Communication method and device

Abstract

The invention relates to the technical field of communication, and discloses a communication method and device. The method comprises the following steps: a first access network device receives a container from each access network device in a plurality of candidate access network devices, and sends the container of each access network device in the plurality of candidate access network devices to a terminal (the containers carry switching parameters); subsequently, after determining that the terminal needs to be switched to a second access network device in the plurality of candidate access network devices, the first access network device sends information used for triggering the terminal to be switched to the second access network device and information used for indicating the first NCC to the terminal through an MAC layer message; furthermore, the terminal can switch to the second access network equipment according to pre-received parameters in a container of the second access network equipment, and determine a key used for communication with the second access network equipment according to the first NCC. Therefore, the secure communication between the terminal and the access network equipment in the LTM cross-station switching scene can be realized.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a communication method and device. Background Art

[0002] Handover is a process initiated by the network side when the terminal is in a connected state, involving signaling interaction between the terminal and the access network device. For example, when the access network device senses that the signal strength of the terminal in its own cell is gradually weakening, it can switch the terminal to the cell of an access network device with better signal strength (for example, a neighboring access network device).

[0003] In order to reduce the switching delay, layer 1 / layer 2 triggered mobility (L1 / L2 triggeredmobility, LTM) switching is currently introduced. LTM switching can be triggered by layer 1 / layer 2 signaling.

[0004] However, for LTM cross-site switching scenarios, how to achieve secure communication between terminals and access network devices still needs further research. Summary of the invention

[0005] The present application provides a communication method and apparatus for implementing secure communication between a terminal and an access network device in an LTM cross-site switching scenario.

[0006] In the first aspect, the present application provides a communication method, which can be applied to a first access network device, or to a processor or chip or chip system or functional module in the first access network device; taking the application of this method to the first access network device as an example, the first access network device receives a container of each access network device in a plurality of candidate access network devices, and the container of each access network device includes parameters for the terminal to switch to each access network device; sends a wireless resource control RRC reconfiguration message to the terminal, and the RRC reconfiguration message includes the container of each access network device in the plurality of candidate access network devices; determines that the terminal needs to switch to a second access network device in the plurality of candidate access network devices; sends a first media access control MAC layer message to the terminal, and the first MAC layer message includes information for triggering the terminal to switch to the second access network device and information for indicating a first NCC, and the first NCC is used to determine the key used by the terminal to communicate with the second access network device.

[0007] Using the above method, the first access network device first sends a container (carrying switching parameters) of each access network device among multiple candidate access network devices to the terminal; then, when the terminal needs to switch to the second access network device, the first access network device sends information indicating the first NCC through a first MAC layer message. Compared with the normal switching process (in the normal switching process, when the source access network device determines that the terminal needs to switch, it needs to first obtain the container of the target access network device from the target access network device (the container carries NCC and switching parameters), and then send the container to the terminal to trigger the terminal to perform the switch), when the first access network device determines that the terminal needs to switch, it can send the first MAC layer message to the terminal to trigger the terminal to perform the switch, thereby reducing the switching delay; and because the first MAC layer message carries information indicating the first NCC, it is convenient to achieve secure communication between the terminal and the second access network device.

[0008] In one possible design, sending a MAC layer message to the terminal includes: the RRC layer of the first access network device passing information used to indicate the first NCC to the MAC layer of the first access network device; and the MAC layer of the first access network device sending the MAC layer message to the terminal.

[0009] In this way, through the information transmission between the RRC layer and the MAC layer in the first access network device, the information used to indicate the first NCC is passed to the MAC layer, so that the MAC layer can encapsulate the information used to indicate the first NCC and the information used to trigger the terminal to switch to the second access network device into a MAC layer message to send to the terminal.

[0010] In one possible design, the method also includes: receiving the first next hop link counter NCC from a mobility management network element; the first NCC is carried on an initial context establishment request message or a path switching response message.

[0011] In this way, the first NCC is obtained by the first access network device from the initial context establishment request message or the path switching response message, and then the terminal can determine the key used for communication between the terminal and the target access network device (i.e., the second access network device) based on the NCC obtained from the source access network device (i.e., the first access network device), thereby facilitating key updates and improving communication security.

[0012] In one possible design, the method further includes: sending a first candidate access network device list to the second access network device, the first candidate access network device list including an identifier of at least one candidate access network device among the multiple candidate access network devices.

[0013] In this way, the first access network device sends the first candidate access network device list to the second access network device, so that when the second access network device determines that the terminal needs to switch, it can determine whether to perform LTM switching based on the first candidate access network device list, so as to improve the success rate of switching. Specifically, since the terminal can successfully switch to the target access network device through LTM switching only when the target access network device sends the constructed container to the terminal in advance, when the second access network device determines that the terminal needs to switch to the third access network device, based on the first candidate access network device list received from the first access network device, if it is determined that the third access network device belongs to the first candidate access network device list, the second access network device can determine to perform LTM switching, and if it is determined that the third access network device does not belong to the first candidate access network device list, the second access network device can determine to perform ordinary switching.

[0014] In a possible design, the information used to indicate the first NCC includes at least one of the following: the first NCC; an index value of the first NCC; and a ciphertext encrypted by the first NCC.

[0015] In one possible design, the method further includes: generating the first MAC layer message. Compared with a normal switching process (in a normal switching process, when the source access network device determines that the terminal needs to switch, it needs to first obtain a container constructed by the target access network device from the target access network device (the container carries the NCC and switching parameters), and then send the container to the terminal), since the first access network device can generate a first MAC layer message containing the NCC and send the first MAC layer message to the terminal when determining that the terminal needs to switch, the switching delay can be reduced.

[0016] In the second aspect, the present application provides a communication method, which can be applied to a second access network device, or to a processor or chip or chip system or functional module in the second access network device; taking the application of this method to the second access network device as an example, the second access network device sends a container of the second access network device to the terminal, and the container includes parameters for the terminal to switch to the second access network device; after the terminal switches from the first access network device to the second access network device, it is determined that the terminal needs to switch to a third access network device among at least one candidate access network device; a second MAC layer message is sent to the terminal, and the second MAC layer message includes information for triggering the terminal to switch to the third access network device and information for indicating a second NCC, and the second NCC is used to determine the key used by the terminal to communicate with the third access network device.

[0017] By adopting the above method, the second access network device can first send a container of the second access network device to the terminal (the container carries the switching parameters). After the terminal switches from the first access network device to the second access network device according to the parameters in the container, if the second access network device determines that the terminal needs to switch to the third access network device, it can send information indicating the second NCC through a second MAC layer message. Compared with the normal switching process (in the normal switching process, when the source access network device determines that the terminal needs to switch, it needs to first obtain the container of the target access network device from the target access network device (the container carries the NCC and switching parameters), and then send the container to the terminal to trigger the terminal to perform the switch), since the second access network device can send a second MAC layer message to the terminal to trigger the terminal to perform the switch when it determines that the terminal needs to switch, it is convenient to reduce the switching delay; and since the second MAC layer message carries information indicating the second NCC, it is convenient to achieve secure communication between the terminal and the third access network device.

[0018] In one possible design, the method further includes: the second access network device generates the second MAC layer message. Compared with the normal switching process (in the normal switching process, when the source access network device determines that the terminal needs to switch, it needs to first obtain the container of the target access network device from the target access network device (the container carries the NCC and switching parameters), and then send the container to the terminal), because the second access network device can generate the second MAC layer message containing the NCC and send the second MAC layer message to the terminal when it determines that the terminal needs to switch, the switching delay can be reduced.

[0019] In one possible design, sending a second MAC layer message to the terminal includes: the RRC layer of the second access network device passing information used to indicate the second NCC to the MAC layer of the second access network device; and the MAC layer of the second access network device sending the second MAC layer message to the terminal.

[0020] In this way, through the information transmission between the RRC layer and the MAC layer in the second access network device, the information used to indicate the second NCC is passed to the MAC layer, so that the MAC layer can encapsulate the information used to indicate the second NCC and the information used to trigger the terminal to switch to the third access network device into a MAC layer message to send to the terminal.

[0021] In one possible design, after the terminal switches to the second access network device, the method also includes: sending a path switching request message to a mobile management network element; receiving a path switching response message from the mobile management network element, the path switching response message including the second NCC and the next hop NH corresponding to the second NCC.

[0022] In this way, the second NCC is obtained by the second access network device from the path switching response message (that is, when performing LTM switching, the second NCC sent to the terminal is obtained by the current source access network device from the path switching response message), which facilitates key update and prevents key reuse when the terminal switches back and forth between multiple access network devices.

[0023] In one possible design, after determining that the terminal needs to switch to the third access network device, the method also includes: determining the key used by the third access network device to communicate with the terminal based on the NH corresponding to the second NCC; and sending the key used by the third access network device to communicate with the terminal to the third access network device.

[0024] In this way, the second access network device can determine the key used by the third access network device to communicate with the terminal according to the NH corresponding to the second NCC, and send it to the third access network device, so that the third access network device and the terminal maintain the same key.

[0025] In one possible design, the method also includes: sending a third MAC layer message to the terminal device, the third MAC layer message including information for indicating the second NCC, the second NCC being used to determine the key used by the terminal to communicate with the second access network device; determining the key used by the terminal to communicate with the second access network device according to the NH corresponding to the second NCC.

[0026] In this way, since the key used by the terminal to communicate with the second access network device is determined by the second NCC stored in the second access network device, the first access network device cannot know the key used by the terminal to communicate with the second access network device, thereby improving communication security.

[0027] In one possible design, after sending the container of the second access network device to the terminal, the method also includes: receiving a first candidate access network device list from the first access network device, the first candidate access network device list including an identifier of the at least one candidate access network device; sending a second MAC layer message to the terminal, including: if it is determined that the third access network device belongs to the first candidate access network device list, sending the second MAC layer message to the terminal.

[0028] In this way, since the terminal can successfully switch to the target access network device through LTM switching only when the target access network device sends the constructed container to the terminal in advance, when the second access network device determines that the terminal needs to switch to the third access network device, based on the first candidate access network device list received from the first access network device, if it is determined that the third access network device belongs to the first candidate access network device list, the second access network device can determine to perform LTM switching, thereby facilitating improving the switching success rate.

[0029] In one possible design, after determining that the terminal needs to switch to a third access network device among at least one candidate access network device, the method further includes: sending a second candidate access network device list to the third access network device, the second candidate access network device list including identifiers of some or all of the candidate access network devices among the at least one candidate access network device.

[0030] In this way, the second access network device sends a second candidate access network device list to the third access network device, so that when the third access network device determines that the terminal needs to switch to other access network devices, it can determine whether to perform LTM switching based on the second candidate access network device list, thereby improving the success rate of the switching.

[0031] In the third aspect, the present application provides a communication method, which can be applied to a terminal, or to a processor or chip or chip system or functional module in a terminal; taking the application of this method to a terminal as an example, the terminal receives a container from each access network device in a plurality of candidate access network devices, the container of each access network device includes parameters for the terminal to switch to each access network device, and the plurality of candidate access network devices include a second access network device; receives a first MAC layer message from a first access network device, the first MAC layer message includes information for triggering the terminal to switch to the second access network device and information for indicating a first NCC; switches to the second access network device according to the parameters in the container of the second access network device; determines the key used by the terminal to communicate with the second access network device according to the first NCC.

[0032] Using the above method, the terminal receives a container (carrying switching parameters in the container) constructed by each access network device from multiple candidate access network devices of the first access network device; then, when the terminal needs to switch to the second access network device, it receives a first MAC layer message (carrying NCC) from the first access network device. Compared with the normal switching process (in the normal switching process, when the source access network device determines that the terminal needs to switch, it needs to first obtain the container (carrying NCC and switching parameters in the container) constructed by the target access network device from the target access network device, and then send the container to the terminal to trigger the terminal to perform the switch), since the first access network device can send the first MAC layer message to the terminal to trigger the terminal to perform the switch, it is convenient to reduce the switching delay; and since the first MAC layer message carries information for indicating the first NCC, it is convenient to achieve secure communication between the terminal and the second access network device.

[0033] It is understandable that the first access network device may be an access network device accessed by the terminal through an initial access process, a normal switching process, a re-establishment process, a cell reselection process, etc. After the terminal accesses the first access network device, the first access network device and the terminal may store the same key (the key is used for the first access network device and the terminal to communicate) and the same NCC (such as the first NCC).

[0034] In one possible design, the key used by the terminal to communicate with the second access network device is determined based on the first NCC, including: after determining that the first NCC is the same as the NCC stored in the terminal, the key used by the terminal to communicate with the second access network device is deduced based on a first input parameter, and the first input parameter includes the key KgNB corresponding to the first NCC and the cell information on the second access network device, such as the PCI and / or carrier frequency of the cell.

[0035] In one possible design, determining the key used by the terminal to communicate with the second access network device based on the first NCC, including: the MAC layer of the terminal passes information used to indicate the first NCC to the RRC layer of the terminal; the RRC layer of the terminal determines the key used by the terminal to communicate with the second access network device based on the first NCC.

[0036] In this way, the information indicating the first NCC is transmitted to the RRC layer through information transmission between the RRC layer and the MAC layer in the terminal, so that the RRC layer determines the key according to the first NCC.

[0037] In one possible design, the multiple candidate access network devices also include a third access network device; after the terminal switches to the second access network device, the method also includes: receiving a second MAC layer message from the second access network device, the second MAC layer message including information for triggering the terminal to switch to the third access network device and information for indicating a second NCC; switching to the third access network device according to parameters in a container of the third access network device; and determining, according to the second NCC, a key used by the terminal to communicate with the third access network device.

[0038] In one possible design, the key used by the terminal to communicate with the third access network device is determined based on the second NCC, including: after determining that the second NCC is different from the NCC stored in the terminal (specifically the first NCC), the key used by the terminal to communicate with the third access network device is deduced based on a second input parameter, and the second input parameter includes the NH corresponding to the second NCC and the cell information on the third access network device.

[0039] In this way, since the second NCC is different from the NCC stored in the terminal, the terminal can perform vertical deduction to obtain the key used by the terminal to communicate with the third access network device, thereby improving communication security.

[0040] In one possible design, the method further includes: after determining that the second NCC is different from the NCC stored in the terminal, updating the NCC stored in the terminal to the second NCC.

[0041] In a fourth aspect, the present application provides a communication method, which can be applied to a terminal, or to a processor or chip or chip system or functional module in a terminal; taking the application of this method to a terminal as an example, the terminal receives a container from each access network device in a plurality of candidate access network devices, the container of each access network device including parameters for the terminal to switch to each access network device, and the plurality of candidate access network devices include a second access network device; receives a first MAC layer message from a first access network device, the first MAC layer message including information for triggering the terminal to switch to the second access network device; switches to the second access network device according to the parameters in the container of the second access network device; receives a third MAC layer message from the second access network device, the third MAC layer message including information for indicating a second NCC; determines the key used by the terminal to communicate with the second access network device according to the second NCC.

[0042] In this way, since the terminal receives information indicating the second NCC from the second access network device after switching to the second access network device, and determines the key used by the terminal to communicate with the second access network device based on the second NCC, the source access network device (i.e., the first access network device) cannot know the key used by the terminal to communicate with the second access network device, thereby improving communication security.

[0043] In one possible design, the first MAC layer message also includes information for indicating a first NCC; the method also includes: determining, based on the first NCC, a key used by the terminal to communicate with the second access network device, and storing the key in an access layer AS security context; wherein, when, based on the second NCC, the key used by the terminal to communicate with the second access network device is determined, the key determined based on the first NCC in the AS security context is updated to the key determined based on the second NCC.

[0044] In this way, the terminal can first determine the key used for communication between the terminal and the second access network device according to the first NCC, so as to securely protect the communication between the terminal and the second access network device during the switching of the terminal to the second access network device.

[0045] In one possible design, the key used by the terminal to communicate with the second access network device is determined based on the first NCC, including: after determining that the first NCC is the same as the NCC stored in the terminal, the key used by the terminal to communicate with the second access network device is deduced based on a first input parameter, and the first input parameter includes the key KgNB corresponding to the first NCC and the cell information on the second access network device.

[0046] In one possible design, the key used by the terminal to communicate with the third access network device is determined based on the second NCC, including: after determining that the second NCC is different from the NCC stored in the terminal, the key used by the terminal to communicate with the second access network device is deduced based on a third input parameter, and the third input parameter includes the NH corresponding to the second NCC and the cell information on the second access network device.

[0047] In this way, since the second NCC is different from the NCC stored in the terminal, the terminal can perform vertical deduction to obtain the key used by the terminal to communicate with the second access network device, thereby improving communication security.

[0048] In one possible design, the method further includes: after determining that the second NCC is different from the NCC stored in the terminal, updating the NCC stored in the terminal to the second NCC.

[0049] In one possible design, determining the key used by the terminal to communicate with the second access network device based on the second NCC, including: the MAC layer of the terminal passes information used to indicate the second NCC to the RRC layer of the terminal; the RRC layer of the terminal determines the key used by the terminal to communicate with the second access network device based on the second NCC.

[0050] In one possible design, the multiple candidate access network devices also include a third access network device; after the terminal switches to the second access network device, the method also includes: receiving a second MAC layer message from the second access network device, the second MAC layer message including information for triggering the terminal to switch to the third access network device; switching to the third access network device according to parameters in the container of the third access network device; receiving a fourth MAC layer message from the third access network device, the fourth MAC layer message including information for indicating a third NCC; and determining, according to the third NCC, a key used by the terminal to communicate with the third access network device.

[0051] In one possible design, the second MAC layer message also includes information for indicating the second NCC; the method also includes: determining, based on the second NCC, the key used by the terminal to send a switching completion message to the third access network device, and storing the key in the AS security context; wherein, when the key used by the terminal to communicate with the third access network device is determined based on the third NCC, the key determined based on the second NCC in the AS security context is updated to the key determined based on the third NCC.

[0052] The communication methods provided in the first to fourth aspects above correspond to each other, and the beneficial effects of the corresponding technical features in the first to fourth aspects can be referenced to each other.

[0053] In the fifth aspect, the present application provides a communication method, which can be applied to a first access network device, or to a processor or chip or chip system or functional module in the first access network device; taking the application of this method to the first access network device as an example, the first access network device sends a switching request message to each access network device in a plurality of candidate access network devices, and the switching request message includes a first NCC; receives a container from each access network device in the plurality of candidate access network devices, and the container of each access network device includes the first NCC; sends an RRC reconfiguration message to the terminal, and the RRC reconfiguration message includes the container of each access network device in the plurality of candidate access network devices; determines that the second access network device to which the terminal needs to switch is an access network device that has not been switched during the continuous LTM switching process for the terminal, and the plurality of candidate access network devices includes the second access network device; sends a first MAC layer message to the terminal, and the first MAC layer message is used to trigger the terminal to switch to the second access network device.

[0054] By adopting the above method, since the container constructed by each access network device among multiple candidate access network devices carries the first NCC, after the terminal switches to any of the access network devices, the key used by the terminal to communicate with the access network device is determined based on the first NCC carried in the container constructed by the access network device (as well as the information of the cell on the access network device), which is relatively simple to implement; further, when performing LTM switching, the first access network device (i.e., the source access network device) can determine whether the second access network device (i.e., the target access network device) is an access network device that has not been switched during the continuous LTM switching process for the terminal. If so, LTM switching can be performed, otherwise ordinary switching is performed, so that when the terminal switches back and forth between multiple candidate access network devices, there will be no problem of key reuse.

[0055] In one possible design, the first NCC included in the container of each access network device is used to determine a key for the terminal to communicate with each access network device.

[0056] In one possible design, the method further includes: receiving the first NCC from a mobility management network element, where the first NCC is carried in an initial context establishment request message or a path switching response message.

[0057] In one possible design, the method further includes: sending the number of LTM consecutive switching times to the second access network device.

[0058] In one possible design, the method further includes: sending a third candidate access network device list to the second access network device, wherein the third candidate access network device list includes an identifier of at least one candidate access network device. For example, the third candidate access network device list includes identifiers of access network devices among multiple candidate access network devices that have not been switched during the continuous LTM switching process of the terminal.

[0059] In this way, the first access network device sends a list of third candidate access network devices to the second access network device, so that when the second access network device determines that the terminal needs to switch to the third access network device, it can determine whether the third access network device is an access network device that has not been switched during the continuous LTM switching process of the terminal based on the list of third candidate access network devices, so that when the terminal switches back and forth between multiple candidate access network devices, there will be no problem of key reuse.

[0060] In the sixth aspect, the present application provides a communication method, which can be applied to a second access network device, or to a processor or chip or chip system or functional module in the second access network device; taking the application of this method to the second access network device as an example, the second access network device receives a switching request message from the first access network device, and the switching request message includes a first NCC; a container of the second access network device is sent to the first access network device, and the container includes the first NCC and parameters for the terminal to switch to the second access network device; the first NCC included in the container is used to determine the key used by the terminal to communicate with the second access network device; after the terminal switches to the second access network device, it is determined that the third access network device to which the terminal needs to switch is an access network device that has not been switched during the continuous LTM switching process for the terminal; a second MAC layer message is sent to the terminal, and the second MAC layer message is used to trigger the terminal to switch to the third access network device.

[0061] Using the above method, since the container constructed by the second access network device includes the first NCC, the terminal can determine the key used for communication between the terminal and the second access network device based on the first NCC, thereby facilitating secure communication between the terminal and the second access network device; when it is determined that the terminal needs to switch to the third access network device, the second access network device (i.e., the source access network device) can determine whether the third access network device (i.e., the target access network device) is an access network device that has not been switched during the continuous LTM switching process of the terminal. If so, LTM switching can be performed, otherwise ordinary switching is performed, so that when the terminal switches back and forth between multiple candidate access network devices, there will be no problem of key reuse.

[0062] In one possible design, after the terminal switches to the second access network device, the method also includes: receiving a second NCC from a mobile management network element, the second NCC being carried in a path switching response message; sending a second MAC layer message to the terminal, including: if the value of the second NCC does not belong to a preset value, sending a second MAC layer message to the terminal.

[0063] In a possible design, the method further includes: if the value of the first NCC belongs to the preset value, sending an RRC reconfiguration message to the terminal, wherein the RRC reconfiguration message is used to trigger the terminal to switch to the third access network device.

[0064] In this way, when the NCC value is a preset value (the preset value may include 0 and 7), that is, when the NCC is about to flip (the value is 7) or has just flipped (the value is 0), a normal switch can be performed to send an updated NCC to the terminal through a switching command message, so as to ensure that the keys deduced by subsequent terminals and access network devices are consistent.

[0065] In one possible design, the method also includes: receiving the number of LTM consecutive switching times from the first access network device; sending a second MAC layer message to the terminal, including: if the number of LTM consecutive switching times is less than or equal to a threshold, sending a second MAC layer message to the terminal.

[0066] In one possible design, the method further includes: if the number of consecutive LTM switching times is greater than the threshold, sending an RRC reconfiguration message to the terminal, and the RRC reconfiguration message is used to trigger the terminal to switch to the third access network device.

[0067] In this way, when the number of consecutive LTM switching is greater than the threshold, a normal switching can be performed to send an updated NCC to the terminal through a switching command message, so as to ensure that the keys subsequently derived by the terminal and the access network device are consistent.

[0068] In one possible design, before the terminal switches to the second access network device, the method also includes: receiving a third candidate access network device list from the first access network device, the third candidate access network device list including an identifier of at least one candidate access network device; determining that the third access network device to which the terminal needs to switch is an access network device that has not been switched during the continuous LTM switching process for the terminal, including: if the third access network device belongs to the third candidate access network device list, determining that the third access network device is an access network device that has not been switched during the continuous LTM switching process for the terminal.

[0069] In one possible design, the method further includes: sending a fourth candidate access network device list to the third access network device, wherein the fourth candidate access network device list does not include an identifier of the second candidate access network device.

[0070] In this way, each time an LTM switch is performed, the source access network device can send a list of candidate access network devices to the target access network device, so that when the target access network device determines that the terminal needs to switch, it can determine whether to perform the LTM switch based on the received list of candidate access network devices, which is relatively simple to implement.

[0071] In the seventh aspect, the present application provides a communication method, which can be applied to a terminal, or to a processor or chip or chip system or functional module in a terminal; taking the application of this method to a terminal as an example, the terminal receives an RRC reconfiguration message from a first access network device, the RRC reconfiguration message includes a container for each access network device in a plurality of candidate access network devices, the container of each access network device includes a first NCC, and the plurality of candidate access network devices include a second access network device; receives a first MAC layer message from the first access network device, the first MAC layer message is used to trigger the terminal to switch to the second access network device; after the terminal switches to the second access network device, uses the key corresponding to the second access network device to communicate with the second access network device, and the key corresponding to the second access network device is determined according to the first NCC.

[0072] In one possible design, the method further includes: determining a key corresponding to the second access network device according to the first NCC. Specifically, when the first NCC is the same as the NCC stored in the terminal, the key corresponding to the second access network device is derived according to a first input parameter, and the first input parameter includes information about a cell on the second access network device.

[0073] In the eighth aspect, the present application provides a communication method, which can be applied to a first access network device, or to a processor or chip or chip system or functional module in the first access network device; taking the application of this method to the first access network device as an example, the first access network device sends a switching request message to multiple candidate access network devices respectively (that is, sends a switching request message to each candidate access network device in the multiple candidate access network devices); receives a container from each access network device in the multiple candidate access network devices, and the container of each access network device includes the NCC corresponding to each access network device; the NCC corresponding to each access network device is used to determine the key used by the terminal to communicate with each access network device; sends an RRC reconfiguration message to the terminal, and the RRC reconfiguration message includes a container constructed by each access network device in the multiple candidate access network devices; wherein the NCC corresponding to each access network device is different, that is, different access network devices in the multiple candidate access network devices correspond to different NCCs.

[0074] By adopting the above method, since the container constructed by each access network device among multiple candidate access network devices carries the NCC corresponding to each access network device, after the terminal switches to any of the access network devices, it determines the key used by the terminal to communicate with the access network device based on the NCC carried in the container constructed by the access network device (as well as the information of the cell on the access network device), thereby improving communication security.

[0075] In one possible design, the method also includes: determining the multiple candidate access network devices, the number of the multiple candidate access network devices is less than or equal to a threshold, and the threshold is determined based on the NCC corresponding to the first access network device.

[0076] In this way, it is easy to ensure that different access network devices of multiple candidate access network devices correspond to different NCCs. For example, the threshold is equal to the maximum value of the NCC minus the NCC corresponding to the first access network device; that is, the number of candidate access network devices determined by the first access network device should be less than or equal to the threshold to avoid the same NCC corresponding to different access network devices.

[0077] In one possible design, the method also includes: determining that the second access network device that the terminal needs to switch to is an access network device that has not been switched during the continuous LTM switching process of the terminal; sending a first MAC layer message to the terminal, and the first MAC layer message is used to trigger the terminal to switch to the second access network device.

[0078] In this way, when executing LTM switching, the first access network device (i.e., the source access network device) can determine whether the second access network device (i.e., the target access network device) is an access network device that has not been switched during the continuous LTM switching process for the terminal. If so, LTM switching can be performed, otherwise normal switching is performed, so that when the terminal switches back and forth between multiple candidate access network devices, there will be no problem of key reuse.

[0079] In one possible design, the method further includes: sending a third candidate access network device list to the second access network device, wherein the third candidate access network device list includes an identifier of at least one candidate access network device. For example, the third candidate access network device list includes identifiers of access network devices among multiple candidate access network devices that have not been switched during the continuous LTM switching process of the terminal.

[0080] In this way, the first access network device can send a third candidate access network device list to the second access network device, so that when the second access network device determines that the terminal needs to switch, it can determine whether to perform LTM switching based on the received third candidate access network device list, which is relatively simple to implement.

[0081] In the ninth aspect, the present application provides a communication method, which can be applied to a second access network device, or to a processor or chip or chip system or functional module in the second access network device; taking the application of this method to the second access network device as an example, the second access network device receives a switching request message from the first access network device; after receiving the switching request message, sends a request message to a mobile management network element, and the request message is used to request the NCC corresponding to the second access network device; receives the NCC from the core network device; sends a switching request confirmation message to the first access network device, and the switching request confirmation message includes a container constructed by the second access network device, and the container includes the NCC, and the NCC is used to determine the key used by the terminal to communicate with the second access network device.

[0082] In this way, since the NCC carried in the container constructed by the second access network device is obtained by the second access network device from the mobility management network element, the NCC corresponding to the second access network device is different from that of other candidate access network devices, which facilitates improving communication security.

[0083] In one possible design, the switching request message includes indication information, and the indication information is used to indicate that the switching request message corresponds to LTM switching.

[0084] In this way, the second access network device may request the mobility management network element for the NCC corresponding to the second access network device in response to the handover request message.

[0085] In one possible design, the method further includes: receiving an NH corresponding to the NCC from the core network device; and determining a key used to communicate with the terminal based on the NH corresponding to the NCC.

[0086] In one possible design, after the terminal switches from the first access network device to the second access network device, the method further includes: determining that a third access network device to which the terminal needs to switch is an access network device that has not been switched during the continuous LTM switching process of the terminal; and sending a second MAC layer message to the terminal, the second MAC layer message being used to trigger the terminal to switch to the third access network device.

[0087] In this way, when executing LTM switching, the second access network device (i.e., the source access network device) can determine whether the third access network device (i.e., the target access network device) is an access network device that has not been switched during the continuous LTM switching process for the terminal. If so, LTM switching can be performed, otherwise normal switching is performed, so that when the terminal switches back and forth between multiple candidate access network devices, there will be no problem of key reuse.

[0088] In one possible design, before the terminal switches from the first access network device to the second access network device, the method also includes: receiving a third candidate access network device list from the first access network device; determining that the third access network device to which the terminal needs to switch is an access network device that has not been switched during the continuous LTM switching process for the terminal, including: if the third access network device belongs to the third candidate access network device list, determining that the third access network device is an access network device that has not been switched during the continuous LTM switching process for the terminal.

[0089] In one possible design, the method further includes: sending a second candidate access network device list to the third access network device, the second candidate access network device list not including an identifier of the second candidate access network device.

[0090] In the tenth aspect, the present application provides a communication method, which can be applied to a terminal, or to a processor or chip or chip system or functional module in a terminal; taking the application of this method to a terminal as an example, the terminal receives an RRC reconfiguration message from a first access network device, and the RRC reconfiguration message includes the identifiers of multiple candidate access network devices and the correspondence between multiple NCCs; according to the NCCs corresponding to the multiple candidate access network devices, the keys corresponding to the multiple candidate access network devices are determined; wherein the NCCs corresponding to different access network devices in the multiple candidate access network devices are different; a first MAC layer message is received from the first access network device, and the first MAC layer message is used to trigger the terminal to switch to the second access network device, and the multiple candidate access network devices include a second access network device; after the terminal switches to the second access network device, the key corresponding to the second access network device is used to communicate with the second access network device.

[0091] In one possible design, the key corresponding to the second access network device is determined according to the NCC corresponding to the second access network device, including: deducing the key corresponding to the second access network device according to a second input parameter; the second input parameter includes the NH corresponding to the NCC corresponding to the second access network device and the information of the cell on the second access network device.

[0092] In one possible design, the method further includes: based on the multiple NCCs, deducing NHs corresponding to the multiple NCCs in sequence in ascending order of the NCCs.

[0093] In this way, the terminal derives the NHs corresponding to the multiple NCCs in ascending order, thereby facilitating rapid derivation of the NH and reducing the processing burden of the terminal.

[0094] In one possible design, the multiple candidate access network devices also include a third access network device; the method also includes: receiving a second MAC layer message from the second access network device, the second MAC layer message being used to trigger the terminal to switch to the third access network device; after the terminal switches to the third access network device, using the key corresponding to the third access network device to communicate with the third access network device.

[0095] In one possible design, the method further includes: in response to the second MAC layer message, deleting the NCC corresponding to the second access network device. In this way, it is convenient to release the storage resources of the terminal in a timely manner.

[0096] In the eleventh aspect, the present application provides a communication device, which has the function of implementing any one of the first to tenth aspects above. For example, the communication device includes a module or unit or means corresponding to the operation involved in any one of the first to tenth aspects above. The function or unit or means can be implemented by software, or by hardware, or the corresponding software can be implemented by hardware.

[0097] In a possible design, the communication device includes a processing unit and a communication unit, wherein the communication unit can be used to send and receive signals to achieve communication between the communication device and other devices, for example, the communication unit is used to send system information to a terminal; the processing unit can be used to perform some internal operations of the communication device. The functions performed by the processing unit and the communication unit can correspond to the operations involved in any one of the first to tenth aspects above.

[0098] In one possible design, the communication device includes a processor, which can be used to couple with a memory. The memory can store necessary computer programs or instructions for implementing the functions involved in any one of the first to tenth aspects. The processor can execute the computer program or instructions stored in the memory, and when the computer program or instructions are executed, the communication device implements the method in any possible design or implementation of any one of the first to tenth aspects.

[0099] In a possible design, the communication device includes a processor and a memory, and the memory can store necessary computer programs or instructions for implementing the functions involved in the first to tenth aspects. The processor can execute the computer program or instructions stored in the memory, and when the computer program or instructions are executed, the communication device implements the method in any possible design or implementation of any aspect of the first to tenth aspects.

[0100] In one possible design, the communication device includes a processor and an interface circuit, wherein the processor is used to communicate with other devices through the interface circuit and execute the method in any possible design or implementation of any one of the first to tenth aspects above.

[0101] It can be understood that in the third aspect above, the processor can be implemented by hardware or by software. When implemented by hardware, the processor can be a logic circuit, an integrated circuit, etc.; when implemented by software, the processor can be a general-purpose processor, which is implemented by reading the software code stored in the memory. In addition, the above processors can be one or more, and the memories can be one or more. The memory can be integrated with the processor, or the memory can be separately set from the processor. In the specific implementation process, the memory can be integrated with the processor on the same chip, or can be set on different chips respectively. The embodiment of the present application does not limit the type of memory and the setting method of the memory and the processor.

[0102] In the twelfth aspect, the present application provides a communication system, which may include a first access network, a second access network device and a terminal. The first access network device is used to execute the method described in the first aspect, the second access network device is used to execute the method described in the second aspect, and the terminal is used to execute the method described in the third or fourth aspect; or, the first access network device is used to execute the method described in the fifth aspect, the second access network device is used to execute the method described in the sixth aspect, and the terminal is used to execute the method described in the seventh aspect; or, the first access network device is used to execute the method described in the eighth aspect, the second access network device is used to execute the method described in the ninth aspect, and the terminal is used to execute the method described in the tenth aspect.

[0103] In the thirteenth aspect, the present application provides a computer-readable storage medium, in which a computer program (or computer-readable instructions) is stored. When a computer reads and executes part or all of the computer-readable instructions, the method in any possible design of the above-mentioned first to tenth aspects is executed.

[0104] Exemplarily, a computer-readable storage medium can be any available medium that can be accessed by a computer. By way of example but not limitation, a computer-readable medium can include a non-transitory computer-readable medium, a random-access memory (RAM), a read-only memory (ROM), an electrically erasable programmable read-only memory (EEPROM), a CD-ROM or other optical disk storage, a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and can be accessed by a computer.

[0105] In a fourteenth aspect, the present application provides a computer program product. When a computer reads and executes the computer program product, the method in any possible design of the above-mentioned first to tenth aspects is executed.

[0106] In the fifteenth aspect, the present application provides a chip (or chip system), wherein the chip includes a processor, the processor is coupled to a memory, and the memory stores a computer program; the processor is used to call part or all of the computer program in the memory, so that the method in any possible design of the above-mentioned first to tenth aspects is executed. BRIEF DESCRIPTION OF THE DRAWINGS

[0107] Figure 1 A schematic diagram of a network architecture applicable to an embodiment of the present application;

[0108] Figure 2 A schematic diagram of a process for performing key derivation on an access network device and a terminal provided in an embodiment of the present application;

[0109] Figure 3 A possible flow chart of a common cross-site handover provided in an embodiment of the present application;

[0110] Figure 4 A possible flow chart of LTM cross-site switching provided in an embodiment of the present application;

[0111] Figure 5 A flow chart corresponding to the communication method provided in the embodiment of the present application;

[0112] Figure 6 A flow chart corresponding to the communication method provided in the embodiment of the present application;

[0113] Figure 7 A flow chart corresponding to the communication method provided in the embodiment of the present application;

[0114] Figure 8 A flow chart corresponding to the communication method provided in the embodiment of the present application;

[0115] Fig. 9 A flow chart corresponding to the communication method provided in the embodiment of the present application;

[0116] Fig.10 A flow chart corresponding to the communication method provided in the embodiment of the present application;

[0117] Fig.11 A flow chart corresponding to the communication method provided in the embodiment of the present application;

[0118] Fig.12 A possible exemplary block diagram of the device involved in the embodiments of the present application;

[0119] Fig.13 A schematic diagram of the structure of a communication device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0120] In order to make the purpose, technical solution and advantages of the present application more clear, the present application will be further described in detail below in conjunction with the accompanying drawings. The specific operation method in the method embodiment can also be applied to the device embodiment or the system embodiment.

[0121] The terms "first", "second", etc. and other various terminology labels, etc. (if any) in the specification and claims and drawings of the present application are used to distinguish similar objects, and are not necessarily used to describe a specific order or precedence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0122] The technical solution provided in this application can be applied to various communication systems, such as: fifth generation (5th generation, 5G) or new radio (new radio, NR) system, long term evolution (long term evolution, LTE) system, LTE frequency division duplex (frequency division duplex, FDD) system, LTE time division duplex (time division duplex, TDD) system, etc. The technical solution provided in this application can also be applied to future communication systems, such as the sixth generation mobile communication system. The technical solution provided in this application can also be applied to device to device (D2D) communication, vehicle to everything (V2X) communication, machine to machine (M2M) communication, machine type communication (MTC), and Internet of things (IoT) communication system or other communication systems.

[0123] The following will be combined Figure 1 (a) and Figure 1(b) in the figure illustrates a 5G system to which the present application is applicable. It should be understood that the 5G system described herein is only an example and does not constitute any limitation to the present application. It should also be understood that certain network elements in the 5G system may communicate using a service-oriented interface or a point-to-point interface. Figure 1 (a) and Figure 1 (b) in the figure introduces the 5G system framework based on point-to-point interface and the 5G system framework based on service-oriented interface respectively.

[0124] As an example, Figure 1 (a) shows a schematic diagram of the architecture of a 5G system 100a to which an embodiment of the present application is applicable. Figure 1 (a) is a schematic diagram of the 5G network architecture based on service-oriented interfaces. Figure 1 As shown in (a), the network architecture may include but is not limited to the following network elements (or referred to as functional network elements, functional entities, nodes, devices, etc.):

[0125] (Radio) access network (R)AN) equipment, access and mobility management function (AMF) network element, session management function (SMF) network element, user plane function (UPF) network element, policy control function (PCF) network element, unified data management (UDM) network element, application function (AF) network element, data network (DN), authentication server function (AUSF) network element, unified data management (UDM) network element, unified data repository (UDR), etc.

[0126] Below Figure 1 The network elements shown in (a) are briefly introduced as follows:

[0127] 1. User equipment (UE): can be called terminal equipment, terminal device, access terminal, user unit, user station, mobile station, mobile station (MS), mobile terminal (MT), remote station, remote terminal, mobile device, user terminal, terminal, wireless communication device, user agent or user device. A terminal can be a device that provides voice / data connectivity to a user, such as a handheld device with wireless connection function, a vehicle-mounted device, etc. At present, some examples of terminals may include: mobile phones, tablet computers, computers with wireless transceiver functions (such as laptop computers, PDAs, etc.), mobile Internet devices (MIDs), virtual reality (VR) devices, augmented reality (AR) devices, wireless terminals in industrial control, wireless terminals in self-driving, wireless terminals in remote medical, wireless terminals in smart grids, wireless terminals in transportation safety, wireless terminals in smart cities, wireless terminals in smart homes, cellular phones, cordless phones, session initiation protocol (SIP) phones, wireless local loop (WLL) stations, personal digital assistants (PDAs), handheld devices with wireless communication functions, computing devices or other processing devices connected to wireless modems, vehicle-mounted devices, wearable devices, terminal devices in 5G networks or future evolved public land mobile communication networks (public land mobile network, PLMN) terminals, etc.

[0128] In addition, the terminal can also be a terminal in the Internet of Things (IoT) system. IoT is an important part of the future development of information technology. Its main technical feature is to connect objects to the network through communication technology, thereby realizing an intelligent network of human-machine interconnection and object-to-object interconnection. IoT technology can achieve massive connections, deep coverage, and terminal power saving through narrow band (NB) technology, for example.

[0129] In addition, the terminal can also include smart printers, train detectors, etc. Its main functions include collecting data (part of the terminal equipment), receiving control information and downlink data from network equipment, and sending electromagnetic waves to transmit uplink data to network equipment.

[0130] It should be understood that the terminal can be any device that can access the network. The terminal and the access network device can communicate with each other using a certain air interface technology.

[0131] Optionally, the terminal can be used to act as a base station. For example, the terminal can act as a scheduling entity that provides sidelink signals between terminals in V2X or D2D, etc. For example, a cell phone and a car communicate with each other using sidelink signals. A cell phone and a smart home device communicate with each other without relaying the communication signal through a base station.

[0132] 2. (Wireless) access network equipment: referred to as access network equipment in the embodiments of the present application, which is used to provide network access functions for authorized user equipment in a specific area, and can use transmission tunnels with different service qualities according to the level of the user equipment, business requirements, etc.

[0133] Access network equipment can manage wireless resources, provide access services for user equipment, and then complete the forwarding of control signals and data between user equipment and the core network. Access network equipment can also be understood as base stations in traditional networks.

[0134] Exemplarily, the access network device in the embodiment of the present application can be any communication device with wireless transceiver function for communicating with user equipment. The access network device includes but is not limited to an evolved NodeB (eNB) or a gNB in ​​a 5G system, or a transmission point (TRP or TP), or one or a group of (including multiple antenna panels) antenna panels of a base station in a 5G system, or can also be a network node constituting a gNB or a transmission point, such as a baseband unit (BBU), or a distributed unit (DU), etc.

[0135] In some deployments, the gNB may include a centralized unit (CU) and a DU. The gNB may also include an active antenna unit (AAU). The CU implements some functions of the gNB, and the DU implements some functions of the gNB. For example, the CU is responsible for processing non-real-time protocols and services, and implementing the functions of the radio resource control (RRC) and packet data convergence protocol (PDCP) layers. The DU is responsible for processing physical layer protocols and real-time services, and implementing the functions of the radio link control (RLC) layer, the media access control (MAC) layer, and the physical (PHY) layer. The AAU implements some physical layer processing functions, radio frequency processing, and related functions of active antennas. Since the information of the RRC layer will eventually become the information of the PHY layer, or be converted from the information of the PHY layer, under this architecture, high-level signaling, such as RRC layer signaling, can also be considered to be sent by the DU, or, sent by the DU+AAU. It can be understood that the access network device can be a device including one or more of a CU node, a DU node, and an AAU node. In addition, the CU may be divided into an access network device in an access network, or the CU may be divided into an access network device in a core network (CN), and this application does not limit this.

[0136] 3. UPF network element: used for packet routing and forwarding, as well as quality of service (QoS) processing of user plane data.

[0137] 4. AMF network element: The access and mobility management function network element is mainly used for mobility management and access management, etc. It can be used to implement other functions of MME except session management, such as access authorization / authentication and other functions.

[0138] 5. SMF network element: mainly used for session management, allocation and management of Internet protocol (IP) addresses of user equipment, selection of endpoints of manageable user plane functions, policy control and charging function interfaces, and downlink data notification.

[0139] 6. PCF network element: a unified policy framework used to guide network behavior and provide policy rule information for control plane functional network elements (such as AMF, SMF, etc.).

[0140] 7. AF: used for data routing affected by applications, open functional network elements of wireless access networks, and interaction with the policy framework for policy control.

[0141] 8. UDM network element: used to process UE identification, access authentication, registration and mobility management, etc.

[0142] 9. AUSF network element: used for authentication services and key generation to achieve two-way authentication of user devices and support a unified authentication framework.

[0143] 10. UDR: used to store the contract information of UDM network elements, policy information of PCF network elements, etc.

[0144] 11. DN: DN is a network outside the operator network. The operator network can access multiple DNs. Multiple services can be deployed on DN, which can provide data and / or voice services to terminal devices. For example, DN is the private network of a smart factory. The sensors installed in the workshop of the smart factory can be terminal devices. The control server of the sensors is deployed in DN, and the control server can provide services for the sensors. The sensors can communicate with the control server, obtain instructions from the control server, and transmit the collected sensor data to the control server according to the instructions. For another example, DN is the internal office network of a company. The mobile phones or computers of the company's employees can be terminal devices. The employees' mobile phones or computers can access information, data resources, etc. on the company's internal office network.

[0145] Figure 1 In (a), Nausf, Nnef, Npcf, Nudm, Naf, Namf, Nsmf, N1, N2, N3, N4, and N6 are interface serial numbers. The meanings of these interface serial numbers can be found in the meanings defined in the 3GPP standard protocol and are not limited here.

[0146] exist Figure 1 In the network architecture shown in (a), each network element can communicate with each other through the interface shown in the figure. For example, the UE and AMF can interact through the N1 interface, and the interaction message can be called an N1 message (N1 Message). The RAN and AMF can interact through the N2 interface, and the N2 interface can be used to send non-access stratum (NAS) messages, etc. The RAN and UPF can interact through the N3 interface, and the N3 interface can be used to transmit user plane data, etc. The SMF and UPF can interact through the N4 interface, and the N4 interface can be used to transmit information such as tunnel identification information of the N3 connection, data cache indication information, and downlink data notification messages. The UPF and DN can interact through the N6 interface, and the N6 interface can be used to transmit user plane data, etc. The relationship between other interfaces and each network element is as follows: Figure 1 As shown in (a), for the sake of brevity, they are not described in detail here.

[0147] like Figure 1 (b) is a schematic diagram of a 5G network architecture based on a point-to-point interface. The functions of the network elements can be found in Figure 1 The introduction of the functions of the corresponding network elements in (a) will not be repeated here. Figure 1 (b) and Figure 1 The main difference of (a) is that: Figure 1 The interfaces between the network elements in (b) are point-to-point interfaces rather than service-oriented interfaces.

[0148] exist Figure 1 In the architecture shown in (b), the interface names and functions between the network elements are as follows:

[0149] 1) N7: The interface between PCF and SMF, used to send protocol data unit (PDU) session granularity and service data flow granularity control strategy.

[0150] 2) N15: Interface between PCF and AMF, used to deliver UE policies and access control related policies.

[0151] 3) N5: Interface between AF and PCF, used for issuing application service requests and reporting network events.

[0152] 4) N4: The interface between SMF and UPF is used to transfer information between the control plane and the user plane, including the control of the forwarding rules, QoS control rules, traffic statistics rules, etc. for the user plane and the reporting of information on the user plane.

[0153] 5) N11: The interface between SMF and AMF, used to transfer PDU session tunnel information between RAN and UPF, transfer control messages sent to UE, transfer radio resource control information sent to RAN, etc.

[0154] 6) N2: The interface between AMF and RAN, used to transmit radio bearer control information from the core network side to the RAN.

[0155] 7) N1: The interface between AMF and UE, access-independent, used to deliver QoS control rules, etc. to the UE.

[0156] 8) N8: Interface between AMF and UDM, used by AMF to obtain access and mobility management related subscription data and authentication data from UDM, and AMF to register UE's current mobility management related information with UDM.

[0157] 9) N10: The interface between SMF and UDM, used by SMF to obtain session management related subscription data from UDM, and SMF to register UE current session related information with UDM.

[0158] 10) N35: Interface between UDM and UDR, used by UDM to obtain user contract data information from UDR.

[0159] 11) N36: Interface between PCF and UDR, used by PCF to obtain policy-related contract data and application data-related information from UDR.

[0160] 12) N12: Interface between AMF and AUSF, used by AMF to initiate an authentication process to AUSF, which can carry SUCI as a contract identifier;

[0161] 13) N13: Interface between UDM and AUSF, used by AUSF to obtain the user authentication vector from UDM to execute the authentication process.

[0162] In order to facilitate the understanding of the embodiments of the present application, some of the terms involved in the present application are exemplified below. It is understandable that the terms given below are explained using the current NR system as an example, but it should be understood that in other communication systems (such as the future sixth-generation communication system), the following terms may have other names, and this application does not limit this.

[0163] 1. Key deduction

[0164] To ensure secure data transmission between the terminal and the network, both the terminal and the network need to perform the same key derivation to ensure that the terminal and the network use the same key. The "network side" may include access network equipment (such as gNB). The word "derive" may also be replaced by "derive" or other descriptions without limitation.

[0165] The parameters related to key derivation include the next hop (NH) and the NH link counter (NCC).

[0166] NH: Whenever an access stratum (AS) security context needs to be established between the terminal and the access network device, the mobility management network element (such as the AMF network element) and the terminal derive KgNB and NH. NH is derived by the terminal and the AMF network element using chain derivation, that is, the NH generated this time will be used to generate the next NH, so that NH can be provided to the gNB from the AMF network element in a forward secure manner.

[0167] NCC: Issued by the AMF network element, associated with each KgNB and NH, used to count the number of NH key chain derivations and the key chain between the synchronization terminal and the access network equipment, and determine whether the next KNG-RAN* is derived from the current KgNB or from a new NH. Each KgNB is associated with the NCC corresponding to the NH value. At initial access, the KgNB is derived directly from the KAMF, and it can be considered that the KgNB is associated with a virtual NH with NCC=0. At initial access, the derived NH is associated with NCC=1.

[0168] Among them, KNG-RAN* is the intermediate key between the terminal and the access network device when performing horizontal or vertical key derivation. KNG-RAN* is used as KgNB after switching. KNG-RAN* can be derived from the currently activated KgNB or NH. If KNG-RAN* is derived from the currently activated KgNB, it is called horizontal key derivation, and the access network device instructs the terminal not to add NCC. If KNG-RAN* is derived from NH, it is called vertical key derivation, and the access network device instructs the terminal to add NCC. If there is an unused {NH,NCC} in the current access network device, vertical key derivation is used. If there is no unused {NH,NCC} pair in the current access network device, horizontal key derivation is used. For example, at the time of initial access, since the AMF network element does not send NH to the access network device at this time, the next switch can only use horizontal key derivation.

[0169] The following uses the network side as an example to explain key deduction in detail. The terminal side can be used as a reference for understanding and will not be elaborated on here.

[0170] Figure 2 Schematic diagram of the process of performing key derivation for access network devices and terminals.

[0171] Horizontal deduction:

[0172] During initial access, the gNB can deduce the initial key KgNB based on the key KAMF and the NAS uplink count value, and deduce KgNB1 based on the initial key KgNB. Subsequently, if horizontal deduction is to be performed, the gNB can deduce the key KgNB2 based on KgNB1, the physical cell identifier (PCI) of the cell where the terminal currently resides, and the carrier frequency, such as the downlink carrier frequency (DL frequency). If horizontal deduction continues, the gNB can deduce the key KgNB3 based on the key KgNB2, the PCI of the cell where the terminal currently resides, and the carrier frequency. And so on, the key KgNB is iteratively updated to ensure communication security.

[0173] Vertical deduction:

[0174] The AMF network element can update the NCC (for example, when path migration or switching occurs during the switching process, the AMF network element can update the NCC). If NCC1 is updated to NCC2, the AMF network element deduces NH2 based on the keys KAMF and NH1. NH2 is associated with NCC2 as a new pair {NH2, NCC2}. The AMF network element can send {NH2, NCC2} to the gNB. After receiving {NH2, NCC2}, the gNB can perform vertical deduction when it needs to deduce KNG-RAN*, that is, deduce the key KgNB4 based on NH2, the PCI of the cell where the terminal is currently located, and the carrier frequency, and so on.

[0175] according to Figure 2 It can be seen that the number of vertical deductions can be determined by the difference before and after the NCC value is updated. For example, if the NCC value is updated from NCC0 to NCC1, one vertical deduction can be performed based on NH0 related to NCC0 to obtain NH1 related to NCC1. If the NCC value is updated from NCC0 to NCC2, two vertical deductions can be performed based on NH0 related to NCC0 to obtain NH2 related to NCC2. If the NCC value is updated from NCC2 to NCC3, one vertical deduction can be performed based on NH2 related to NCC2 to obtain NH3 related to NCC3.

[0176] 2. Handover

[0177] Handover is a process in which the terminal is in the RRC connection state, which is initiated by the network side and involves signaling interaction between the terminal and the access network device. For example, when the access network device perceives that the signal strength of the terminal in its own cell is gradually weakening, it can switch the terminal to the cell of an access network device with better signal strength (for example, a neighboring access network device). It can be understood that the handover can be the terminal switching between cells of different access network devices (i.e., cross-site handover), such as the terminal device switching from the cell of access network device 1 to the cell of access network device 2; or, it can also refer to the terminal switching between cells of the same access network device, such as the terminal device switching from cell 1 of access network device 1 to cell 2 of access network device 1. The embodiment of the present application will be described using the cross-site handover scenario as an example.

[0178] The handover process triggered by layer 3 signaling may be referred to as layer 3 handover (L3 handover) or normal handover. Layer 3 may refer to the RRC layer, layer 1 hereinafter may refer to the physical layer, and layer 2 hereinafter may refer to the MAC layer.

[0179] Figure 3 The figure is a possible flow chart of common cross-site switching. Figure 3The cross-site handover shown includes the terminal switching from access network device 0 to access network device 1, and then switching from access network device 1 to access network device 2. Figure 3 As shown, the process includes:

[0180] S301, the terminal is connected to 5GC through access network device 0.

[0181] The terminal can access the access network device 0 through the initial access process, the normal switching process, the re-establishment process, or the cell reselection process, and access the 5GC through the access network device 0. Furthermore, the key KgNB (referred to as K0 for ease of description) and NCC0 (K0 is associated with NCC0) are respectively stored on the terminal and the access network device 0, and NCC0 is stored on the AMF network element.

[0182] It should be noted that the number after NCC in the embodiment of the present application is only used to distinguish different NCCs, and does not represent a specific NCC value; for example, NCC0 is used to represent the NCC value used on access network device 0, and does not limit the NCC value to 0. The symbols K0, K1, K2, K1 * , K2 * etc., all refer to the keys for security protection between the terminal and the access network equipment, such as Figure 2 The KgNB, KgNB1 to KgNB12 involved in the * or K2 * Specifically, it refers to which KgNB can be related to the scene, and the embodiments of the present application do not limit this.

[0183] S302: Access network device 0 determines that the terminal needs to be switched.

[0184] As the terminal moves, for example, the terminal gradually moves away from access network device 0, access network device 0 can sense that the signal strength of the terminal gradually weakens. When the signal strength of the terminal weakens to a certain extent, access network device 0 determines that the terminal needs to be switched to an access network device with better signal strength, so that an access network device with better signal strength can be selected from various candidate access network devices, such as access network device 1.

[0185] As a possible implementation, the terminal can measure at least one candidate cell and send a measurement report to access network device 0, where the measurement report includes the signal strength of at least one candidate cell, and at least one candidate cell belongs to at least one candidate access network device; accordingly, access network device 0 can select a cell with better signal strength (i.e., the target cell) from at least one candidate cell based on the measurement report, for example, the access network device to which the target cell belongs (i.e., the target access network device) is access network device 1.

[0186] S303 : Access network device 0 sends a handover request message to access network device 1 . Correspondingly, access network device 1 receives the handover request message from access network device 0 .

[0187] For example, access network device 0 can horizontally deduce key K1 based on K0, PCI of the cell on access network device 1, and carrier frequency. The handover request message may include NCC0 and K1, and the handover request message is used to request that the terminal be handed over to access network device 1; after receiving the handover request information, access network device 1 can save NCC0 and K1.

[0188] It can be understood that here, the key K1 is obtained by horizontal deduction of the access network device 0 (that is, the NCC value on the access network device 0 has not changed) as an example. In other examples, if the access network device 0 determines that the current NCC value is increased compared with the previous NCC value, the key K1 can also be vertically deduced according to the PCI and carrier frequency of the cell on NH0 and the access network device 1. * , and save NCC0 and K1 * .

[0189] S304, the access network device 1 constructs a transparent container.

[0190] If the access network device 1 allows the terminal to switch, the access network device 1 can construct a transparent container, which carries the above-mentioned received NCC0.

[0191] The transparent container also carries configuration information, which includes parameters for the terminal to switch to the access network device 1 .

[0192] In the embodiments of the present application, for the convenience of description, the transparent container is referred to as a container.

[0193] S305 , access network device 1 sends a handover request ACK message to access network device 0 , where the message carries the container. Correspondingly, access network device 0 receives the handover request ACK message from access network device 1 .

[0194] The handover request confirmation message is used to indicate that the access network device 1 allows the terminal to switch. For example, the current resources of the access network device 1 are sufficient, and more terminals are allowed to switch in. The handover request confirmation message may include a container constructed by the access network device 1.

[0195] Alternatively, in other examples, the handover request confirmation message may also be used to indicate that the access network device 1 does not allow the terminal to switch. For example, the current resources of the access network device 1 are insufficient and no more terminals are allowed to switch in. This process is illustrated by taking the example of the access network device 1 allowing the terminal to switch.

[0196] S306, the access network device 0 sends a switching command message to the terminal; correspondingly, the terminal receives the switching command message.

[0197] The handover command message may be an RRC reconfiguration message, and the RRC reconfiguration message carries the container.

[0198] S307, the terminal deduce the key.

[0199] The terminal can obtain NCC0 from the container. If the NCC0 obtained from the container is the same as the NCC value stored locally in the terminal, the terminal can perform horizontal deduction, that is, derive the key K1 according to K0, the PCI of the cell on the access network device 1, and the carrier frequency. In this way, the terminal and the access network device 1 maintain the same key, that is, K1.

[0200] In other examples, if the NCC0 obtained from the container is different from the NCC value stored locally in the terminal, the terminal can first calculate the NH0 corresponding to NCC0, and then vertically deduce the key K1 according to NH0, the PCI of the cell on the access network device 1, and the carrier frequency. * In this way, the terminal and access network device 1 maintain the same key, namely K1 * .

[0201] It can be understood that, through the above operations, the access network device 1 cannot know the key (ie, K0) shared by the terminal and the access network device 0, thereby protecting the security of past communications from being affected by the access network device 1.

[0202] S308, the terminal detaches from access network device 0 and sends a handover completion message to access network device 1. Correspondingly, access network device 1 receives the handover completion message from the terminal.

[0203] The handover completion message may be an RRC reconfiguration complete message.

[0204] S309, access network device 1 sends a path switching request message to the AMF network element; accordingly, the AMF network element receives the path switching request message.

[0205] S310, the AMF network element sends a path switching response message to access network device 1; accordingly, access network device 1 receives the path switching response message, thereby completing the path switching.

[0206] Path switching means that the data transmission path of the terminal is switched from "UPF network element─access network device 0─terminal" to "UPF network element─access network device 1─terminal". That is to say, before the path switching, the downlink data is sent from the UPF network element to the access network device 0, and then from the access network device 0 to the terminal; the uplink data is sent from the terminal to the access network device 0, and then from the access network device 0 to the UPF network element; after the path switching, the downlink data is sent from the UPF network element to the access network device 1, and then from the access network device 1 to the terminal; the uplink data is sent from the terminal to the access network device 1, and then from the access network device 1 to the UPF network element.

[0207] After receiving the path switching request message, the AMF network element can update the locally saved NCC value by adding 1 to obtain an updated NCC (called NCC1), and perform key deduction based on the updated NCC to obtain an updated NH (called NH1). NCC1 and NH1 are associated as an updated pair {NH1, NCC1}.

[0208] The path switch response message includes {NH1, NCC1}. After receiving the path switch response message, the access network device 1 may save {NH1, NCC1}.

[0209] S311, the terminal communicates with access network device 1 using key K1.

[0210] Here, "the terminal and the access network device 1 communicate using the key K1" may mean: the terminal and the access network device 1 communicate using the key K1 itself; or it may mean: the terminal and the access network device 1 communicate using the confidentiality protection key and the integrity protection key derived from the key K1. Other similar descriptions in the following of this application may be handled with reference to this.

[0211] S312, the access network device 1 determines that the terminal needs to be switched.

[0212] The specific implementation of access network device 1 determining that the terminal needs to switch can refer to the description of access network device 0 determining that the terminal needs to switch. Access network device 1 can select an access network device with better signal strength from various candidate access network devices, such as access network device 2.

[0213] S313 , access network device 1 sends a switching request message to access network device 2 . Correspondingly, access network device 2 receives the switching request message from access network device 1 .

[0214] Access network device 1 can deduce key K2 based on NH1, PCI and carrier frequency of the cell on access network device 2. *, and sends a handover request message to access network device 2. The handover request message is used to request that the terminal be handed over to access network device 2. The handover request message may include NCC1 and K2 * After receiving the handover request message, the access network device 1 can save NCC1 and K2 * .

[0215] S314, access network device 2 constructs a container.

[0216] If the access network device 2 allows the terminal to switch, the access network device 2 may construct a container carrying the received NCC1.

[0217] The container also carries configuration information, which includes parameters used for the terminal to switch to the access network device 2.

[0218] S315 , the access network device 2 sends a handover request confirmation message to the access network device 1 . Correspondingly, the access network device 1 receives the handover request confirmation message from the access network device 2 .

[0219] The handover request confirmation message is used to instruct the access network device 2 to allow the terminal to switch. The handover request confirmation message may include a container constructed by the access network device 2.

[0220] Alternatively, in other examples, the handover request confirmation message may also be used to indicate that the access network device 1 does not allow the terminal to handover. This process is illustrated by taking the example that the access network device 1 allows the terminal to handover.

[0221] S316, the access network device 1 sends a switching command message to the terminal; correspondingly, the terminal receives the switching command message.

[0222] The handover command message may be an RRC reconfiguration message, and the RRC reconfiguration message carries the above container.

[0223] S317, the terminal deduce the key.

[0224] The terminal can obtain NCC1 from the container. Since the NCC1 obtained from the container is different from the NCC0 stored locally in the terminal, the terminal performs a corresponding number of vertical deductions based on the difference between NCC1 and NCC0 to obtain the corresponding NH (i.e., NH1), and then deduces the key K2 based on NH1, the PCI of the cell on the access network device 2, and the carrier frequency. * In this way, the terminal and access network device 2 maintain the same key, namely K2 * .

[0225] It is understandable that, through the above operations, the access network device 2 cannot know the key (ie, K1) shared by the terminal and the access network device 1, thereby protecting the security of past communications from being affected by the access network device 2.

[0226] S318, the terminal detaches from the access network device 1, and sends a handover completion message to the access network device 2. Correspondingly, the access network device 2 receives the handover completion message from the terminal.

[0227] The handover complete message may be an RRC reconfiguration complete message.

[0228] S319, access network device 2 sends a path switching request message to the AMF network element; accordingly, the AMF network element receives the path switching request message.

[0229] S320, the AMF network element sends a path switching response message to access network device 2; accordingly, access network device 2 receives the path switching response message, thereby completing the path switching.

[0230] Path switching means that the data transmission path of the terminal is switched from "UPF network element─access network device 1─terminal" to "UPF network element─access network device 2─terminal".

[0231] After receiving the path switching request message, the AMF network element can update the locally saved NCC value by adding 1 to obtain an updated NCC (called NCC2), and perform deduction based on the updated NCC to obtain an updated NH (called NH2). NCC2 is associated with NH2 as an updated pair {NH2, NCC2}.

[0232] The path switch response message includes {NH2, NCC2}. After receiving the path switch response message, the access network device 2 may save {NH2, NCC2}.

[0233] S321, the terminal and access network device 2 use key K2 * to communicate.

[0234] It is understandable that the terminal may subsequently switch from access network device 2 to other access network devices (such as access network device 3). For specific implementation, reference may be made to the description of the terminal switching from access network device 1 to access network device 2.

[0235] Using the above Figure 3 In the process shown in FIG. 1 , access network device 0 knows the key shared by the terminal and access network device 1 (ie, K1), but cannot know the key shared by the terminal and access network device 2 (ie, K2). * ), and it is impossible to know the key shared by the terminal and the subsequent target access network device, so two-hop security can be achieved.

[0236] In order to reduce the switching delay, LTM switching or layer 1 / layer 2 switching is introduced. Different from layer 3 switching, LTM switching can be triggered by layer 1 / layer 2 signaling. Since layer 1 and layer 2 are located at a lower level of the protocol stack than the RRC layer (layer 3), it is easy to reduce the switching delay.

[0237] Figure 4 The following is a possible flow chart of LTM cross-site switching. Since there is no specific solution for the security protection of LTM cross-site switching, the process here does not involve security-related content. Figure 4 As shown, the process includes:

[0238] S401, the terminal is connected to 5GC through access network device 0.

[0239] The terminal can access the access network device 0 through the initial access process, the normal switching process, the re-establishment process, the cell reselection process, etc., and access the 5GC through the access network device 0.

[0240] S402, access network device 0 determines multiple candidate access network devices for LTM switching.

[0241] As a possible implementation, the terminal can measure multiple candidate cells and send a measurement report to the access network device 0, where the measurement report includes the signal strength of the multiple candidate cells, and the multiple candidate cells belong to multiple candidate access network devices; accordingly, the access network device 0 can select a cell with better signal strength from the multiple candidate cells based on the measurement report, and the access network devices to which the selected multiple cells belong are the candidate access network devices for LTM switching.

[0242] As another possible implementation, the access network device 0 can obtain the historical movement trajectory information of the terminal, determine the list of cells that the terminal frequently switches in and out of based on the historical movement trajectory information, and then determine multiple candidate access network devices for LTM switching based on the list of cells that the terminal frequently switches in and out of.

[0243] In this process, description is given by taking the case where candidate access network devices for LTM switching include access network device 1 and access network device 2 as an example.

[0244] S403 : Access network device 0 sends a handover request message 1 to access network device 1 . Correspondingly, access network device 1 receives the handover request message 1 from access network device 0 .

[0245] Optionally, the handover request message 1 (and the handover request message 2 described below) may include identifiers of multiple candidate access network devices for LTM handover.

[0246] S404, access network device 1 constructs a container.

[0247] If the access network device 1 allows the terminal to perform LTM switching, the access network device 1 can construct a container. The container carries the identification and configuration information of the access network device 1. The configuration information includes parameters for the terminal to switch to the access network device 1, such as the SSB frequency point and beam information of the access network device 1.

[0248] S405 , the access network device 1 sends a handover request confirmation message 1 to the access network device 0 . Accordingly, the access network device 0 receives the handover request confirmation message 1 from the access network device 1 .

[0249] S406 , access network device 0 sends a handover request message 2 to access network device 2 . Correspondingly, access network device 2 receives the handover request message 2 from access network device 0 .

[0250] S407, access network device 2 constructs a container.

[0251] If the access network device 2 allows the terminal to perform LTM switching, the access network device 2 can construct a container. The container carries the identification and configuration information of the access network device 2. The configuration information includes parameters for the terminal to switch to the access network device 2, such as the SSB frequency point and beam information of the access network device 2.

[0252] S408 , access network device 2 sends a handover request confirmation message 2 to access network device 0 . Correspondingly, access network device 0 receives the handover request confirmation message 2 from access network device 1 .

[0253] S409, access network device 0 sends an RRC reconfiguration message to the terminal, where the RRC reconfiguration message carries a container constructed by access network device 1 and a container constructed by access network device 2; accordingly, the terminal receives the RRC reconfiguration message.

[0254] The terminal obtains the container constructed by access network device 1 and the container constructed by access network device 2 from the RRC reconfiguration message and saves them.

[0255] S410, the terminal sends an RRC reconfiguration completion message to the access network device 0; correspondingly, the access network device 0 receives the RRC reconfiguration completion message from the terminal.

[0256] S411, access network device 0 determines that the terminal needs to be switched, and the target access network device for switching is access network device 1.

[0257] There are many specific implementations of the access network device 0 determining the target access network device, which is not limited in the present embodiment. For example, the access network device 0 can determine that the target access network device is the access network device 1 according to the measurement report reported by the terminal.

[0258] S412: Access network device 0 sends a handover command message to the terminal. Correspondingly, the terminal receives the handover command message from access network device 0.

[0259] The handover command message is a MAC layer message, such as a MAC control element (CE). The handover command message includes an identifier of a target access network device, that is, an identifier of the access network device 1 .

[0260] S413, the terminal detaches from the access network device 0, and sends a handover completion message to the access network device 1. Correspondingly, the access network device 1 receives the handover completion message from the terminal.

[0261] The handover complete message may be an RRC reconfiguration complete message.

[0262] Optionally, if the switching request message 1 does not include the identifiers of multiple candidate access network devices for LTM switching, after the access network device 0 determines that the terminal needs to switch to the access network device 1, it can send the identifiers of multiple candidate access network devices for LTM switching to the access network device 1 via the Xn message.

[0263] S414, access network device 1 sends a path switching request message to the AMF network element; accordingly, the AMF network element receives the path switching request message.

[0264] S415, the AMF network element sends a path switching response message to access network device 1; accordingly, access network device 1 receives the path switching response message, thereby completing the path switching.

[0265] Here, path switching means that the data transmission path of the terminal is switched from "UPF network element─access network device 0─terminal" to "UPF network element─access network device 1─terminal".

[0266] S416, the terminal communicates with access network device 1 (eg, data transmission).

[0267] S417, access network device 1 determines that the terminal needs to be switched, and the target access network device for switching is access network device 2.

[0268] S418, the access network device 1 sends a switching command message to the terminal. Correspondingly, the terminal receives the switching command message from the access network device 1.

[0269] The handover command message is a MAC layer message, such as MAC CE. The handover command message includes the identifier of the target access network device, that is, the identifier of the access network device 2.

[0270] It can be understood that the access network device 1 can determine whether the target access network device (i.e., the access network device 2) is a candidate access network device for LTM switching. If the target access network device is a candidate access network device for LTM switching, the access network device 1 can send a MAC CE to the terminal to perform LTM cross-site switching. Optionally, if the target access network device is not a candidate access network device for LTM switching, the access network device 1 can send an RRC reconfiguration message to the terminal to perform a normal cross-site switching.

[0271] S419, the terminal detaches from the access network device 1, and sends a handover completion message to the access network device 2. Correspondingly, the access network device 2 receives the handover completion message from the terminal.

[0272] The handover complete message may be an RRC reconfiguration complete message.

[0273] Optionally, if the switching request message 2 does not include the identifiers of multiple candidate access network devices for LTM switching, after the access network device 1 determines that the terminal needs to switch to the access network device 2, it can send the identifiers of multiple candidate access network devices for LTM switching to the access network device 2 via the Xn message.

[0274] S420, access network device 2 sends a path switching request message to the AMF network element; accordingly, the AMF network element receives the path switching request message.

[0275] S421, the AMF network element sends a path switching response message to access network device 2; accordingly, access network device 2 receives the path switching response message and completes the path switching.

[0276] Here, path switching refers to the switching of the data transmission path of the terminal from "UPF network element─access network device 1─terminal" to "UPF network element─access network device 2─terminal".

[0277] S422, the terminal communicates with access network device 2 (eg, data transmission).

[0278] It can be understood that if the candidate access network devices for LTM switching also include access network device 3, the subsequent terminal can also switch from access network device 2 to access network device 3. The specific implementation can refer to the description of the terminal switching from access network device 1 to access network device 2.

[0279] According to the above-mentioned ordinary cross-site handover process and LTM cross-site handover process, it can be seen that: in ordinary cross-site handover, the source access network device can select one target access network device and instruct the terminal to switch to the target access network device through the RRC reconfiguration message. After the terminal switches to the target access network device, the current handover ends; in the next handover, the terminal will receive a new RRC reconfiguration message, that is, each handover will trigger the RRC reconfiguration process. In LTM cross-base station handover, the source access network device determines multiple candidate access network devices for LTM handover and sends containers constructed by multiple candidate access network devices to the terminal; subsequently, the source access network device can instruct the terminal to switch to the target access network device through MAC CE, that is, each handover does not trigger the RRC reconfiguration process.

[0280] In the embodiments of the present application, research will be conducted on the implementation of secure communication between a terminal and an access network device in an LTM cross-site switching scenario.

[0281] Exemplarily, the communication method provided in the embodiment of the present application includes three possible schemes (Scheme 1, Scheme 2 and Scheme 3) for realizing secure communication between the terminal and the access network device in the LTM cross-site switching scenario.

[0282] In solution 1, the first access network device receives the container constructed by each access network device among multiple candidate access network devices, and sends the container constructed by each access network device among multiple candidate access network devices to the terminal (the container carries the switching parameters); subsequently, after the first access network device determines that the terminal needs to switch to the second access network device among multiple candidate access network devices, it sends information for triggering the terminal to switch to the second access network device and information for indicating the first NCC to the terminal through a MAC layer message; further, the terminal can switch to the second access network device according to the parameters in the container constructed by the second access network device received in advance, and determine the key used for communicating with the second access network device according to the first NCC. In this way, secure communication between the terminal and the second access network device can be achieved.

[0283] In the second scheme, the first access network device sends the first NCC to multiple candidate access network devices, and receives the container constructed by each of the multiple candidate access network devices, and the container constructed by each access network device may include the first NCC; subsequently, after the first access network device determines that the terminal needs to switch to the second access network device among the multiple candidate access network devices, it triggers the terminal to switch to the second access network device through a MAC layer message; further, the terminal can switch to the second access network device according to the parameters in the container constructed by the second access network device received in advance, and determine the key used for communication with the second access network device according to the first NCC in the container constructed by the second access network device received in advance. In this way, secure communication between the terminal and the second access network device can be achieved.

[0284] In scheme three, the first access network device sends a switching request message to multiple candidate access network devices respectively. After receiving the switching request message, each access network device in the multiple candidate access network devices obtains the NCC corresponding to each access network device from the mobile management network element, and sends the container constructed by each access network device to the first access network device. The container constructed by each access network device includes the NCC corresponding to each access network device, and the NCCs corresponding to different access network devices in the multiple candidate access network devices are different. Subsequently, after the first access network device determines that the terminal needs to switch to the second access network device in the multiple candidate access network devices, it triggers the terminal to switch to the second access network device through a MAC layer message. Then, the terminal can switch to the second access network device according to the parameters in the container constructed by the second access network device received in advance, and determine the key used for communication with the second access network device according to the NCC in the container constructed by the second access network device received in advance. In this way, secure communication between the terminal and the second access network device can be achieved.

[0285] It can be understood that the above description of Scheme 1 to Scheme 3 is only to make the embodiments of the present application easier to understand, and should not be regarded as a strict limitation of the technical features in the scope of protection required by the present application, that is, not all of the technical features involved in the above description are necessary technical features.

[0286] The embodiments of the present application are described in detail below in conjunction with Embodiments 1 to 7.

[0287] Embodiment 1

[0288] In the first embodiment, scheme 1 will be described in detail.

[0289] Figure 5 This is a flow chart corresponding to the communication method provided in the embodiment of the present application. Figure 5 As shown, the process may include:

[0290] S501: A first access network device receives a container from each access network device among a plurality of candidate access network devices, where the container of each access network device includes parameters for a terminal to switch to each access network device.

[0291] Here, the container of each access network device may specifically refer to a container constructed by each access network device.

[0292] The first access network device may be an access network device accessed by the terminal through an initial access process, a common handover process, a re-establishment process, a cell reselection process, etc. The first access network device and the terminal may store the same key (the key is used for communication between the first access network device and the terminal) and the same NCC (such as the first NCC).

[0293] For example, if the first access network device is an access network device accessed by the terminal through an initial access process or cell reselection, the AMF network element may send a first NCC to the first access network device through an NGAP message, and then the first access network device may save the first NCC. Specifically, in the initial access process, the NGAP message is an initial context setup request message. If the first access network device is an access network device accessed by the terminal through a re-establishment process, the first access network device may also receive the first NCC through a retrieve UE context response message and save the first NCC. If the first access network device is an access network device accessed by the terminal through a normal switching process, the first access network device may receive the first NCC through a path switching response message and save the first NCC; optionally, the first access network device may perform RRC reconfiguration on the terminal through an RRC reconfiguration message so that the terminal and the first access network device save the same NCC (i.e., the first NCC); if the first access network device does not perform RRC reconfiguration on the terminal, the NCCs saved by the terminal and the first access network device may be different. The embodiments of the present application are described by taking "the terminal and the first access network device store the same NCC" as an example.

[0294] Exemplarily, the first access network device can determine multiple candidate access network devices for LTM switching, and send switching request messages to the multiple candidate access network devices respectively, for requesting the multiple candidate access network devices to construct containers. Among them, the container constructed by each access network device in the multiple candidate access network devices includes parameters for the terminal to switch to each access network device, for example, the container constructed by the second access network device in the multiple candidate access network devices includes parameters for the terminal to switch to the second access network device (such as SSB frequency information, beam information, etc.), and the container constructed by the third access network device in the multiple candidate access network devices includes parameters for the terminal to switch to the third access network device (such as SSB frequency information, beam information, etc.). For details, please refer to the description in S402 to S408.

[0295] S502, the first access network device sends an RRC reconfiguration message to the terminal, where the RRC reconfiguration message includes a container constructed by each access network device in a plurality of candidate access network devices; accordingly, the terminal receives the RRC reconfiguration message.

[0296] After receiving the RRC reconfiguration message, the terminal may parse the RRC reconfiguration message to obtain a container constructed by each access network device in the plurality of candidate access network devices. Optionally, the terminal may send an RRC reconfiguration completion message to the first access network device.

[0297] The above S501 and S502 can be understood as a handover preparation process.

[0298] S503: The first access network device determines that the terminal needs to switch to a second access network device among multiple candidate access network devices.

[0299] There are many ways to implement the first access network device to determine that the terminal needs to switch to the second access network device. For example, the terminal can measure at least one candidate cell and send a measurement report to the first access network device, where the measurement report includes the signal strength of at least one candidate cell; accordingly, the first access network device can select a cell with better signal strength (i.e., a target cell) from at least one candidate cell based on the measurement report, for example, the access network device to which the target cell belongs (i.e., the target access network device) is the second access network device, that is, the first access network device determines that the terminal needs to switch to the second access network device.

[0300] It is understandable that the description here is based on the example that the target access network device selected by the first access network device is the second access network device among multiple candidate access network devices; in other examples, the target access network device selected by the first access network device may not belong to the multiple candidate access network devices. If the target access network device selected by the first access network device does not belong to the multiple candidate access network devices, the first access network device can trigger the terminal to perform a normal cross-site handover.

[0301] S504, the first access network device sends a first MAC layer message (ie, a switching command message) to the terminal, where the first MAC layer message includes information for triggering the terminal to switch to the second access network device and information for indicating the first NCC; accordingly, the terminal receives the first MAC layer message.

[0302] Exemplarily, the information for triggering the terminal to switch to the second access network device may include an identifier of the second access network device. The information for indicating the first NCC may include at least one of the following: the first NCC; the index value of the first NCC; the ciphertext encrypted by the first NCC. The first NCC may be an NCC stored in the first access network device (such as the RRC layer of the first access network device).

[0303] Here, the description is given by taking the example of information used to trigger the terminal to switch to the second access network device and information used to indicate the first NCC being carried in the same MAC layer message (i.e., the first MAC layer message). In other examples, the information used to trigger the terminal to switch to the second access network device and the information used to indicate the first NCC may also carry different MAC layer messages.

[0304] Exemplarily, from the perspective of the first access network device, after the first access network device determines that the terminal needs to switch to the second access network device, it can generate a first MAC layer message and send the first MAC layer message. Compared with the normal switching process (in the normal switching process, when the source access network device determines that the terminal needs to switch, it needs to first obtain the container constructed by the target access network device from the target access network device (the container carries NCC and switching parameters), and then send the container to the terminal), when the first access network device determines that the terminal needs to switch, it can generate the first MAC layer message containing information for indicating the first NCC by itself, and send the first MAC layer message to the terminal, thereby reducing the switching delay.

[0305] Among them, the RRC layer of the first access network device can pass the information used to indicate the first NCC to the MAC layer of the first access network device, and then the first MAC layer message generated by the MAC layer of the first access network device includes the information used to indicate the first NCC. For example, the RRC layer of the first access network device passes the first NCC to the MAC layer of the first access network device, and then the MAC layer of the first access network device encapsulates the first NCC into the first MAC layer message; for another example, the RRC layer of the first access network device obtains the index value of the first NCC (or the encrypted ciphertext of the first NCC, here taking the index value of the first NCC as an example) based on the stored first NCC, and passes the index value of the first NCC to the MAC layer of the first access network device, and then the MAC layer of the first access network device encapsulates the index value of the first NCC into the first MAC layer message and sends it to the terminal.

[0306] Exemplarily, from the perspective of the terminal, after receiving the first MAC layer message, the terminal can determine the key (referred to as key 1) used by the terminal to communicate with the second access network device according to the first NCC carried by the first MAC layer message. Here, key 1 can be the key KgNB (for example, Figure 2 It may be a KgNB in ​​the deduction process shown in the figure), or it may be a confidentiality protection key and / or integrity protection key derived based on the key KgNB. Please refer to the introduction of "the terminal and access network device 1 use key K1 to communicate" in S311 above. In the embodiment of the present application, "key 1 is the key KgNB for security protection between the terminal and the second access network device" will be mainly described as an example. Other similar points (such as key 2 below) can be understood by reference.

[0307] For example, the MAC layer of the terminal obtains information indicating the first NCC from the first MAC layer message. The MAC layer of the terminal transmits the information indicating the first NCC to the RRC layer of the terminal, and then the RRC layer of the terminal can determine the key 1 according to the first NCC.

[0308] There are many specific implementations of the terminal determining the key 1 according to the first NCC. For example, the terminal can compare the first NCC with the NCC stored locally in the terminal. Since the two are the same, the terminal can horizontally deduce the key used by the terminal to communicate with the second access network device according to the first input parameter. The first input parameter includes the PCI and carrier frequency of the cell of the second access network device, and also includes the key KgNB for security protection between the terminal and the first access network device.

[0309] S505: The terminal switches to the second access network device according to the parameters in the container constructed by the second access network device.

[0310] For example, the terminal can initiate a random access process to the second access network device according to the parameters in the container constructed by the second access network device, so as to synchronize with the second access network device through the random access process; after the synchronization is completed, the terminal can send a switching completion message to the second access network device. Among them, the switching completion message can be an RRC reconfiguration completion message. It can be understood that when the parameters in the container constructed by the second access network device contain all the information required for access, the terminal may not read the system message. Exemplarily, when the beam information is included in the container, the terminal selects the corresponding beam and establishes a connection with the second access network device.

[0311] Exemplarily, the terminal may send a switching completion message to the second access network device according to key 1.

[0312] S506, the second access network device obtains the second NCC from the AMF network element.

[0313] Optionally, the second access network device also receives the NH corresponding to the second NCC from the AMF network element. The second access network device can save the second NCC and the NH corresponding to the second NCC.

[0314] Exemplarily, the second access network device can send a path switching request message to the AMF network element. Accordingly, after receiving the path switching request message, the AMF network element can update the locally stored NCC value (i.e., the first NCC) by adding 1 to obtain the updated NCC (i.e., the second NCC), perform key deduction according to the updated NCC, obtain the NH corresponding to the second NCC, and send a path switching response message to the second access network device. The path switching response message includes the second NCC and the NH corresponding to the second NCC. For example, the second access network device can send a path switching request message to the AMF network element in response to a switching completion message sent by the terminal.

[0315] S507: The terminal and the second access network device communicate using key 1.

[0316] That is to say, key 1 can be used for communication between the terminal and the second access network device during the switching process (for example, the terminal can use key 1 to send a switching completion message to the second access network device), and can also be used for communication between the terminal and the second access network device after the switching is completed (such as the communication involved in S507).

[0317] As described above, the implementation of the terminal determining the key has been introduced. From the perspective of the second access network device, the second access network device can maintain the same key as key 1 (also referred to as key 1 for ease of description) so as to use key 1 to communicate with the terminal. Here, the implementation of the second access network device obtaining key 1 is described. As a possible implementation, in the switching preparation process, after determining multiple candidate access network devices, the first access network device can respectively determine the keys of multiple candidate access network devices and send them to the corresponding access network devices through a switching request message. Taking the second access network device among the multiple candidate access network devices as an example, the first access network device can horizontally deduce key 1 according to the first input parameter, and send key 1 to the second access network device through a switching request message. Optionally, when requesting the second access network device to construct a container, the first access network device can send a first NCC to the second access network device (that is, the switching request message can include the first NCC), and then the container constructed by the second access network device can include the first NCC. The above-mentioned first MAC layer message does not need to carry information for indicating the first NCC, and the terminal can obtain the first NCC from the container constructed by the second access network device.

[0318] As another possible implementation, after the first access network device determines that the terminal needs to switch to the second access network device, it can horizontally deduce key 1 based on the first input parameter, and send key 1 to the second access network device through an Xn message (that is, the Xn message includes key 1). Optionally, the Xn message also includes a first NCC.

[0319] The above S506 may be executed before S507, or S506 may be executed after S507, or S506 and S507 may be executed simultaneously. The embodiment of the present application does not limit the order in which the steps are executed.

[0320] Optionally, after the terminal switches from the first access network device to the second access network device, the method further includes:

[0321] S508: The second access network device determines that the terminal needs to switch to a third access network device among at least one candidate access network device.

[0322] Here, the implementation of the second access network device determining that the terminal needs to switch to the third access network device can refer to the description of "the first access network device determines that the terminal needs to switch to the second access network device" above.

[0323] As a possible implementation, at least one candidate access network device is the above-mentioned multiple candidate access network devices. After the first access network device determines multiple candidate access network devices, it can send a first candidate access network device list to the multiple candidate access network devices respectively through a switching request message, and the first candidate access network device list includes the identifiers of the multiple candidate access network devices; or, after the first access network device determines that the terminal needs to switch to the second access network device, it can send the first candidate access network device list to the second access network device through the above-mentioned Xn message.

[0324] As another possible implementation, at least one candidate access network device includes some or all of the access network devices among the multiple candidate access network devices. After the first access network device determines that the terminal needs to switch to the second access network device, it can select some or all of the access network devices (i.e., select at least one candidate access network device) from the multiple candidate access network devices based on a variety of possible factors (such as the load on the candidate access network device, etc.), and send a first candidate access network device list to the second access network device through the above-mentioned Xn message, and the first candidate access network device list includes the identifier of the selected at least one candidate access network device.

[0325] Optionally, for this implementation, the first access network device may also send identifiers of multiple candidate access network devices to the second access network device, for example, through a switching request message or the above-mentioned Xn message, without specific limitation.

[0326] S509, the second access network device sends a key (referred to as key 2) used by the third access network device to communicate with the terminal to the third access network device; correspondingly, the third access network device receives the key.

[0327] After the second access network device determines that the terminal needs to switch to the third access network device, it can deduce key 2 based on the NH corresponding to the second NCC obtained from the AMF network element, the PCI of the cell on the third access network device, and the carrier frequency, and send key 2 to the third access network device through the Xn message. Optionally, the Xn message also includes the second NCC.

[0328] Optionally, the Xn message may also include a second candidate access network device list, and the second candidate access network device list may be the identifiers of some or all candidate access network devices in the first candidate access network device list. For example, after the second access network device determines that the terminal needs to switch to the third access network device, it may select some or all access network devices from multiple candidate access network devices based on a variety of possible factors (such as the load on the candidate access network device, etc.) (the selected access network device is the access network device in the second candidate access network device list), and send the second candidate access network device list to the third access network device through the Xn message.

[0329] S510, the second access network device sends a second MAC layer message (i.e., a switching command message) to the terminal. The second MAC layer message includes information for triggering the terminal to switch to the third access network device and information for indicating the second NCC. The second NCC is used to determine the key used by the terminal to communicate with the third access network device.

[0330] The information used to trigger the terminal to switch to the third access network device may include an identifier of the third access network device.

[0331] The information used to indicate the second NCC may include at least one of the following: the second NCC; the index value of the second NCC; the ciphertext encrypted by the second NCC. The second NCC may be the NCC stored in the second access network device (such as the RRC layer of the second access network device).

[0332] Exemplarily, from the perspective of the second access network device, after the second access network device determines that the terminal needs to switch to the third access network device, it can generate a second MAC layer message and send the second MAC layer message. Compared with the normal switching process (in the normal switching process, when the source access network device determines that the terminal needs to switch, it needs to first obtain the container constructed by the target access network device from the target access network device (the container carries the NCC and switching parameters), and then send the container to the terminal), when the second access network device determines that the terminal needs to switch, it can generate a second MAC layer message containing information for indicating the second NCC by itself, and send the second MAC layer message to the terminal, thereby reducing the switching delay. For example, the RRC layer of the second access network device transmits the information for indicating the second NCC to the MAC layer of the second access network device, and then the second MAC layer message generated by the MAC layer of the second access network device includes information for indicating the second NCC.

[0333] Exemplarily, from the perspective of the terminal, after receiving the second MAC layer message, the terminal can determine the key (referred to as key 2) used by the terminal to communicate with the third access network device according to the second NCC carried by the second MAC layer message. For example, the MAC layer of the terminal obtains information indicating the second NCC from the second MAC layer message. The MAC layer of the terminal transmits the information indicating the second NCC to the RRC layer of the terminal, and then the RRC layer of the terminal can determine key 2 according to the second NCC.

[0334] There are multiple specific implementations of the terminal determining the key 2 according to the second NCC. For example, the terminal can compare the second NCC with the NCC (i.e., the first NCC) stored locally in the terminal. Since the second NCC is different from the first NCC, the terminal can deduce the NH corresponding to the second NCC according to the difference between the second NCC and the first NCC, and deduce the key 2 according to the NH corresponding to the second NCC, the PCI of the cell of the third access network device, and the carrier frequency. In addition, after determining that the second NCC is different from the NCC stored locally in the terminal, the terminal can update the locally stored NCC to the second NCC.

[0335] The embodiment of the present application does not limit the execution order of S509 and S510. S509 may be executed before S520, or S509 may be executed before S510, or S509 and S510 may be executed simultaneously.

[0336] S511: The terminal switches to the third access network device according to the parameters in the container constructed by the third access network device.

[0337] The implementation here may refer to the description of S505.

[0338] S512, the third access network device obtains the third NCC from the AMF network element.

[0339] Exemplarily, in response to the terminal switching to a third access network device (for example, the third access network device receives a switching completion message from the terminal), the third access network device can obtain a third NCC from the AMF network element.

[0340] Optionally, the third access network device also receives the NH corresponding to the third NCC from the AMF network element, and saves the third NCC and the NH corresponding to the third NCC.

[0341] For example, the third access network device can send a path switching request message to the AMF network element. Accordingly, after receiving the path switching request message, the AMF network element can update the locally stored NCC value (i.e., the second NCC) by 1 to obtain an updated NCC (i.e., the third NCC), and perform key deduction according to the updated NCC to obtain the NH corresponding to the third NCC, and send a path switching response message to the third access network device. The path switching response message includes the third NCC and the NH corresponding to the third NCC.

[0342] S513: The terminal communicates with the third access network device using key 2.

[0343] Exemplarily, the terminal derives key 2 according to the second NCC carried in the second MAC layer message, and the third access network device receives key 2 from the second access network device. Therefore, the terminal and the third access network device can use key 2 to communicate.

[0344] Using the above method, the first access network device first sends a container constructed by each access network device among multiple candidate access network devices to the terminal (the container carries the switching parameters); then, after determining that the terminal needs to switch to the second access network device, the information used to indicate the first NCC is sent through the first MAC layer message. Compared with the normal switching process (in the normal switching process, when the source access network device determines that the terminal needs to switch, it needs to first obtain the container constructed by the target access network device from the target access network device (the container carries the NCC and switching parameters), and then send the container to the terminal to trigger the terminal to perform the switch), since the first access network device can send the first MAC layer message to the terminal to trigger the terminal to perform the switch when it determines that the terminal needs to switch, it is convenient to reduce the switching delay; and since the first MAC layer message carries the information used to indicate the first NCC, it is convenient to achieve secure communication between the terminal and the second access network device.

[0345] Furthermore, since the LTM switch performs a switching preparation process in S501-S502, if the NCC is carried in the container during the switching preparation process, the NCC carried in the container will all be the first NCC, which will make it impossible to achieve vertical deduction; in an embodiment of the present application, the NCC is carried by a MAC layer message, which facilitates the access network device and the terminal to deduce and use the updated key for secure communication based on the updated NCC.

[0346] It is understandable that when performing LTM switching, the source access network device can send the NCC obtained by the source access network device to the terminal through a MAC layer message, so that the terminal can determine the key used by the terminal to communicate with the target access network device according to the NCC, which is convenient for key update, so that when the terminal switches back and forth between multiple access network devices, there will be no problem of key reuse. In addition, the first access network device knows the key shared by the terminal and the second access network device (the key shared by the terminal and the second access network device is obtained by horizontal deduction), but cannot know the key shared by the terminal and the third access network device (the key shared by the terminal and the third access network device is obtained by vertical deduction), nor can it know the key shared by the terminal and the subsequent target access network device (the key shared by the terminal and the subsequent target access network device is obtained by vertical deduction), so that two-hop security can be achieved.

[0347] The above is described using the example of "the terminal determines the key used for communication between the terminal and the target access network device according to the NCC carried in the switching command message". In this case, the terminal can determine the key used for communication between the terminal and the second access network device according to the first NCC, and store it in the AS security context of the terminal. In other possible examples, after S506, the second access network device can send a third MAC layer message to the terminal, and the third MAC layer message may include a second NCC (the NCC is obtained by the second access network device from the AMF network element in S506); accordingly, after receiving the third MAC layer message, the terminal can determine the key used for communication between the terminal and the second access network device according to the second NCC; in this case, in S507, the key used for communication between the terminal and the second access network device is a key determined according to the second NCC. Among them, when the terminal determines the key used for communication between the terminal and the second access network device based on the second NCC, the terminal can update the key determined according to the first NCC in the AS security context to the key determined according to the second NCC (that is, the key used by the terminal for communication with the second access network device determined by the first NCC is invalid), and then the terminal and the second access network device can use the key determined by the second NCC for communication; optionally, the terminal can delete the key used by the terminal for communication with the second access network device determined by the first NCC.

[0348] That is to say, before the terminal determines the key used for communication between the terminal and the second access network device based on the second NCC, the key used for communication between the terminal and the second access network device is the key determined according to the first NCC, and after the terminal determines the key used for communication between the terminal and the second access network device based on the second NCC, the key used for communication between the terminal and the second access network device is the key determined according to the second NCC; for example, during the switching process, the key used for communication between the terminal and the second access network device is the key determined according to the first NCC, and after the switching is completed, the second access network device can send a third MAC layer message to the terminal, and then after the switching is completed, the key used for communication between the terminal and the second access network device is the key determined according to the second NCC.

[0349] Similarly, in S510, the terminal can determine the key used for communicating with the third access network device based on the second NCC, and store it in the AS security context; after S511, the third access network device can send a fourth MAC layer message to the terminal, and the fourth MAC layer message may include a third NCC (the NCC is obtained by the third access network device from the AMF network element in S512); accordingly, after receiving the fourth MAC layer message, the terminal can determine the key used for communicating with the third access network device based on the third NCC, and update the key determined according to the second NCC in the AS security context to the key determined according to the third NCC (that is, the key used by the terminal for communicating with the third access network device determined according to the second NCC is invalid); in this case, in S513, the key used for communicating with the third access network device is the key determined according to the third NCC.

[0350] In this way, the first access network device is unaware of the key shared by the terminal and the second access network device, and is also unaware of the key shared by the terminal and the third access network device, thereby achieving one-hop security.

[0351] In addition, the above-mentioned embodiment 1 only describes the implementation of the terminal switching from the first access network device to the second access network device, and switching from the second access network device to the third access network device. The terminal may subsequently perform one or more LTM switchings in succession, such as switching from the third access network device to the fourth access network device. The specific implementation of "the terminal switching from the third access network device to the fourth access network device" can refer to the description of "the terminal switching from the second access network device to the third access network device". In other words, the above-mentioned description of "the terminal switching from the second access network device to the third access network device" can be applied to the switching of the terminal between multiple candidate access network devices for LTM switching.

[0352] Based on the first embodiment, two possible implementation processes are described below in combination with the second embodiment (corresponding to two-hop security) and the third embodiment (corresponding to one-hop security). In the second and third embodiments, the "first access network device" in the first embodiment is access network device 0, the "second access network device" is access network device 1, and the "third access network device" is access network device 2.

[0353] Embodiment 2

[0354] Figure 6 This is a flow chart corresponding to the communication method provided in the embodiment of the present application. Figure 6 As shown, the process may include:

[0355] S601, the terminal is connected to 5GC through access network device 0.

[0356] The terminal can access the access network device 0 through the initial access process, the normal switching process, the re-establishment process, or the cell reselection process, and access the 5GC through the access network device 0. Furthermore, the key KgNB (referred to as K0 for ease of description) and NCC0 (K0 is associated with NCC0) are respectively stored on the terminal and the access network device 0, and NCC0 is stored on the AMF network element.

[0357] S602 to S611 are described with reference to S402 to S411.

[0358] S612 , access network device 0 sends an Xn message to access network device 1 ; correspondingly, access network device 1 receives the Xn message from access network device 0 .

[0359] Optionally, the access network device 0 horizontally derives the key K1 according to the NCC0, the PCI of the cell on the access network device 1, and the carrier frequency. The Xn message includes the NCC0 and the key K1.

[0360] As a possible implementation (implementation 1), access network device 0 may directly send the identifiers of multiple candidate access network devices determined in S602 to access network device 1 through an Xn message. In this case, the Xn message also includes access network device list 1, and access network device list 1 includes the identifiers of multiple candidate access network devices for LTM switching determined in S602. Alternatively, access network device 0 sends access network device list 1 to access network device 1 through a switching request message 1, in which case the Xn message may not include access network device list 1.

[0361] As another possible implementation (implementation 2), the access network device 0 may select part or all of the access network devices from the multiple candidate access network devices determined in S602 according to multiple possible factors (such as the load on the candidate access network devices, etc.), and then send the identifiers of the selected access network devices to the access network device 1 through the Xn message. In this case, the Xn message also includes the access network device list 2, and the access network device list 2 includes the identifiers of the access network devices selected by the access network device 0.

[0362] Optionally, for this implementation, access network device 0 may also send identifiers of multiple candidate access network devices determined in S602 (i.e., access network device list 1) to access network device 1, such as through switching request message 1 or the above-mentioned Xn message, without specific limitation.

[0363] It can be understood that in implementation 1, access network device list 1 is the first candidate access network device list in embodiment one; in implementation 2, access network device list 2 is the first candidate access network device list in embodiment one.

[0364] In addition, after receiving the Xn message, the access network device 1 can know that the access network device 1 is the target access network device for LTM switching, not the target access network device for ordinary switching, and then there is no need to construct a container (if it is the target access network device for ordinary switching, the access network device constructs a container, refer to Figure 3 ).

[0365] In an example, the Xn message may be a dedicated message for LTM switching, and after receiving the Xn message, the access network device 1 may learn that the access network device 1 is the target access network device for the LTM switching.

[0366] In another example, the Xn message may include indication information, and the indication information is used to indicate that access network device 1 is the target access network device for LTM switching. The embodiment of the present application does not limit the specific implementation of the indication information, for example, the indication information may include access network device list 1 in implementation 1 or access network device list 2 in implementation 2.

[0367] The embodiment of the present application does not limit the sending time of S612, for example, S612 can be executed before S613, or S612 can be executed after S613, or S612 and S613 are executed simultaneously. Other steps similar to S612 in the embodiment of the present application can be understood by reference.

[0368] S613: Access network device 0 sends a handover command message to the terminal. Correspondingly, the terminal receives the handover command message from access network device 0.

[0369] The handover command message is a MAC layer message, such as MAC CE. The handover command message includes the identifier of the target access network device (i.e., the identifier of access network device 1) and NCC0. Among them, access network device 0 can transfer NCC0 from the RRC layer to the MAC layer and send it in the MAC layer message.

[0370] After access network device 0 determines that the terminal needs to switch to access network device 1, it can generate a switching command message and send the switching command message. Compared with the normal switching process, since access network device 0 can generate a switching command message including NCC0 by itself when determining that the terminal needs to switch, and send the switching command message to the terminal, the switching delay can be reduced. The RRC layer of access network device 0 can pass NCC0 to the MAC layer of access network device 0, and then the switching command message generated by the MAC layer of access network device 0 includes NCC1.

[0371] It can be understood that the access network device 0 can determine whether the target access network device (i.e., the access network device 1) is a candidate access network device for LTM switching. If the target access network device is a candidate access network device for LTM switching, the access network device 0 can execute the above S612 and S613 to trigger LTM cross-site switching; optionally, in response to the switching request confirmation message 1 of the access network device 1, the switching command message (i.e., MAC layer message) sent by the access network device 0 in S613 can carry NCC0. Optionally, if the target access network device is not a candidate access network device for LTM switching, the access network device 0 can trigger a normal cross-site switching.

[0372] In other examples, during the handover preparation process, after determining multiple candidate access network devices, access network device 0 can respectively determine the keys of multiple candidate access network devices, and send them to the corresponding access network devices through a handover request message. Taking access network device 1 as an example, access network device 0 can horizontally deduce key K1 based on key K0, PCI of the cell on the second access network device, and carrier frequency, and send key K1 to access network device 1 through handover request message 1 in S603. Optionally, handover request message 1 can also include NCC0, and the container constructed by access network device 1 can include NCC0.

[0373] In this case, optionally, the Xn message in S612 may not need to carry NCC0 and key K1, and the switching command message in S613 may not carry NCC0. In S614, the terminal may deduce the key based on NCC0 in the container constructed by access network device 1.

[0374] In addition, optionally, the Xn message in S612 can carry NCC0 and a key horizontally derived from key K1, the switching command message in S613 carries NCC0, and in S614 the terminal can horizontally derive the key based on NCC0 and key KI in the switching command message in S613.

[0375] S614, the terminal deduce the key.

[0376] The MAC layer of the terminal can obtain NCC0 from the above MAC CE, and then pass NCC0 to the RRC layer of the terminal. Since the obtained NCC0 is the same as the NCC0 stored locally in the terminal, the RRC layer of the terminal can perform horizontal deduction, that is, derive the key K1 according to K0, the PCI of the cell on the access network device 1, and the carrier frequency. In this way, the terminal and the access network device 1 maintain the same key, namely K1.

[0377] S615, the terminal detaches from access network device 0 and sends a handover completion message to access network device 1. Correspondingly, access network device 1 receives the handover completion message from the terminal.

[0378] The handover complete message may be an RRC reconfiguration complete message.

[0379] S616, access network device 1 sends a path switching request message to the AMF network element; accordingly, the AMF network element receives the path switching request message.

[0380] S617, the AMF network element sends a path switching response message to access network device 1; accordingly, access network device 1 receives the path switching response message, thereby completing the path switching.

[0381] Here, path switching means that the data transmission path of the terminal is switched from "UPF network element─access network device 0─terminal" to "UPF network element─access network device 1─terminal".

[0382] After receiving the path switching request message, the AMF network element can update the locally saved NCC value by adding 1 to obtain an updated NCC (called NCC1), and perform vertical deduction based on the updated NCC to obtain an updated NH (called NH1). NCC1 and NH1 are associated as an updated pair {NH1, NCC1}.

[0383] The path switch response message includes {NH1, NCC1}. After receiving the path switch response message, the access network device 1 saves {NH1, NCC1} for use in the next LTM switch derivation key.

[0384] S618, the terminal communicates with access network device 1 using key K1.

[0385] S619, access network device 1 determines that the terminal needs to be switched, and the target access network device for switching is access network device 2.

[0386] For the above implementation 1, the access network device 1 can determine whether the target access network device (i.e., the access network device 2) belongs to the access network device list 1. If the target access network device belongs to the access network device list 1, the access network device 1 can execute S620 and S621 to trigger the LTM cross-site handover. In addition, in response to the target access network device belonging to the access network device list 1, the handover command message (i.e., the MAC layer message) sent by the access network device 1 in S621 can carry NCC1. Optionally, if the target access network device does not belong to the access network device list 1, the access network device 1 can trigger a normal cross-site handover.

[0387] For the above implementation 2, the access network device 1 can determine whether the target access network device (i.e., access network device 2) belongs to the access network device list 2. If the target access network device belongs to the access network device list 2, the access network device 1 can execute S620 and S621 to trigger the LTM cross-site handover. In addition, in response to the target access network device belonging to the access network device list 2, the handover command message (i.e., MAC layer message) sent by the access network device 1 in S621 can carry NCC1. Optionally, if the target access network device does not belong to the access network device list 2, the access network device 1 can trigger a normal cross-site handover.

[0388] S620 , access network device 1 sends an Xn message to access network device 2 ; correspondingly, access network device 2 receives the Xn message from access network device 1 .

[0389] Access network device 1 derives key K2 based on previously saved NH1, PCI of the cell on access network device 2, and carrier frequency * The Xn message includes NCC1 and key K2 * .

[0390] As a possible implementation, access network device 1 may directly send access network device list 1 to access network device 2 through an Xn message (access network device list 1 in this case is the second candidate access network device list in embodiment 1). Alternatively, access network device 0 may send access network device list 1 to access network device 1 through a switching request message 2, in which case, the Xn message may not include access network device list 1.

[0391] As another possible implementation, the access network device 1 may select part or all of the access network devices from the access network device list 1 according to a variety of possible factors (such as the load on the candidate access network devices, etc.), and then send the identifiers of the selected access network devices to the access network device 1 through the Xn message. In this case, the Xn message also includes the access network device list 3, and the access network device list 3 includes the identifiers of the access network devices selected by the access network device 1 (the access network device list 3 is the second candidate access network device list in the first embodiment).

[0392] Optionally, for this implementation, access network device 0 may also send access network device list 1 to access network device 2 via switching request message 2, or access network device 1 may also send access network device list 1 to access network device 2 via Xn message, without specific limitation.

[0393] S621: Access network device 1 sends a handover command message to the terminal. Correspondingly, the terminal receives the handover command message from access network device 1.

[0394] The handover command message is a MAC layer message, such as MAC CE. The handover command message includes the identifier of the target access network device (ie, the identifier of the access network device 2) and NCC1.

[0395] After access network device 1 determines that the terminal needs to switch to access network device 2, it can generate a switching command message and send the switching command message. Compared with the normal switching process, since access network device 1 can generate a switching command message containing NCC1 by itself when determining that the terminal needs to switch, and send the switching command message to the terminal, the switching delay can be reduced. The RRC layer of access network device 1 can pass NCC1 to the MAC layer of access network device 1, and then the switching command message generated by the MAC layer of access network device 1 includes NCC1.

[0396] S622, the terminal deduce the key.

[0397] The MAC layer of the terminal can obtain NCC1 from the above MAC CE, and then pass NCC1 to the RRC layer of the terminal. Since the obtained NCC1 is different from the NCC0 stored locally in the terminal, the RRC layer of the terminal can update the locally stored NCC to NCC1, and perform a corresponding number of vertical deductions based on the difference between NCC1 and NCC0 to obtain the corresponding NH (i.e., NH1), and then deduce the key K2 based on NH1, the PCI of the cell on the access network device 2, and the carrier frequency. * In this way, the terminal and access network device 2 maintain the same key, namely K2 * .

[0398] S623, the terminal detaches from the access network device 1, and sends a handover completion message to the access network device 2. Correspondingly, the access network device 2 receives the handover completion message from the terminal.

[0399] The handover complete message may be an RRC reconfiguration complete message.

[0400] S624, access network device 2 sends a path switching request message to the AMF network element; accordingly, the AMF network element receives the path switching request message.

[0401] S625, the AMF network element sends a path switching response message to access network device 2; accordingly, access network device 2 receives the path switching response message, thereby completing the path switching.

[0402] Here, path switching refers to the switching of the data transmission path of the terminal from "UPF network element─access network device 1─terminal" to "UPF network element─access network device 2─terminal".

[0403] After receiving the path switching request message, the AMF network element can update the locally saved NCC value by adding 1 to obtain an updated NCC (called NCC2), and perform vertical deduction based on the updated NCC to obtain an updated NH (called NH2). NCC2 is associated with NH2 as an updated pair {NH2, NCC2}.

[0404] The path switch response message includes {NH2, NCC2}. After receiving the path switch response message, the access network device 1 saves {NH2, NCC2} for use in the next LTM switch derivation key.

[0405] S626, the terminal and access network device 2 use K2 * to communicate.

[0406] It can be understood that if the candidate access network devices for LTM switching also include access network device 3, the subsequent terminal can also switch from access network device 2 to access network device 3. The specific implementation can refer to the description of the terminal switching from access network device 1 to access network device 2.

[0407] also, Figure 6 The process shown is Figure 5 The processes shown correspond to each other, and the steps of the two can refer to each other. For example, S501 can refer to S602 to S608, S502 can refer to S609, S503 can refer to S611, S504 can refer to S613 and S614, S505 can refer to S615, S506 can refer to S616 and S617, S507 can refer to S618, S508 can refer to S619, S509 can refer to S620, S510 can refer to S621 and S622, S511 can refer to S623, S512 can refer to S624 and S625, and S513 can refer to S626.

[0408] With the above method, on the one hand, the source access network device sends the NCC to the terminal, so that the terminal can determine the key according to the NCC, and the source access network device can deduce the key according to the NH corresponding to the NCC and send it to the target access network device, so that the terminal and the target access network device can maintain the same key, ensuring the secure communication between the terminal and the target access network device; and because the NCC will be updated every time the LTM switch is performed, the problem of key reuse will not occur when the terminal switches back and forth between multiple access network devices. For example, the terminal switches from access network device 0 to access network device 1, from access network device 1 to access network device 2, and from access network device 2 back to access network device 1. The key used by the terminal and access network device 1 for communication is different in the two switches before and after.

[0409] On the other hand, access network device 0 knows the key shared by the terminal and access network device 1 (i.e., K1), but cannot know the key shared by the terminal and access network device 2 (i.e., K2). * ), and it is impossible to know the key shared by the terminal and the subsequent target access network device, so two-hop security can be achieved.

[0410] Embodiment 3

[0411] Figure 7 This is a flow chart corresponding to the communication method provided in the embodiment of the present application. Figure 7 As shown, the process may include:

[0412] S701 to S717 may refer to the description of S601 to S617 and will not be repeated here.

[0413] S718, access network device 1 derives a key.

[0414] Access network device 1 derives key K1 based on NH1, PCI of the cell on access network device 1, and carrier frequency. * .

[0415] S719, access network device 1 sends message 1 to the terminal, where message 1 includes NCC1; accordingly, the terminal receives message 1.

[0416] Message 1 may be a MAC layer message (such as MAC CE) or an RRC layer message (such as an RRC reconfiguration message), and is not specifically limited.

[0417] S720, the terminal derives a key.

[0418] The MAC layer of the terminal can obtain NCC1 from the above message 1, and then pass NCC1 to the RRC layer of the terminal. Since the obtained NCC1 is different from the NCC0 stored locally in the terminal, the RRC layer of the terminal can update the locally stored NCC to NCC1, and perform a corresponding number of vertical deductions based on the difference between NCC1 and NCC0 to obtain the corresponding NH (i.e., NH1), and then deduce the key K1 based on NH1, the PCI of the cell on the access network device 1, and the carrier frequency. * In this way, the terminal and access network device 1 maintain the same key, namely K1 * .

[0419] S721, the terminal and access network device 1 use key K1 * to communicate.

[0420] S722, access network device 1 determines that the terminal needs to be switched, and the target access network device for switching is access network device 2.

[0421] S723 , access network device 1 sends an Xn message to access network device 2 ; correspondingly, access network device 2 receives the Xn message from access network device 1 .

[0422] Access network equipment 1 according to K1 * , the PCI and carrier frequency of the cell on the access network device 2, and derive the key K2. The Xn message includes NCC1 and the key K2.

[0423] The above S722 and S723 may refer to the description in S619 and S620.

[0424] S724, the access network device 1 sends a handover command message to the terminal. Correspondingly, the terminal receives the handover command message from the access network device 1.

[0425] The handover command message is a MAC layer message, such as MAC CE. The handover command message includes the identifier of the target access network device (ie, the identifier of the access network device 2) and NCC1.

[0426] S725, the terminal deduce the key.

[0427] The MAC layer of the terminal can obtain NCC1 from the above MAC CE, and then pass NCC1 to the RRC layer of the terminal. Since the obtained NCC1 is the same as the NCC1 saved by the terminal, the RRC layer of the terminal can perform horizontal deduction, that is, according to K1 * , the PCI of the cell on the access network device 2 and the carrier frequency, and derive the key K2. In this way, the terminal and the access network device 2 maintain the same key, namely K2.

[0428] S726, the terminal detaches from the access network device 1, and sends a handover completion message to the access network device 2. Correspondingly, the access network device 2 receives the handover completion message from the terminal.

[0429] The handover complete message may be an RRC reconfiguration complete message.

[0430] S727, access network device 2 sends a path switching request message to the AMF network element; accordingly, the AMF network element receives the path switching request message.

[0431] S728, the AMF network element sends a path switching response message to access network device 2; accordingly, access network device 2 receives the path switching response message and completes the path switching.

[0432] Here, path switching refers to the switching of the data transmission path of the terminal from "UPF network element─access network device 1─terminal" to "UPF network element─access network device 2─terminal".

[0433] After receiving the path switching request message, the AMF network element can update the locally saved NCC value by adding 1 to obtain an updated NCC (called NCC2), and perform vertical deduction based on the updated NCC to obtain an updated NH (called NH2). NCC2 is associated with NH2 as an updated pair {NH2, NCC2}.

[0434] The path switch response message includes {NH2, NCC2}. After receiving the path switch response message, the access network device 1 saves {NH2, NCC2}.

[0435] S729, access network device 2 derives a key.

[0436] Access network device 2 derives key K2 based on NH2, PCI of the cell on access network device 2, and carrier frequency. * .

[0437] S730 , access network device 2 sends message 2 to the terminal, where message 2 includes NCC2 ; accordingly, the terminal receives message 2 .

[0438] Message 2 may be a MAC layer message (such as MAC CE) or an RRC layer message (such as an RRC reconfiguration message), and is not specifically limited.

[0439] S731, the terminal deduce the key.

[0440] The terminal can obtain NCC2 from the above message 2. Since the obtained NCC2 is different from the NCC1 stored locally in the terminal, the terminal can update the locally stored NCC1 to NCC2, and perform a corresponding number of vertical deductions based on the difference between NCC2 and NCC1 to obtain the corresponding NH (i.e., NH2), and then deduce the key K2 based on NH2, the PCI of the cell on the access network device 1, and the carrier frequency. * In this way, the terminal and access network device 2 maintain the same key, namely K2 * .

[0441] S732, the terminal and access network device 2 use key K2 * to communicate.

[0442] It is understandable that the terminal may subsequently switch from access network device 2 to other access network devices (such as access network device 3). For specific implementation, reference may be made to the description of the terminal switching from access network device 1 to access network device 2.

[0443] also, Figure 7 The process shown is Figure 6 The difference is: Figure 6Used to achieve two-hop security, that is, the NCC and NH received by the access network device from the AMF are used for communication security protection when the terminal switches to the next base station scenario; Figure 7 It is used to achieve one-hop security, that is, the NCC and NH received by the access network device from the AMF are used for communication security protection when the terminal switches to the current base station scenario; therefore Figure 7 Compared to Figure 6 There are some additional steps, such as S718 to S720, S729 to S731; apart from this difference, the steps of the two can refer to each other and will not be repeated here.

[0444] By using the above method, the access network device 0 cannot know the key (i.e. K1) used by the terminal and the access network device 1. * ), nor can the key used by the terminal and access network device 2 (i.e., K2 * ), and it is impossible to know the key shared by the terminal and the subsequent target access network device, so one-hop security can be achieved.

[0445] Embodiment 4

[0446] In the fourth embodiment, the second solution will be described in detail.

[0447] Figure 8 This is a flow chart corresponding to the communication method provided in the embodiment of the present application. Figure 8 As shown, the process may include:

[0448] S801. A first access network device sends a switching request message to multiple candidate access network devices respectively. The switching request message is used to request the multiple candidate access network devices to construct a container.

[0449] Here, the first access network device may be an access network device accessed by the terminal through an initial access process, a normal switching process, a re-establishment process, a cell reselection process, etc. The first access network device and the terminal may store the same key (the key is used for communication between the first access network device and the terminal) and NCC (such as the first NCC).

[0450] Taking the second access network device among multiple candidate access network devices as an example, the first access network device can deduce key 1 according to the first input parameter, and send a switching request message to the second access network device, and the switching request message includes the first NCC and key 1. Correspondingly, after receiving the switching request message, the second access network device can obtain and save the first NCC and key 1. Among them, the first input parameter includes one or more of the following: the PCI of the cell on the second access network device, the carrier frequency of the cell, the key KgNB for security protection between the terminal and the first access network device, etc.

[0451] S802, the first access network device receives a container constructed by each access network device among multiple candidate access network devices, where the container constructed by each access network device includes parameters for the terminal to switch to each access network device and a first NCC (ie, obtained from a switching request message).

[0452] S803: The first access network device sends an RRC reconfiguration message to the terminal, where the RRC reconfiguration message includes a container constructed by each access network device in a plurality of candidate access network devices.

[0453] Here, the terminal obtains containers constructed by multiple candidate access network devices from the RRC reconfiguration message. Further, taking the second access network device among multiple candidate access network devices as an example, the terminal can obtain the first NCC from the container constructed by the second access network device. Since the first NCC obtained is the same as the NCC stored locally in the terminal, the terminal can perform horizontal deduction, that is, according to the first input parameter, horizontal deduction obtains the key used by the terminal to communicate with the second access network device, and saves the correspondence between the key and the identifier of the second access network device. In this way, the terminal can save the keys corresponding to multiple candidate access network devices.

[0454] The embodiment of the present application does not limit the specific timing when the terminal determines the keys corresponding to multiple candidate access network devices respectively.

[0455] The above S801 and S803 can be understood as a switching preparation process, and the relevant implementation can refer to the description in the first embodiment.

[0456] S804: The first access network device determines that the second access network device to which the terminal needs to switch is an access network device that has not been switched during the continuous LTM switching process of the terminal.

[0457] After the first access network device determines that the terminal needs to switch to the second access network device, it can further determine whether the second access network device is an access network device that has not been switched during the continuous LTM switching process for the terminal. Since the terminal has not switched to any of the multiple candidate access network devices after the first access network device determines multiple candidate access network devices, the first access network device can determine that the multiple candidate access network devices are all access network devices that have not been switched during the continuous LTM switching process for the terminal.

[0458] In this embodiment, the second access network device is an access network device that has not been switched during the continuous LTM switching process for the terminal. In other examples, if the second access network device is an access network device that has been switched during the continuous LTM switching process for the terminal, the first access network device can send an RRC reconfiguration message to the terminal, and the RRC reconfiguration message is used to trigger the terminal to switch to the second access network device (i.e., perform a normal cross-site handover).

[0459] Exemplarily, continuous LTM switching refers to multiple switching triggered by L1 / L2 messages after obtaining configuration information in the switching preparation phase, that is, after obtaining the configuration information, continuous L1 / L2 message triggered switching may not require additional RRC configuration.

[0460] The continuous LTM switching process may include a process in which the terminal obtains containers constructed by multiple candidate access network devices (i.e., a switching preparation process) and multiple continuous LTM switching. Among them, multiple candidate access network devices are candidate access network devices in the continuous LTM switching process for the terminal. For example, after the terminal accesses access network device a through the initial access process, the ordinary switching process, the re-establishment process, or the cell reselection process, the access network device a receives containers constructed by multiple candidate access network devices (such as access network devices b to d), and sends them to the terminal through an RRC reconfiguration message; subsequently, the terminal switches from access network device a to access network device b through LTM switching (the first LTM switching), at which time access network device b is the access network device that has been switched during the continuous LTM switching process, and access network devices c and d are the access network devices that have not been switched during the continuous LTM switching process; optionally, access network device a can record the number of LTM continuous switching as 1, and send the number of LTM continuous switching to access network device b. The terminal switches from access network device b to access network device c again through LTM switching (the second LTM switching). At this time, access network devices b and c are both access network devices that have been switched during the continuous LTM switching process, while access network device d is an access network device that has not been switched during the continuous LTM switching process; optionally, access network device b can add 1 to the number of LTM continuous switching times (that is, the number of LTM continuous switching times is 2), and send the number of LTM continuous switching times to access network device c. The terminal switches from access network device c to access network device d again through LTM switching (the third LTM switching). At this time, access network devices b, c and d are all access network devices that have been switched during the continuous LTM switching process. Optionally, access network device c can add 1 to the number of LTM continuous switching times (that is, the number of LTM continuous switching times is 3), and send the number of LTM continuous switching times to access network device d. If the terminal is connected from access network device d to access network device e through a normal switching process, a re-establishment process, or a cell reselection process, the above three LTM switches performed by the terminal can be understood as three consecutive LTM switches; optionally, access network device d can reset the number of consecutive LTM switches to zero.

[0461] The number of consecutive LTM switching times may refer to the number of LTM switching times performed in a consecutive LTM switching process for a terminal.

[0462] In addition, this embodiment is described by taking the example of the first access network device determining whether to perform LTM inter-site switching or ordinary inter-site switching based on "whether the second access network device is an access network device that has not been switched during the continuous LTM switching process for the terminal"; that is, if the second access network device is an access network device that has not been switched during the continuous LTM switching process for the terminal, LTM inter-site switching (i.e. steps S805 and S806) is performed; otherwise, ordinary inter-site switching is performed.

[0463] In other possible embodiments, the first access network device may also determine whether to perform LTM cross-site switching or ordinary cross-site switching according to the value of NCC and / or the number of LTM continuous switching. For example, if the second access network device is an access network device that has not been switched during the continuous LTM switching process for the terminal, the NCC stored in the first access network device does not belong to the preset value, and the number of LTM continuous switching is less than the threshold, then LTM cross-site switching can be performed, otherwise (for example, if at least one of the following is satisfied: the second access network device is an access network device that has been switched during the continuous LTM switching process for the terminal, the NCC stored in the first access network device is the preset value, and the number of LTM continuous switching is greater than or equal to the threshold), ordinary cross-site switching can be performed.

[0464] S805: The first access network device sends a third candidate access network device list to the second access network device. The third candidate access network device list includes identifiers of access network devices that have not been switched during the continuous LTM switching process of the terminal.

[0465] For example, the first access network device determines that multiple candidate access network devices are access network devices that have not been switched during the continuous LTM switching process of the terminal, then the third candidate access network device list includes the identifiers of multiple candidate access network devices, that is, the candidate access network device list sent by the source access network device to the target access network device does not include the source access network device.

[0466] In other examples, since the terminal is about to switch to the second access network device, the third candidate access network device list includes the identifiers of other access network devices among multiple candidate access network devices except the second access network device, that is, the candidate access network device list sent by the source access network device to the target access network device does not include the source access network device and the target access network device.

[0467] S806. The first access network device sends a first MAC layer message to the terminal, where the first MAC layer message is used to trigger the terminal to switch to the second access network device.

[0468] Here, the first MAC layer message may include an identifier of the second access network device.

[0469] Optionally, in response to the first MAC layer message, the terminal may delete context information related to the first access network device, such as deleting a key used by the terminal to communicate with the first access network device, etc. It should be noted that if the terminal does not determine the keys corresponding to multiple candidate access network devices respectively during the switching preparation process, then in response to the first MAC layer message, the terminal may not delete the key used by the terminal to communicate with the first access network device.

[0470] S807: The terminal switches to the second access network device according to the parameters in the container constructed by the second access network device.

[0471] Optionally, after the terminal switches to the second access network device, the second access network device can send a path switching request message to the AMF network element, and accordingly, the AMF network element can send a path switching response message to the second access network device based on the path switching request message.

[0472] S808: The terminal and the second access network device communicate using key 1.

[0473] Here, after the MAC layer of the terminal obtains the identifier of the second access network device from the first MAC layer message, the identifier of the second access network device can be passed to the RRC layer; then, the RRC layer of the terminal can obtain the key corresponding to the second access network device (i.e., key 1) according to the identifier of the second access network device; and the second access network device can obtain the previously saved key 1. Then, the terminal and the second access network device can use key 1 for communication.

[0474] It can be understood that the above description is based on the example of the terminal receiving the RRC reconfiguration message and then deducing the keys corresponding to each access network device. The embodiment of the present application does not limit the specific time when the terminal deduces the key. For example, the terminal can also derive the key used for the terminal to communicate with the second access network device after receiving the first MAC layer message.

[0475] Optionally, after the terminal switches from the first access network device to the second access network device, the method further includes:

[0476] S809: The second access network device determines that the third access network device to which the terminal needs to switch is an access network device that has not been switched during the continuous LTM switching process of the terminal.

[0477] Exemplarily, the second access network device can determine whether the third access network device belongs to the third candidate access network device list. If the third access network device belongs to the third candidate access network device list, the third access network device is determined to be an access network device that has not been switched during the continuous LTM switching process for the terminal; if the third access network device does not belong to the third candidate access network device list, the third access network device is determined to be an access network device that has not been switched during the continuous LTM switching process for the terminal.

[0478] It is understandable that in other embodiments, the first access network device may send the identifiers of multiple candidate access network devices and the fifth candidate access network device list to the second access network device, and the fifth candidate access network device list includes access network devices that have been switched during the continuous LTM switching process for the terminal. In this case, the second access network device may first determine whether the third access network device belongs to multiple candidate access network devices. If the third access network device belongs to multiple candidate access network devices, it further determines whether the third access network device belongs to the fifth candidate access network device list (if the third access network device does not belong to multiple candidate access network devices, perform normal switching). If the third access network device does not belong to the fifth candidate access network device list, it is determined that the third access network device is an access network device that has not been switched during the continuous LTM switching process for the terminal; if the third access network device belongs to the fifth candidate access network device list, it is determined that the third access network device is an access network device that has not been switched during the continuous LTM switching process for the terminal.

[0479] In addition, in this embodiment, the second access network device is described as an example of determining whether to perform LTM cross-site switching or ordinary cross-site switching according to "whether the third access network device is an access network device that has not been switched during the continuous LTM switching process for the terminal". In other possible embodiments, the second access network device can also determine whether to perform LTM cross-site switching or ordinary cross-site switching according to the value of NCC and / or the number of LTM continuous switching. For example, if the third access network device is an access network device that has not been switched during the continuous LTM switching process for the terminal, the NCC stored in the second access network device (i.e., the NCC obtained from the path switching response message) does not belong to the preset value, and the number of LTM continuous switching is less than the threshold, then LTM cross-site switching can be performed, otherwise (for example, if at least one of the following is satisfied: the third access network device is an access network device that has been switched during the continuous LTM switching process for the terminal, the NCC stored in the second access network device is the preset value, and the number of LTM continuous switching is greater than or equal to the threshold), ordinary cross-site switching can be performed.

[0480] S810. The second access network device sends a fourth candidate access network device list to the third access network device. The fourth candidate access network device list includes identifiers of access network devices that have not been switched during the continuous LTM switching process of the terminal.

[0481] For example, the fourth candidate access network device list includes identifiers of other access network devices except the second access network device among multiple candidate access network devices, that is, the candidate access network device list sent by the source access network device to the target access network device does not include the source access network device.

[0482] In other examples, since the terminal is about to switch to the third access network device, the fourth candidate access network device list includes the identifiers of other access network devices among the multiple candidate access network devices except the second access network device and the third access network device, that is, the candidate access network device list sent by the source access network device to the target access network device does not include the source access network device and the target access network device.

[0483] S811. The second access network device sends a second MAC layer message to the terminal, where the second MAC layer message is used to trigger the terminal to switch to the third access network device.

[0484] Optionally, in response to the second MAC layer message, the terminal may delete context information related to the second access network device, such as deleting a key used by the terminal to communicate with the second access network device.

[0485] S812: The terminal switches to the third access network device according to the parameters in the container constructed by the third access network device.

[0486] Optionally, after the terminal switches to the third access network device, the third access network device can send a path switching request message to the AMF network element, and accordingly, the AMF network element can send a path switching response message to the third access network device based on the path switching request message.

[0487] S813: The terminal determines a key for communicating with a third access network device according to the first NCC, and communicates with the third access network device according to the key.

[0488] With the above method, since the container constructed by each access network device among multiple candidate access network devices carries the first NCC, after the terminal switches to any of the access network devices, the key used by the terminal to communicate with the access network device is determined based on the first NCC carried in the container constructed by the access network device (as well as the information of the cell on the access network device), which is relatively simple to implement; when performing LTM switching, the source access network device can determine whether the target access network device is an access network device that has not been switched during the continuous LTM switching process of the terminal. If so, LTM cross-site switching can be performed, otherwise ordinary cross-site switching is performed, so that when the terminal switches back and forth between multiple candidate access network devices, there will be no problem of key reuse.

[0489] Based on the fourth embodiment, a possible implementation process is described below in combination with the fifth embodiment. In the fifth embodiment, the "first access network device" in the fourth embodiment is access network device 0, the "second access network device" is access network device 1, and the "third access network device" is access network device 2.

[0490] Embodiment 5

[0491] Fig. 9 This is a flow chart corresponding to the communication method provided in the embodiment of the present application. Fig. 9 As shown, the process includes:

[0492] S901, the terminal is connected to 5GC through access network device 0.

[0493] The terminal can access the access network device 0 through the initial access process, the normal switching process, the re-establishment process, or the cell reselection process, and access the 5GC through the access network device 0. Furthermore, the key KgNB (referred to as K0 for ease of description) and NCC0 (K0 is associated with NCC0) are respectively stored on the terminal and the access network device 0, and NCC0 is stored on the AMF network element.

[0494] S902: Access network device 0 determines multiple candidate access network devices for LTM switching.

[0495] The description here may refer to S402.

[0496] In this process, description is given by taking as an example a plurality of candidate access network devices for LTM switching including access network device 1, access network device 2, ..., access network device 5.

[0497] S903 , access network device 0 sends a handover request message 1 to access network device 1 . Correspondingly, access network device 1 receives the handover request message 1 from access network device 0 .

[0498] Access network device 0 derives key K1 according to K0, PCI of the cell of access network device 1 and carrier frequency. Switching request message 1 includes NCC0 and key K1. After receiving switching request message 1, access network device 1 can save NCC0 and key K1.

[0499] S904, access network device 1 constructs a container.

[0500] If the access network device 1 allows the terminal to perform LTM switching, the access network device 1 can construct a container. The container carries the identifier of the access network device 1, NCC0 and configuration information, and the configuration information includes parameters for the terminal to switch to the access network device 1.

[0501] S905 , access network device 1 sends a handover request confirmation message 1 to access network device 0 . Correspondingly, access network device 0 receives the handover request confirmation message 1 from access network device 1 .

[0502] The handover request confirmation message 1 includes a container constructed by the access network device 1 .

[0503] S906 , access network device 0 sends a handover request message 2 to access network device 2 . Correspondingly, access network device 2 receives the handover request message 2 from access network device 0 .

[0504] Access network device 0 derives key K2 according to K0, PCI and carrier frequency of the cell of access network device 2. Switching request message 2 includes NCC0 and key K2. After receiving switching request message 2, access network device 2 can save NCC0 and key K2.

[0505] S907, access network device 2 constructs a container.

[0506] If the access network device 2 allows the terminal to perform LTM switching, the access network device 2 can construct a container. The container carries the identifier of the access network device 2, NCC0 and configuration information, and the configuration information includes parameters for the terminal to switch to the access network device 2.

[0507] S908 , access network device 2 sends a handover request confirmation message 2 to access network device 0 . Correspondingly, access network device 0 receives the handover request confirmation message 2 from access network device 1 .

[0508] The handover request confirmation message 2 includes a container constructed by the access network device 2 .

[0509] It can be understood that the above only describes access network device 0 sending a switching request message to access network device 1 and access network device 2. Access network device 0 can also send switching request information to other candidate access network devices for LTM switching. The specific implementation can refer to S903 to S908 above and will not be repeated here.

[0510] S909, access network device 0 sends an RRC reconfiguration message to the terminal, where the RRC reconfiguration message carries a container constructed by access network device 1 and a container constructed by access network device 2; accordingly, the terminal receives the RRC reconfiguration message.

[0511] The terminal obtains the container constructed by the access network device 1 and the container constructed by the access network device 2 from the RRC reconfiguration message. Further, the terminal can obtain NCC0 from the container constructed by the access network device 1. Since the obtained NCC0 is the same as the NCC0 locally stored in the terminal, the terminal can perform horizontal deduction, that is, according to K0, the PCI of the cell on the access network device 1 and the carrier frequency, the key K1 is deduced, and the corresponding relationship between the key K1 and the identifier of the access network device 1 is saved (for example, saved in the context information related to the access network device 1). The terminal can obtain NCC0 from the container constructed by the access network device 2. Since the obtained NCC0 is the same as the NCC0 locally stored in the terminal, the terminal can perform horizontal deduction, that is, according to K0, the PCI of the cell on the access network device 2 and the carrier frequency, the key K2 is deduced, and the corresponding relationship between the key K2 and the identifier of the access network device 2 is saved (for example, saved in the context information related to the access network device 2).

[0512] S910, the terminal sends an RRC reconfiguration completion message to access network device 0; correspondingly, access network device 0 receives the RRC reconfiguration completion message from the terminal.

[0513] S911, access network device 0 determines that the terminal needs to be switched, and the target access network device for switching is access network device 1.

[0514] S912, access network device 0 determines whether to perform LTM inter-site handover or common inter-site handover.

[0515] If the target access network device (i.e., access network device 1) is an access network device that has not been switched during the continuous LTM switching process for the terminal, then access network device 0 can determine to perform LTM cross-site switching; if the target access network device is an access network device that has been switched during the continuous LTM switching process for the terminal, then access network device 0 can determine to perform ordinary cross-site switching. In this process, since access network device 1 is an access network device that has not been switched during the continuous LTM switching process for the terminal, access network device 0 can determine to perform LTM cross-site switching.

[0516] S913 , access network device 0 sends an Xn message to access network device 1 ; correspondingly, access network device 1 receives the Xn message from access network device 0 .

[0517] The Xn message may include access network device list 1 (i.e., the third candidate access network device list in Embodiment 4), and access network device list 1 may include the identification of at least one candidate access network device for LTM switching. As described above, access network device 0 determines multiple candidate access network devices for LTM switching (e.g., access network device 1 to access network device 5), and access network device list 1 may include some or all of the multiple candidate access network devices.

[0518] The access network devices in the access network device list 1 may all be access network devices that have not been switched during the continuous LTM switching process of the terminal. For example, the access network device list includes access network devices 1 to 5.

[0519] S914, the access network device 0 sends a handover command message to the terminal. Correspondingly, the terminal receives the handover command message from the access network device 0.

[0520] The handover command message is a MAC layer message, such as MAC CE. The handover command message includes the identifier of the target access network device, that is, the identifier of the access network device 1.

[0521] S915, the terminal detaches from access network device 0 and sends a handover completion message to access network device 1. Correspondingly, access network device 1 receives the handover completion message from the terminal.

[0522] The handover complete message may be an RRC reconfiguration complete message.

[0523] The terminal can obtain the previously stored container constructed by the access network device 1 according to the identifier of the access network device 1 in the above-mentioned handover command message (ie, MAC CE), and then can send a handover completion message to the access network device 1.

[0524] S916, access network device 1 sends a path switching request message to the AMF network element; accordingly, the AMF network element receives the path switching request message.

[0525] S917, the AMF network element sends a path switching response message to access network device 1; accordingly, access network device 1 receives the path switching response message, thereby completing the path switching.

[0526] Here, path switching means that the data transmission path of the terminal is switched from "UPF network element─access network device 0─terminal" to "UPF network element─access network device 1─terminal".

[0527] Optionally, after receiving the path switching request message, the AMF network element can update the locally stored NCC value by adding 1 to obtain an updated NCC (called NCC1), so as to perform vertical deduction based on the updated NCC to obtain an updated NH (called NH1). NCC1 and NH1 are associated as an updated pair {NH1, NCC1}.

[0528] The path switch response message includes {NH1, NCC1}. After receiving the path switch response message, the access network device 1 saves {NH1, NCC1}.

[0529] S918, the terminal communicates with access network device 1 using key K1.

[0530] The terminal can obtain the previously stored key K1 corresponding to the identifier of access network device 1 according to the identifier of access network device 1 in the above-mentioned switching command message (i.e., MAC CE); and access network device 1 also receives key K1 through the switching request message, so the terminal and access network device 1 can communicate using key K1.

[0531] S919, access network device 1 determines that the terminal needs to be switched, and the target access network device for switching is access network device 2.

[0532] S920, the access network device 1 determines whether to perform LTM inter-site handover or common inter-site handover.

[0533] Access network device 1 can determine whether the target access network device (i.e., access network device 2) is an access network device that has not been switched during the continuous LTM switching process for the terminal. For example, if access network device 2 belongs to the access network device in access network device list 1, it means that access network device 2 is an access network device that has not been switched during the continuous LTM switching process for the terminal, and it is determined to perform LTM cross-site switching; otherwise, it can be determined to perform ordinary cross-site switching.

[0534] In this embodiment, since the access network device 2 belongs to the access network devices in the access network device list 1, the access network device 1 can determine to perform LTM cross-site switching.

[0535] S921, access network device 1 sends an Xn message to access network device 2; correspondingly, access network device 2 receives the Xn message from access network device 1.

[0536] The Xn message may include access network device list 2 (i.e., the fourth candidate access network device list in Embodiment 4), and the access network devices in access network device list 2 may all be access network devices that have not been switched during the continuous LTM switching process for the terminal. For example, since access network device 1 is an access network device that has not been switched during the continuous LTM switching process for the terminal, access network device 1 may delete the identifier of access network device 1 from access network device list 1 to obtain access network device list 2, that is, access network device list 2 may include access network devices 2 to access network devices 5.

[0537] S922: Access network device 1 sends a handover command message to the terminal. Correspondingly, the terminal receives the handover command message from access network device 1.

[0538] The handover command message is a MAC layer message, such as MAC CE. The handover command message includes the identifier of the target access network device, that is, the identifier of the access network device 2.

[0539] S923, the terminal detaches from the access network device 1, and sends a handover completion message to the access network device 2. Correspondingly, the access network device 2 receives the handover completion message from the terminal.

[0540] The handover complete message may be an RRC reconfiguration complete message.

[0541] The terminal can obtain the previously stored container constructed by access network device 2 according to the identifier of access network device 2 in the above-mentioned switching command message (ie, MAC CE), and then access the cell of access network device 2 according to the container, and can send a switching completion message to access network device 2.

[0542] S924, access network device 2 sends a path switching request message to the AMF network element; accordingly, the AMF network element receives the path switching request message.

[0543] S925, the AMF network element sends a path switching response message to access network device 2; accordingly, access network device 2 receives the path switching response message and completes the path switching.

[0544] Here, path switching refers to the switching of the data transmission path of the terminal from "UPF network element─access network device 1─terminal" to "UPF network element─access network device 2─terminal".

[0545] Optionally, after receiving the path switching request message, the AMF network element can update the locally stored NCC value by adding 1 to obtain an updated NCC (called NCC2), so as to perform vertical deduction based on the updated NCC to obtain an updated NH (called NH2). NCC2 is associated with NH2 as an updated pair {NH2, NCC2}.

[0546] The path switch response message includes {NH2, NCC2}. After receiving the path switch response message, the access network device 1 may save {NH2, NCC2}.

[0547] S926, the terminal communicates with access network device 2 using key K2.

[0548] The terminal can obtain the previously stored key K1 corresponding to the identifier of access network device 2 according to the identifier of access network device 2 in the above-mentioned switching command message (i.e., MAC CE); and access network device 2 also receives key K2 through the switching request message, so the terminal and access network device 2 can communicate using key K2.

[0549] It is understandable that the terminal may subsequently switch from access network device 2 to other access network devices (such as access network device 3). For specific implementation, reference may be made to the description of the terminal switching from access network device 1 to access network device 2.

[0550] The above process is described by taking "the access network device list sent by the source access network device to the target access network device does not include the source access network device, but includes the target access network device" as an example. In other possible examples, the access network device list sent by the source access network device to the target access network device may also not include the source access network device and the target access network device. For example, in the above S913, the access network device list 1 sent by access network device 0 to access network device 1 includes access network devices 2 to 5; in the above S921, the access network device list 2 sent by access network device 1 to access network device 2 includes access network devices 3 to 5. This is because the terminal is about to switch to the target access network device through LTM switching. Therefore, the access network device list may no longer include the target access network device, thereby saving transmission overhead.

[0551] also, Fig. 9 The process shown is Figure 8 The illustrated processes correspond to each other, and the steps of the two can refer to each other. For example, S801 and S802 can refer to S902 to S908, S803 can refer to S909, S804 can refer to S911 and S912, S805 can refer to S913, S806 can refer to S914, S807 can refer to S915, S808 can refer to S918, S809 can refer to S919 and S920, S810 can refer to S921, S811 can refer to S922, S812 can refer to S923, and S813 can refer to S926.

[0552] By adopting the above method, access network device 0 can send NCC0 and corresponding keys to each candidate access network device for LTM switching through a switching request message, and the terminal can horizontally deduce and save the keys corresponding to each candidate access network device according to the NCC0 carried in the container constructed by each candidate access network device for LTM switching. The terminal can use the corresponding keys when switching to the candidate access network device through LTM switching. Further, taking access network device 1 as an example, when the terminal switches from access network device 0 to access network device 1, access network device 1 can receive access network device list 1, which includes access network devices that have not been switched in the continuous LTM switching process for the terminal; when access network device 1 determines that the terminal needs to be switched to access network device 2, it can determine whether access network device 2 is an access network device that has not been switched in the continuous LTM switching process for the terminal according to access network list 1. If so, LTM cross-site switching can be performed, otherwise ordinary cross-site switching can be performed, so that the terminal will not repeatedly switch to the same access network device through LTM cross-site switching, avoiding the problem of key reuse.

[0553] For option 2, Fig. 9 Taking the process shown as an example, it can be understood that:

[0554] 1. In the above S909, "after the terminal obtains the container constructed by access network device 1 and the container constructed by access network device 2 from the RRC reconfiguration message, it deduces the key corresponding to each access network device" as an example. In other possible examples, the terminal may also deduce the key corresponding to the current target access network device after receiving the switching command message. For example, after the terminal receives the switching command message in S914, it can deduce the key corresponding to access network device 1; for another example, after the terminal receives the switching command message in S922, it can deduce the key corresponding to access network device 2. In this case, since the key K0 is required to deduce the key corresponding to the target access network device (such as access network device 1 or access network device 2), the key K0 may not be deleted after the terminal detaches from access network device 0. In this case, the terminal may only need to deduce the keys corresponding to some of the candidate access network devices among multiple candidate access network devices. For example, if the terminal does not switch to a certain candidate access network device, the terminal does not need to deduce the key corresponding to the candidate access network device.

[0555] 2. Taking access network device 1 as an example, in the above S912, it is described as an example that access network device 1 determines whether to perform LTM cross-site switching or ordinary cross-site switching according to "whether access network device 2 is an access network device that has not been switched in the continuous LTM switching process for the terminal". In other possible examples, when access network device 1 determines that the terminal needs to switch, it can also determine whether to perform LTM cross-site switching or ordinary cross-site switching according to the value of NCC1 and / or the number of continuous LTM switching.

[0556] For example, if at least one of the following three items is met, the access network device 1 may determine to perform a normal inter-site handover, and if none of the following three items is met, the access network device 1 may determine to perform an LTM inter-site handover:

[0557] (1) The selected target access network device is an access network device that has been switched during the continuous LTM switching process of the terminal.

[0558] (2) The NCC value is a preset value; wherein the preset value may include 0 and 7.

[0559] (3) The number of LTM continuous switching times is greater than or equal to the threshold; the threshold can be determined based on NCC0, for example, the threshold can be equal to the maximum value of NCC minus NCC0, or the maximum value of NCC minus NCC0+1. For example, if NCC0 is 0, the threshold can be 7 or 8. Exemplarily, the initial value of the number of LTM continuous switching times can be 0. After the access network device 0 determines to perform LTM cross-site switching, it can add 1 to the value of the number of LTM continuous switching times and send the number of LTM continuous switching times to the access network device 1, that is, the access network device 1 can obtain the number of LTM continuous switching times from the access network device 0. When performing a normal switch, the number of LTM continuous switching times can be reset to 0.

[0560] Here, the reason why "it is possible to determine whether to perform LTM cross-site switching or ordinary cross-site switching according to the value of NCC1" is explained (the number of LTM continuous switching can be understood by reference):

[0561] Since the NCC has only 3 bits of overhead on the air interface, that is, only NCC0 to NCC7 can be transmitted on the air interface (that is, the maximum value of NCC is 7), if the NCC value on the network side is greater than the maximum value that the air interface can represent, such as NCC8>NCC7, in this case, the NCC value will be flipped on the air interface. For example, the NCC value on the air interface is the result of the modulo operation of the NCC value on the network side on 8, such as flipping from NCC8 to NCC0.

[0562] According to the above Fig. 9It can be seen from the illustrated process that when performing LTM cross-site switching, the access network device does not send NCC to the terminal. Therefore, the terminal does not perceive the update of NCC on the network side (such as AMF network element), that is, the NCC stored locally in the terminal is always NCC0.

[0563] Assume that when the first LTM inter-site handover is performed, the NCC on the AMF network element is updated from NCC0 to NCC1, and {NH1, NCC1} is sent to the current target access network device through a path switching response message; when the second LTM inter-site handover is performed, the NCC on the AMF network element is updated from NCC1 to NCC2, and {NH2, NCC2} is sent to the current target access network device through a path switching response message; and so on, when the ninth LTM inter-site handover is performed, the NCC on the AMF network element is updated to NCC1, and {NH9, NCC1} is sent to the current target access network device through a path switching response message.

[0564] If the 10th switch is a normal cross-site switch, the source access network device (i.e., the target access network device of the 8th switch) will send NCC1 to the terminal through a switching command message. At this time, from the terminal's point of view, the difference between the NCC1 obtained by the terminal and the NCC0 locally stored in the terminal is 1, which leads to inconsistent understanding of the difference between the network side and the terminal before and after the NCC value is updated, resulting in inconsistent keys deduced by the terminal and the access network device, affecting the communication between the terminal and the access network device.

[0565] Therefore, an embodiment of the present application proposes that when the NCC value is a preset value (the preset value may include 0 and 7), that is, when the NCC is about to flip (the value is 7) or has just flipped (the value is 0), a normal cross-site switching can be performed, thereby sending an updated NCC to the terminal through a switching command message, so as to ensure that the keys deduced by subsequent terminals and access network devices are consistent.

[0566] Embodiment 6

[0567] In the sixth embodiment, the third solution will be described in detail.

[0568] Fig.10 This is a flow chart corresponding to the communication method provided in the embodiment of the present application. Fig.10 As shown, the process may include:

[0569] S1001: A first access network device determines a plurality of candidate access network devices for LTM switching.

[0570] Here, the first access network device may be an access network device accessed by the terminal through an initial access process, a normal switching process, a re-establishment process, a cell reselection process, etc. The first access network device and the terminal may store the same key (the key is used for communication between the first access network device and the terminal) and NCC (such as the first NCC).

[0571] Optionally, the number of multiple candidate access network devices determined by the first access network device is less than or equal to a threshold value, for example, the threshold value is determined based on the NCC stored in the first access network device (i.e., the first NCC). For example, the threshold value is equal to the maximum value of the NCC minus the first NCC. In other words, the number of candidate access network devices determined by the first access network device should be less than or equal to the threshold value to avoid the NCC corresponding to different subsequent access network devices being the same.

[0572] S1002: The first access network device sends a switching request message to multiple candidate access network devices respectively. The switching request message is used to request the multiple candidate access network devices to construct a container.

[0573] Exemplarily, the switching request message includes indication information, where the indication information is used to indicate that the switching request message corresponds to LTM switching.

[0574] Taking the second access network device among multiple candidate access network devices as an example, after receiving the switching request message, the second access network device sends a request message to the AMF network element in response to the switching request message, and the request message is used to request the NCC corresponding to the second access network device. Then, the AMF network element updates the locally stored NCC value by adding 1 according to the request message, obtains the updated NCC (i.e., the second NCC), performs vertical deduction according to the updated NCC, obtains the NH corresponding to the second NCC, and sends a response message to the first access network device, the response message includes the second NCC and the NH corresponding to the second NCC.

[0575] Furthermore, the second access network device constructs a container, which includes parameters for the terminal to switch to the second access network device, and also includes an NCC corresponding to the second access network device (i.e., a second NCC) and an identifier of the second access network device. The second access network device sends a switching request confirmation message to the first access network device, and the switching request confirmation message includes the container constructed by the second access network device.

[0576] Optionally, after receiving the second NCC and the NH corresponding to the second NCC, the second access network device can determine the key used by the second access network device to communicate with the terminal according to the NH corresponding to the second NCC, the cell on the second access network device, and the carrier frequency. The embodiment of the present application does not limit the specific time when the second access network device determines the key.

[0577] The above is described using the second access network device among multiple candidate access network devices as an example. Other access network devices among the multiple candidate access network devices can be implemented for reference, that is, multiple candidate access network devices all request their corresponding NCCs from the AMF network element based on the switching request message. Therefore, different access network devices among the multiple candidate access network devices correspond to different NCCs.

[0578] S1003: The first access network device receives a container constructed by each access network device among a plurality of candidate access network devices, where the container constructed by each access network device includes an NCC corresponding to each access network device.

[0579] S1004: The first access network device sends an RRC reconfiguration message to the terminal, where the RRC reconfiguration message includes a container constructed by each access network device in a plurality of candidate access network devices.

[0580] Here, the terminal obtains containers constructed by multiple candidate access network devices from the RRC reconfiguration message, and the container constructed by each access network device includes the NCC corresponding to each access network device and the identifier of each access network device; then, the terminal obtains the NCCs corresponding to the multiple candidate access network devices. It can also be understood that the RRC reconfiguration message includes the corresponding relationship between the identifiers of multiple candidate access network devices and multiple NCCs. The terminal can calculate the NHs corresponding to the multiple NCCs and store the corresponding relationship between the NCCs and the NHs.

[0581] Exemplarily, the terminal deduce the NH corresponding to multiple NCCs in ascending order of NCC. Among them, if the values ​​of some NCCs in multiple NCCs are flipped values, the values ​​of these NCCs before flipping can be determined first, and then sorted according to the values ​​before flipping. For example, the NCC currently stored in the terminal is 3. If the values ​​of multiple NCCs are 4, 5, 6, and 7, respectively, since the values ​​of these multiple NCCs are all greater than 3, that is, they are unflipped values, they can be directly arranged in ascending order according to 4, 5, 6, and 7. For another example, the NCC currently stored in the terminal is 3. If the values ​​of multiple NCCs are 4, 5, 6, 7, 0, and 1, respectively, since the values ​​of some NCCs (0, 1) are less than 3, that is, they are flipped values, the values ​​before flipping (8, 9) can be determined first, and then they can be arranged in ascending order according to 4, 5, 6, 7, 8, and 9.

[0582] The terminal can save the correspondence between at least two of the three items: the access network device identifier, NCC and NH. The specific implementation form is not limited. For example, the terminal can save the correspondence between the access network device identifier and NH, or the terminal can save the correspondence between the access network device identifier and NCC, and the correspondence between NCC and NH.

[0583] Optionally, taking the second access network device as an example, the terminal can deduce the key used by the terminal to communicate with the second access network device based on the NH corresponding to the NCC corresponding to the second access network device (i.e., the second NCC), the PCI of the cell on the second access network device, and the carrier frequency. In this way, the terminal can obtain the keys corresponding to multiple candidate access network devices.

[0584] The above S1001 to S1004 can be understood as a switching preparation process, and the relevant implementation can refer to the description in the first embodiment.

[0585] S1005: The first access network device determines that the second access network device to which the terminal needs to switch is an access network device that has not been switched during the continuous LTM switching process of the terminal.

[0586] For example, the specific implementation of S1005 may refer to the description in S804.

[0587] S1006: The first access network device sends a third candidate access network device list to the second access network device. The third candidate access network device list includes identifiers of access network devices that have not been switched during the continuous LTM switching process of the terminal.

[0588] S1007: The first access network device sends a first MAC layer message to the terminal, where the first MAC layer message is used to trigger the terminal to switch to the second access network device.

[0589] Here, the first MAC layer message may include an identifier of the second access network device.

[0590] Optionally, in response to the first MAC layer message, the terminal may delete context information related to the first access network device, such as deleting the first NCC, a key used for communication between the terminal and the first access network device, and the like.

[0591] S1008: The terminal switches to the second access network device according to the parameters in the container constructed by the second access network device.

[0592] S1009: The terminal communicates with the second access network device according to the key used by the terminal to communicate with the second access network device.

[0593] Several implementations of the terminal obtaining the key used for communicating with the second access network device are described in detail herein.

[0594] Implementation 1. If the terminal determines the keys corresponding to multiple candidate access network devices respectively after receiving the RRC reconfiguration message, and stores the correspondence between the identifiers of the multiple candidate access network devices and the multiple keys, then in S1009, the terminal can obtain the key corresponding to the second access network device based on the identifier of the second access network device carried by the first MAC layer message, and the correspondence between the identifiers of the multiple candidate access network devices and the multiple keys.

[0595] Implementation 2. If the terminal determines the NHs corresponding to multiple NCCs after receiving the RRC reconfiguration message, and stores the correspondence between the identifiers of multiple candidate access network devices and the multiple NHs, then in S1009, the terminal can obtain the NH corresponding to the second access network device based on the identifier of the second access network device carried by the first MAC layer message, and the correspondence between the identifiers of multiple candidate access network devices and the multiple NHs, and then deduce the key used for the terminal to communicate with the second access network device based on the NH corresponding to the second access network device, the PCI of the cell on the second access network device, and the carrier frequency.

[0596] Implementation 3. If the terminal determines the NHs corresponding to multiple NCCs after receiving the RRC reconfiguration message, and stores the correspondence between the identifiers of multiple candidate access network devices and the multiple NCCs, and the correspondence between the multiple NCCs and the multiple NHs, then in S1009, the terminal can obtain the NCC corresponding to the second access network device based on the identifier of the second access network device carried by the first MAC layer message, and the correspondence between the identifiers of multiple candidate access network devices and the multiple NCCs; obtain the NH corresponding to the second access network device based on the NCC corresponding to the second access network device, and the correspondence between the multiple NCCs and the multiple NHs; and further, deduce the key used by the terminal to communicate with the second access network device based on the NH corresponding to the second access network device, the PCI of the cell on the second access network device, and the carrier frequency.

[0597] Implementation 4. If the terminal stores the correspondence between the identifiers of multiple candidate access network devices and multiple NCCs after receiving the RRC reconfiguration message (without deducing the NH and the key), then in S1009, the terminal can obtain the NCC corresponding to the second access network device (i.e., the second NCC) based on the identifier of the second access network device carried by the first MAC layer message, and the correspondence between the identifiers of multiple candidate access network devices and multiple NCCs, and then deduce the NH corresponding to the second NCC, and deduce the key used for the terminal to communicate with the second access network device based on the NH corresponding to the second NCC, the PCI of the cell on the second access network device, and the carrier frequency.

[0598] Exemplarily, after the MAC layer of the terminal obtains the identifier of the second access network device from the first MAC layer message, it can pass the identifier of the second access network device to the RRC layer; further, the RRC layer of the terminal can obtain the key used by the terminal to communicate with the second access network device based on the identifier of the second access network device (for example, obtaining the key used by the terminal to communicate with the second access network device according to any one of implementations 1 to 4 above), and then communicate with the second access network device based on the key.

[0599] Optionally, after the terminal switches from the first access network device to the second access network device, the method further includes:

[0600] S1010: The second access network device determines that a third access network device to which the terminal needs to switch is an access network device that has not been switched during the continuous LTM switching process of the terminal.

[0601] Illustratively, the specific implementation of S1010 may refer to the description in S809.

[0602] S1011. The second access network device sends a fourth candidate access network device list to the third access network device. The fourth candidate access network device list includes identifiers of access network devices that have not been switched during the continuous LTM switching process of the terminal.

[0603] S1012: The second access network device sends a second MAC layer message to the terminal, where the second MAC layer message is used to trigger the terminal to switch to a third access network device.

[0604] Optionally, in response to the second MAC layer message, the terminal may delete context information related to the second access network device, such as deleting the NCC, NH and key corresponding to the second access network device.

[0605] S1013: The terminal switches to the third access network device according to the parameters in the container constructed by the third access network device.

[0606] S1014: The terminal communicates with the third access network device according to the key for communicating between the terminal and the third access network device.

[0607] The implementation of the above S1005 to S1014 may refer to the description of S804 to S813 in the fourth embodiment.

[0608] It is understandable that if the terminal derives the key corresponding to the current target access network device after receiving the switching command message, the terminal may only need to derive the keys corresponding to some of the multiple candidate access network devices. For example, if the terminal does not switch to a certain candidate access network device, the terminal does not need to derive the key corresponding to the candidate access network device. For details, refer to the description in Example 5.

[0609] By adopting the above method, during the switching preparation process, each of the multiple candidate access network devices can obtain the corresponding NCC from the AMF network element and encapsulate the NCC in a container; then the terminal can determine the key used by the terminal to communicate with the candidate access network device based on the NCC in the container constructed by the candidate access network device. Since the NCCs corresponding to different candidate access network devices are different, one-hop security can be achieved. In addition, since the source access network device can determine whether the target access network device is an access network device that has not been switched during the continuous LTM switching process of the terminal, if so, LTM cross-site switching can be performed, otherwise ordinary cross-site switching can be performed, so that when the terminal switches back and forth between multiple access network devices, there will be no problem of key reuse.

[0610] Based on the sixth embodiment, a possible implementation process is described below in combination with the seventh embodiment. In the seventh embodiment, the "first access network device" in the fourth embodiment is access network device 0, the "second access network device" is access network device 1, and the "third access network device" is access network device 2.

[0611] Embodiment 7

[0612] Fig.11 This is a flow chart corresponding to the communication method provided in the embodiment of the present application. Fig.11 As shown, the process may include:

[0613] S1101, the terminal is connected to 5GC through access network device 0.

[0614] The terminal can access the access network device 0 through the initial access process, and access the 5GC through the access network device 0 to complete the attachment. Furthermore, the key KgNB (referred to as K0 for ease of description) and NCC0 (K0 is associated with NCC0) are respectively stored on the terminal and the access network device 0, and NCC0 is stored on the AMF network element.

[0615] S1102, access network device 0 determines multiple candidate access network devices for LTM switching.

[0616] Optionally, access network device 0 can determine the maximum number M of candidate access network devices for LTM switching based on NCC0, and the maximum number is less than or equal to the maximum value of NCC minus NCC0. In other words, the number of candidate access network devices for LTM switching determined by access network device 0 should be less than or equal to M to avoid the same NCC corresponding to different access network devices in the future.

[0617] The access network device 0 may determine multiple candidate access network devices for LTM switching by referring to the method described in S402. In this process, the multiple candidate access network devices for LTM switching include access network device 1, access network device 2, ..., access network device 5 as an example for description.

[0618] S1103 , access network device 0 sends a handover request message 1 to access network device 1 . Correspondingly, access network device 1 receives the handover request message 1 from access network device 0 .

[0619] S1104, access network device 1 sends message a1 to the AMF network element, where message a1 is used to request the NCC and NH corresponding to access network device 1; accordingly, the AMF network element receives message a1.

[0620] If access network device 1 allows the terminal to perform LTM switching, message a1 can be sent to the AMF network element; otherwise, message a1 may not be sent.

[0621] S1105, the AMF network element sends message a2 to access network device 1, and message a2 includes the NCC and NH corresponding to access network device 1; accordingly, access network device 1 receives message a2 from the AMF network element.

[0622] The above-mentioned message a1 may be a specific message dedicated to requesting the NCC and NH corresponding to the access network device 1; or, the message a1 includes request information, and the request information is used to request the NCC and NH corresponding to the access network device 1. In this way, after receiving the message a1, the AMF network element may update the locally stored NCC value by 1 to obtain an updated NCC (called NCC1), so as to perform vertical deduction according to the updated NCC to obtain an updated NH (called NH1). NCC1 and NH1 are associated as an updated pair of {NH1, NCC1}. The message a2 may include the NCC (i.e., NCC1) and NH (i.e., NH1) corresponding to the access network device 1.

[0623] Optionally, after receiving NH1, the access network device 1 can deduce the key K1 according to NH1, the PCI of the cell of the access network device 1, and the carrier frequency. * , and save the key K1 * (For example, it is stored in the context information related to the access network device 1). The embodiment of the present application does not limit the access network device 1 to derive the key K1 * For example, the access network device 1 may also deduce the key K1 after receiving the handover completion message from the terminal. * .

[0624] S1106, access network device 1 constructs a container.

[0625] The container carries the identifier of access network device 1, NCC1 and configuration information, and the configuration information includes parameters for the terminal to switch to access network device 1. Among them, the NCC1 carried in the container is obtained by access network device 1 from the AMF network element (different from the second solution, the NCC carried in the container is obtained from the source access network device).

[0626] S1107 , access network device 1 sends a handover request confirmation message 1 to access network device 0 . Correspondingly, access network device 0 receives the handover request confirmation message 1 from access network device 1 .

[0627] The handover request confirmation message 1 includes a container constructed by the access network device 1 .

[0628] S1108 , access network device 0 sends a handover request message 2 to access network device 2 . Correspondingly, access network device 2 receives the handover request message 2 from access network device 0 .

[0629] S1109, access network device 2 sends message b1 to the AMF network element, message b1 is used to request the NCC and NH corresponding to access network device 2; accordingly, the AMF network element receives message b1.

[0630] If access network device 2 allows the terminal to perform LTM switching, message b1 can be sent to the AMF network element; otherwise, message b1 may not be sent.

[0631] S1110, the AMF network element sends message b2 to access network device 2, and message b2 includes the NCC and NH corresponding to access network device 2; accordingly, access network device 2 receives message a2 from the AMF network element.

[0632] The above-mentioned message b1 may be a specific message dedicated to requesting the NCC and NH corresponding to access network device 1; or, message b1 includes request information, and the request information is used to request the NCC and NH corresponding to access network device 2. In this way, after receiving message b1, the AMF network element may update the locally stored NCC value by adding 1 to obtain an updated NCC (called NCC2), so as to perform vertical deduction based on the updated NCC to obtain an updated NH (called NH2). NCC2 and NH2 are associated as an updated pair of {NH2, NCC2}. Message b2 may include the NCC (i.e., NCC2) and NH (i.e., NH2) corresponding to access network device 2.

[0633] Optionally, after receiving NH2, the access network device 2 can deduce the key K2* according to NH2, the PCI of the cell of the access network device 2, and the carrier frequency, and save the key K2* (for example, save it in the context information related to the access network device 2). The embodiment of the present application does not limit the execution time of the access network device 1 to deduce the key K1*. For example, the access network device 1 can also deduce the key K1* after receiving the handover completion message from the terminal.

[0634] S1111, access network device 2 constructs a container.

[0635] The container carries the identifier of access network device 2, NCC2 and configuration information, and the configuration information is used to configure the parameters for the terminal to switch to access network device 2. Among them, the NCC2 carried in the container is obtained by access network device 2 from the AMF network element (different from the second solution, the NCC carried in the container is obtained from the source access network device).

[0636] S1112 , access network device 2 sends a handover request confirmation message 2 to access network device 0 . Correspondingly, access network device 0 receives the handover request confirmation message 2 from access network device 2 .

[0637] The handover request confirmation message 2 includes a container constructed by the access network device 2 .

[0638] It can be understood that the above only describes access network device 0 sending a switching request message to access network device 1 and access network device 2. Access network device 0 can also send switching request information to other candidate access network devices for LTM switching. The specific implementation can refer to S903 to S912 above and will not be repeated here.

[0639] S1113, access network device 0 sends an RRC reconfiguration message to the terminal, where the RRC reconfiguration message carries a container constructed by access network device 1 and a container constructed by access network device 2; accordingly, the terminal receives the RRC reconfiguration message.

[0640] The terminal obtains the containers constructed by each candidate access network device of the LTM (such as the containers constructed by access network devices 1 to 5) from the RRC reconfiguration message, and obtains the NCCs (such as NCC1 to NCC5) corresponding to access network devices 1 to 5 respectively. The terminal calculates the NH corresponding to each NCC and stores the corresponding relationship between the NCC and the NH.

[0641] Exemplarily, the terminal deduces the NHs corresponding to NCC1 to NCC5 in ascending order of NCC. For example, the terminal performs a corresponding number of vertical deductions based on the difference between NCC1 and NCC0 stored locally in the terminal to obtain the corresponding NH (i.e., NH1); the terminal performs a corresponding number of vertical deductions based on the difference between NCC2 and NCC1 to obtain the corresponding NH (i.e., NH2); the terminal performs a corresponding number of vertical deductions based on the difference between NCC3 and NCC2 to obtain the corresponding NH (i.e., NH3); and so on, and then obtain the NHs corresponding to NCC1 to NCC5.

[0642] The terminal can save the correspondence between at least two of the three items: the access network device identifier, NCC and NH. The specific implementation form is not limited. For example, the terminal can include the correspondence between the access network device identifier and NH, or the terminal can maintain the correspondence between the access network device identifier, NCC and NH.

[0643] Optionally, the terminal can deduce the key K1 according to NH1, the PCI of the cell on the access network device 1, and the carrier frequency. * , and save access network device 1 and key K1 * The terminal can deduce the key K2 based on NH2, the PCI of the cell on the access network device 2, and the carrier frequency. * , and save access network device 2 and key K2 * By analogy, the terminal can obtain the keys corresponding to access network devices 1 to 5. The embodiment of the present application does not limit the specific timing for the terminal to determine the NH corresponding to NCC1 to NCC5 and the keys corresponding to access network devices 1 to 5.

[0644] S1114, the terminal sends an RRC reconfiguration completion message to access network device 0; correspondingly, access network device 0 receives the RRC reconfiguration completion message from the terminal.

[0645] S1115 to S1119 can refer to the above-mentioned S1011 to S1015.

[0646] S1120, access network device 1 sends a path switching request message to the AMF network element; accordingly, the AMF network element receives the path switching request message.

[0647] Optionally, the path switching request message may include indication information, where the indication information is used to indicate that the AMF network element does not need to perform NCC update. Correspondingly, the AMF network element receives the indication information, and the AMF skips the NCC update and NH calculation process.

[0648] S1121, the AMF network element sends a path switching response message to access network device 1; accordingly, access network device 1 receives the path switching response message, thereby completing the path switching.

[0649] Since the AMF network element can skip the NCC update and NH calculation process according to the indication information, the path switching response message does not need to include the updated NCC and NH.

[0650] Here, path switching means that the data transmission path of the terminal is switched from "UPF network element─access network device 0─terminal" to "UPF network element─access network device 1─terminal".

[0651] S1122, the terminal and access network device 1 use key K1 * to communicate.

[0652] The terminal can obtain the key K1 corresponding to the identifier of the access network device 1 according to the identifier of the access network device 1 in the above-mentioned switching command message (ie, MAC CE). * ; and access network device 1 also deduces the key K1 * Therefore, the terminal and access network device 1 can use key K1 * to communicate.

[0653] Specifically, if in S1113, the terminal receives the RRC reconfiguration message, it determines the keys corresponding to the access network devices 1 to 5, respectively, and saves the corresponding relationship between the identifiers of the access network devices and the keys. After the MAC layer of the terminal receives the switching command message, it can pass the identifier of the access network device 1 in the switching command message to the RRC layer, and then the RRC layer of the terminal obtains the key K1 corresponding to the identifier of the access network device 1 according to the identifier of the access network device 1. * .

[0654] Alternatively, if in S1113, the terminal receives the RRC reconfiguration message, determines the NH corresponding to NCC1 to NCC5, and saves the corresponding relationship between the identifier of the access network device and the NH, then after the MAC layer of the terminal receives the handover command message, it can pass the identifier of the access network device 1 in the handover command message to the RRC layer, and then the RRC layer of the terminal obtains the corresponding NH according to the identifier of the access network device 1, and then determines the key K1 according to the NH, the identifier of the cell on the access network device 1, and the carrier frequency. * .

[0655] It is understandable that the terminal may subsequently switch from access network device 1 to other access network devices (such as access network device 2). For specific implementation, reference may be made to the description of the terminal switching from access network device 0 to access network device 1.

[0656] also, Fig.11 The process shown is Fig.10 The processes shown correspond to each other, and the steps of the two can refer to each other. For example, S1001 can refer to S1102, S1002 and S1003 can refer to S1103 to S1112, S1004 can refer to S1113, S1005 can refer to S1115 and S1116, S1006 can refer to S1117, S1007 can refer to S1118, S1008 can refer to S1119, and S1009 can refer to S1122.

[0657] With respect to the above embodiments, it can be understood that:

[0658] (1) In various embodiments of the present application, the cell in "PCI and carrier frequency of the cell on the access network device" involved in deducing the key can be any cell on the access network device. For example, if the access network device is a target access network device, the cell can be the target cell or other cells other than the target cell. The embodiments of the present application do not limit this.

[0659] (2) In the various embodiments of the present application, if there is no special explanation or logical conflict, the terms and / or descriptions between different embodiments are consistent and can be referenced to each other, and the technical features in different embodiments can be combined to form new embodiments according to their inherent logical relationships. In addition, in the same embodiment, different implementations or different examples can also be referenced or referred to each other.

[0660] (3) The various numerical numbers involved in this application are only for the convenience of description and are not used to limit the scope of this application. The step numbers of the above-mentioned flowcharts are only an example of the execution process and do not constitute a restriction on the order of execution of the steps. That is, the size of the step number does not mean the order of execution. The execution order of each step should be determined by its function and internal logic. In addition, not all the steps shown in each flowchart are required to be executed. Some steps can be added or deleted based on the actual needs of each flowchart.

[0661] The above mainly introduces the solution provided by the embodiment of the present application from the perspective of the interaction between the terminal and the access network device. It is understandable that in order to achieve the above functions, the terminal and the access network device may include hardware structures and / or software modules corresponding to the execution of each function. Those skilled in the art should easily realize that, in combination with the units and algorithm steps of each example described in the embodiments disclosed herein, the embodiments of the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0662] The embodiment of the present application can divide the terminal and the access network device into functional units according to the above method example. For example, each functional unit can be divided according to each function, or two or more functions can be integrated into one unit. The above integrated unit can be implemented in the form of hardware or in the form of software functional units.

[0663] In the case of an integrated unit, Fig.12 A possible exemplary block diagram of the device involved in the embodiments of the present application is shown. Fig.12 As shown, the apparatus 1200 may include: a processing unit 1202 and a communication unit 1203. The processing unit 1202 is used to control and manage the actions of the apparatus 1200. The communication unit 1203 is used to support the communication between the apparatus 1200 and other devices. Optionally, the communication unit 1203 is also called a transceiver unit, and may include a receiving unit and / or a sending unit, which are respectively used to perform receiving and sending operations. The apparatus 1200 may also include a storage unit 1201 for storing program code and / or data of the apparatus 1200.

[0664] (1) The apparatus 1200 may be the first access network device in the above embodiment. The processing unit 1202 may support the apparatus 1200 in executing the actions of the first access network device in each method example above. Alternatively, the processing unit 1202 mainly executes the internal actions of the first access network device in the method example, and the communication unit 1203 may support the communication between the apparatus 1200 and other devices.

[0665] For example, in one embodiment, the communication unit 1203 is used to: receive a container from each access network device among multiple candidate access network devices, the container of each access network device including parameters for the terminal to switch to each access network device; send a radio resource control RRC reconfiguration message to the terminal, the RRC reconfiguration message including the container of each access network device among the multiple candidate access network devices; the communication unit 1203 is also used to: when the terminal needs to switch to a second access network device among the multiple candidate access network devices, send a first media access control MAC layer message to the terminal, the first MAC layer message including information for triggering the terminal to switch to the second access network device and information for indicating a first NCC, the first NCC being used to determine the key used by the terminal to communicate with the second access network device.

[0666] In one possible design, the communication unit 1203 is specifically used to: after the RRC layer of the first access network device passes the information used to indicate the first NCC to the MAC layer of the first access network device, send the MAC layer message to the terminal through the MAC layer of the first access network device.

[0667] In a possible design, the communication unit 1203 is further used to: receive the first next hop link counter NCC from the mobility management network element, where the first NCC is carried in an initial context establishment request message or a path switching response message.

[0668] In a possible design, the communication unit 1203 is further used to: send a first candidate access network device list to the second access network device, where the first candidate access network device list includes an identifier of at least one candidate access network device among the multiple candidate access network devices.

[0669] (2) The apparatus 1200 may be the second access network device in the above embodiment. The processing unit 1202 may support the apparatus 1200 in executing the actions of the second access network device in each method example above. Alternatively, the processing unit 1202 mainly executes the internal actions of the second access network device in the method example, and the communication unit 1203 may support the communication between the apparatus 1200 and other devices.

[0670] For example, in one embodiment, the communication unit 1203 is used to: send a container of the second access network device, the container including parameters for the terminal to switch to the second access network device; the processing unit 1202 is used to: after the terminal switches from the first access network device to the second access network device through LTM switching, determine that the terminal needs to switch to a third access network device among at least one candidate access network device; the communication unit 1203 is also used to: send a second MAC layer message to the terminal, the second MAC layer message including information for triggering the terminal to switch to the third access network device and information for indicating a second NCC, the second NCC being used to determine the key used by the terminal to communicate with the third access network device.

[0671] In one possible design, the communication unit 1203 is specifically used to: after the RRC layer of the second access network device passes the information used to indicate the second NCC to the MAC layer of the second access network device, send the second MAC layer message to the terminal through the MAC layer of the second access network device.

[0672] In one possible design, after the terminal switches to the second access network device, the communication unit 1203 is also used to: send a path switching request message to the mobile management network element; receive a path switching response message from the mobile management network element, and the path switching response message includes the second NCC and the next hop NH corresponding to the second NCC.

[0673] In one possible design, after determining that the terminal needs to switch to the third access network device, the processing unit 1202 is also used to: determine the key used by the third access network device to communicate with the terminal according to the NH corresponding to the second NCC; the communication unit 1203 is also used to: send the key used by the third access network device to communicate with the terminal to the third access network device.

[0674] In one possible design, the communication unit 1203 is also used to: send a third MAC layer message to the terminal device, the third MAC layer message including information for indicating the second NCC, and the second NCC is used to determine the key used by the terminal to communicate with the second access network device; the processing unit 1202 is also used to: determine the key used by the terminal to communicate with the second access network device according to the NH corresponding to the second NCC.

[0675] In one possible design, after sending the container of the second access network device to the terminal, the communication unit 1203 is also used to: receive a first candidate access network device list from the first access network device, the first candidate access network device list including an identifier of at least one candidate access network device; if it is determined that the third access network device belongs to the first candidate access network device list, then send the second MAC layer message to the terminal.

[0676] In one possible design, after determining that the terminal needs to switch to a third access network device in at least one candidate access network device, the communication unit 1203 is also used to: send a second candidate access network device list to the third access network device, the second candidate access network device list including the identifiers of some or all candidate access network devices in the first candidate access network device list.

[0677] (3) The device 1200 may be a terminal in the above embodiment. The processing unit 1202 may support the device 1200 to execute the actions of the terminal in the above method examples. Alternatively, the processing unit 1202 mainly executes the internal actions of the terminal in the method examples, and the communication unit 1203 may support the communication between the device 1200 and other devices.

[0678] For example, in one embodiment, the communication unit 1203 is used to: receive a container from each access network device among multiple candidate access network devices, the container of each access network device including parameters for the terminal to switch to each access network device, and the multiple candidate access network devices include a second access network device; receive a first MAC layer message from a first access network device, the first MAC layer message including information for triggering the terminal to switch to the second access network device and information for indicating a first NCC; the processing unit 1202 is used to: switch to the second access network device according to the parameters in the container of the second access network device; and determine, according to the first NCC, the key used by the terminal to communicate with the second access network device.

[0679] In one possible design, the processing unit 1202 is specifically used to: when the first NCC is the same as the NCC stored in the terminal, deduce the key used by the terminal to communicate with the second access network device based on a first input parameter, and the first input parameter includes information about the cell on the second access network device.

[0680] In one possible design, the processing unit 1202 is specifically used to: after the MAC layer of the terminal passes the information used to indicate the first NCC to the RRC layer of the terminal, determine, through the RRC layer of the terminal, the key used for the terminal to communicate with the second access network device according to the first NCC.

[0681] In one possible design, the multiple candidate access network devices also include a third access network device; after the terminal switches to the second access network device, the communication unit 1203 is also used to: receive a second MAC layer message from the second access network device, the second MAC layer message including information for triggering the terminal to switch to the third access network device and information for indicating a second NCC; the processing unit 1202 is also used to: switch to the third access network device according to parameters in the container of the third access network device; and determine, according to the second NCC, the key used by the terminal to communicate with the third access network device.

[0682] In one possible design, the processing unit 1202 is specifically used to: when the second NCC is different from the NCC stored in the terminal, deduce the key used by the terminal to communicate with the third access network device based on a second input parameter, and the second input parameter includes the NH corresponding to the second NCC and the cell information on the third access network device.

[0683] In another embodiment, the communication unit 1203 is used to: receive a container from each access network device among multiple candidate access network devices, the container of each access network device including parameters for the terminal to switch to each access network device, and the multiple candidate access network devices include a second access network device; receive a first MAC layer message from a first access network device, the first MAC layer message including information for triggering the terminal to switch to the second access network device; the processing unit 1202 is used to: switch to the second access network device according to the parameters in the container of the second access network device; the communication unit 1203 is also used to: receive a third MAC layer message from the second access network device, the third MAC layer message including information for indicating a second NCC; the processing unit 1202 is also used to: determine the key used by the terminal to communicate with the second access network device according to the second NCC.

[0684] In one possible design, the first MAC layer message also includes information for indicating a first NCC; the processing unit 1202 is also used to: determine, based on the first NCC, the key used by the terminal to communicate with the second access network device, and store it in the access layer AS security context; wherein, when the key used by the terminal to communicate with the second access network device is determined based on the second NCC, the key determined based on the first NCC in the AS security context is updated to the key determined based on the second NCC.

[0685] In one possible design, the processing unit 1202 is specifically used to: when the first NCC is the same as the NCC stored in the terminal, deduce the key used by the terminal to communicate with the second access network device according to a first input parameter, and the first input parameter includes the KgNB corresponding to the first NCC and the information of the cell on the second access network device.

[0686] In one possible design, the processing unit 1202 is specifically used to: when the second NCC is different from the NCC stored in the terminal, deduce the key used by the terminal to communicate with the second access network device according to a third input parameter, and the third input parameter includes the NH corresponding to the second NCC and the cell information on the second access network device.

[0687] In a possible design, the processing unit 1202 is specifically used to: when the second NCC is different from the NCC stored in the terminal, update the NCC stored in the terminal to the second NCC.

[0688] In one possible design, the processing unit 1202 is specifically used to: after the MAC layer of the terminal passes the information used to indicate the second NCC to the RRC layer of the terminal, determine, through the RRC layer of the terminal, the key used for the terminal to communicate with the second access network device according to the second NCC.

[0689] It should be understood that the division of the units in the above device is only a division of logical functions. In actual implementation, they can be fully or partially integrated into one physical entity, or they can be physically separated. And the units in the device can all be implemented in the form of software calling through processing elements; they can also be all implemented in the form of hardware; some units can also be implemented in the form of software calling through processing elements, and some units can be implemented in the form of hardware. For example, each unit can be a separately established processing element, or it can be integrated in a certain chip of the device. In addition, it can also be stored in the memory in the form of a program, and called and executed by a certain processing element of the device. The function of the unit. In addition, all or part of these units can be integrated together, or they can be implemented independently. The processing element described here can also be a processor, which can be an integrated circuit with signal processing capabilities. In the implementation process, each operation of the above method or each unit above can be implemented by an integrated logic circuit of hardware in the processor element or in the form of software calling through a processing element.

[0690] In one example, the unit in any of the above devices may be one or more integrated circuits configured to implement the above method, such as one or more application specific integrated circuits (ASIC), or one or more digital singnal processors (DSP), or one or more field programmable gate arrays (FPGA), or a combination of at least two of these integrated circuit forms. For another example, when the unit in the device can be implemented in the form of a processing element scheduler, the processing element can be a processor, such as a general-purpose central processing unit (CPU), or other processors that can call programs. For another example, these units can be integrated together and implemented in the form of a SoC.

[0691] The above unit for receiving is an interface circuit of the device, which is used to receive signals from other devices. For example, when the device is implemented in the form of a chip, the receiving unit is an interface circuit of the chip used to receive signals from other chips or devices. The above unit for sending is an interface circuit of the device, which is used to send signals to other devices. For example, when the device is implemented in the form of a chip, the sending unit is an interface circuit of the chip used to send signals to other chips or devices.

[0692] Based on the above embodiments, the present application also provides a communication device, referring to Fig.13 As shown, the communication device 1300 may include a transceiver 1301 and a processor 1302. Optionally, the communication device 1300 may further include a memory 1303. The memory 1303 may be disposed inside the communication device 1300 or outside the communication device 1300. The processor 1302 may control the transceiver 1301 to receive and send messages, etc.

[0693] Specifically, the processor 1302 may be a central processing unit (CPU), a network processor (NP) or a combination of a CPU and a NP. The processor 1302 may further include a hardware chip. The hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (PLD) or a combination thereof. The PLD may be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL) or any combination thereof.

[0694] The transceiver 1301, the processor 1302 and the memory 1303 are interconnected. Optionally, the transceiver 1301, the processor 1302 and the memory 1303 are interconnected via a bus 1304; the bus 1304 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Fig.13 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0695] In an optional implementation, the memory 1303 is used to store programs, etc. Specifically, the program may include a program code, and the program code includes a computer operation instruction. The memory 1303 may include a RAM, and may also include a non-volatile memory (non-volatile memory), such as one or more disk memories. The processor 1302 executes the application stored in the memory 1303 to implement the above functions, thereby realizing the functions of the communication device 1300.

[0696] Exemplarily, the communication apparatus 1300 may be the first access network device in the above embodiment, or may also be the second access network device in the above embodiment, or may also be the terminal in the above embodiment.

[0697] In one embodiment, when the communication device 1300 implements the function of the first access network device in the above method embodiment, the transceiver 1301 can implement the transceiver operation performed by the first access network device in the above method embodiment; the processor 1302 can implement other operations except the transceiver operation performed by the first access network device in the above method embodiment. For specific related descriptions, please refer to the related descriptions in the above embodiments, which will not be described in detail here.

[0698] In another embodiment, when the communication device 1300 implements the function of the second access network device in the above method embodiment, the transceiver 1301 can implement the transceiver operation performed by the second access network device in the above method embodiment; the processor 1302 can implement other operations except the transceiver operation performed by the second access network device in the above method embodiment. For specific related descriptions, please refer to the related descriptions in the above embodiments, which will not be described in detail here.

[0699] In another embodiment, when the communication device 1300 implements the function of the terminal in the above method embodiment, the transceiver 1301 can implement the transceiver operation performed by the terminal in the above method embodiment; the processor 1302 can implement other operations except the transceiver operation performed by the terminal in the above method embodiment. For specific related descriptions, please refer to the related descriptions in the above embodiments, which will not be described in detail here.

[0700] An embodiment of the present application provides a communication system, which includes at least one of a terminal, a first access network device, and a second access network device. The terminal is used to execute the functions of the terminal side in the above embodiment, the first access network device is used to execute the functions of the first access network device side in the above embodiment, and the second access network device is used to execute the functions of the second access network device side in the above embodiment.

[0701] The terms "system" and "network" in the embodiments of the present application can be used interchangeably. "At least one" refers to one or more, and "multiple" refers to two or more. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist, for example, A and / or B, which can represent: the existence of A alone, the existence of A and B at the same time, and the existence of B alone, where A and B can be singular or plural. The character " / " generally indicates that the associated objects before and after are in an "or" relationship. "At least one of the following (individuals)" or similar expressions thereof refer to any combination of these items, including any combination of single items (individuals) or plural items (individuals). For example, "at least one of A, B and C" includes A, B, C, AB, AC, BC or ABC. And, unless otherwise specified, the ordinal numbers such as "first" and "second" mentioned in the embodiments of the present application are used to distinguish multiple objects, and are not used to limit the order, timing, priority or importance of multiple objects.

[0702] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0703] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0704] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0705] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0706] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A communication method, characterized in that: The method is applied to a first access network device or a chip in the first access network device, and the method includes: Receiving a container from each access network device among a plurality of candidate access network devices, wherein the container of each access network device includes parameters for the terminal to switch to each access network device; Sending a radio resource control (RRC) reconfiguration message to the terminal, wherein the RRC reconfiguration message includes a container constructed by each access network device in the multiple candidate access network devices; In a case where the terminal needs to switch to a second access network device among the multiple candidate access network devices, a first media access control MAC layer message is sent to the terminal, wherein the first MAC layer message includes information for triggering the terminal to switch to the second access network device and information for indicating a first next hop link counter NCC, wherein the first NCC is used to determine a key used by the terminal to communicate with the second access network device.

2. The method according to claim 1, characterized in that Sending a MAC layer message to the terminal includes: The RRC layer of the first access network device transmits information used to indicate the first NCC to the MAC layer of the first access network device; The MAC layer of the first access network device sends the MAC layer message to the terminal.

3. The method according to claim 1 or 2, characterized in that: The method further comprises: receiving the first NCC from a mobility management network element; The first NCC is carried in an initial context establishment request message or a path switch response message.

4. The method according to any one of claims 1 to 3, characterized in that The method further comprises: A first candidate access network device list is sent to the second access network device, where the first candidate access network device list includes an identifier of at least one candidate access network device among the multiple candidate access network devices.

5. The method according to any one of claims 1 to 4, characterized in that The information used to indicate the first NCC includes at least one of the following: the first NCC; an index value of the first NCC; The ciphertext encrypted by the first NCC.

6. A communication method, characterized in that: The method is applied to a second access network device or a chip in the second access network device, and the method includes: Sending a container of the second access network device to the terminal, where the container includes parameters for the terminal to switch to the second access network device; After the terminal switches from the first access network device to the second access network device through the layer 1 / layer 2 triggered mobility LTM switching, determining that the terminal needs to switch to a third access network device among at least one candidate access network device; A second MAC layer message is sent to the terminal, wherein the second MAC layer message includes information for triggering the terminal to switch to the third access network device and information for indicating a second NCC, where the second NCC is used to determine a key used by the terminal to communicate with the third access network device.

7. The method according to claim 6, characterized in that Sending a second MAC layer message to the terminal includes: The RRC layer of the second access network device transmits information used to indicate the second NCC to the MAC layer of the second access network device; The MAC layer of the second access network device sends the second MAC layer message to the terminal.

8. The method according to claim 6 or 7, characterized in that: After the terminal switches to the second access network device, the method further includes: Sending a path switching request message to a mobility management network element; A path switching response message is received from the mobility management network element, where the path switching response message includes the second NCC and a next hop NH corresponding to the second NCC.

9. The method according to claim 8, characterized in that After determining that the terminal needs to be switched to the third access network device, the method further includes: Determine, according to the NH corresponding to the second NCC, a key used by the third access network device to communicate with the terminal; Sending a key used by the third access network device to communicate with the terminal to the third access network device.

10. The method according to claim 8, characterized in that The method further comprises: Sending a third MAC layer message to the terminal device, wherein the third MAC layer message includes information used to indicate the second NCC, and the second NCC is used to determine a key used by the terminal to communicate with the second access network device; According to the NH corresponding to the second NCC, a key used by the terminal to communicate with the second access network device is determined.

11. The method according to any one of claims 6 to 10, characterized in that After sending the container of the second access network device to the terminal, the method further includes: receiving a first candidate access network device list from the first access network device, the first candidate access network device list including an identifier of the at least one candidate access network device; Sending a second MAC layer message to the terminal includes: if it is determined that the third access network device belongs to the first candidate access network device list, sending the second MAC layer message to the terminal.

12. The method according to claims 6 to 11, characterized in that After determining that the terminal needs to be switched to a third access network device in at least one candidate access network device, the method further includes: A second candidate access network device list is sent to the third access network device, where the second candidate access network device list includes identifiers of some or all of the candidate access network devices in the at least one candidate network access device.

13. A communication method, characterized in that: The method is applied to a terminal or a chip in the terminal, and the method includes: Receiving a container from each access network device among a plurality of candidate access network devices, wherein the container of each access network device includes parameters for the terminal to switch to each access network device, and the plurality of candidate access network devices include a second access network device; receiving a first MAC layer message from a first access network device, where the first MAC layer message includes information for triggering the terminal to switch to the second access network device and information for indicating a first NCC; Switching to the second access network device according to the parameters in the container of the second access network device; Determine, according to the first NCC, a key used by the terminal to communicate with the second access network device.

14. The method according to claim 13, characterized in that Determining, according to the first NCC, a key used by the terminal to communicate with the second access network device, including: When the first NCC is the same as the NCC stored in the terminal, the key used by the terminal to communicate with the second access network device is deduced based on the first input parameter, and the first input parameter includes the key KgNB corresponding to the first NCC and the cell information on the second access network device.

15. The method according to claim 13 or 14, characterized in that Determining, according to the first NCC, a key used by the terminal to communicate with the second access network device, including: The MAC layer of the terminal transmits information used to indicate the first NCC to the RRC layer of the terminal; The RRC layer of the terminal determines, according to the first NCC, a key used by the terminal to communicate with the second access network device.

16. The method according to any one of claims 13 to 15, characterized in that The multiple candidate access network devices also include a third access network device; After the terminal switches to the second access network device, the method further includes: receiving a second MAC layer message from the second access network device, where the second MAC layer message includes information for triggering the terminal to switch to a third access network device and information for indicating a second NCC; Switching to the third access network device according to the parameters in the container of the third access network device; Determine, according to the second NCC, a key used by the terminal to communicate with the third access network device.

17. The method according to claim 16, characterized in that Determining, according to the second NCC, a key used by the terminal to communicate with the third access network device, including: When the second NCC is different from the NCC stored in the terminal, the key used by the terminal to communicate with the third access network device is derived based on the second input parameter, and the second input parameter includes the NH corresponding to the second NCC and the cell information on the third access network device.

18. The method according to claim 16 or 17, characterized in that The method further comprises: In a case where the second NCC is different from the NCC stored in the terminal, the NCC stored in the terminal is updated to the second NCC.

19. A communication method, characterized in that: The method is applied to a terminal or a chip in the terminal, and the method includes: Receiving a container from each access network device among a plurality of candidate access network devices, wherein the container of each access network device includes parameters for the terminal to switch to each access network device, and the plurality of candidate access network devices include a second access network device; receiving a first MAC layer message from a first access network device, where the first MAC layer message includes information for triggering the terminal to switch to the second access network device; Switching to the second access network device according to the parameters in the container of the second access network device; receiving a third MAC layer message from the second access network device, where the third MAC layer message includes information indicating a second NCC; A key used by the terminal to communicate with the second access network device is determined according to the second NCC.

20. The method according to claim 19, characterized in that The first MAC layer message also includes information for indicating a first NCC; The method further comprises: Determine, according to the first NCC, a key used by the terminal to communicate with the second access network device, and store the key in an access layer AS security context; When the key used for communication between the terminal and the second access network device is determined according to the second NCC, the key determined according to the first NCC in the AS security context is updated to the key determined according to the second NCC.

21. The method according to claim 20, characterized in that Determining, according to the first NCC, a key used by the terminal to communicate with the second access network device, including: When the first NCC is the same as the NCC stored in the terminal, the key used by the terminal to communicate with the second access network device is deduced based on the first input parameter, and the first input parameter includes the key KgNB corresponding to the first NCC and the cell information on the second access network device.

22. The method according to any one of claims 19 to 21, characterized in that Determining, according to the second NCC, a key used by the terminal to communicate with the third access network device, including: When the second NCC is different from the NCC stored in the terminal, the key used by the terminal to communicate with the second access network device is derived based on the third input parameter, and the third input parameter includes the NH corresponding to the second NCC and the cell information on the second access network device.

23. The method according to any one of claims 19 to 22, characterized in that The method further comprises: In a case where the second NCC is different from the NCC stored in the terminal, the NCC stored in the terminal is updated to the second NCC.

24. The method according to any one of claims 19 to 23, characterized in that Determining, according to the second NCC, a key used by the terminal to communicate with the second access network device, including: The MAC layer of the terminal transmits information used to indicate the second NCC to the RRC layer of the terminal; The RRC layer of the terminal determines, according to the second NCC, a key used by the terminal to communicate with the second access network device.

25. The method according to any one of claims 19 to 24, characterized in that The multiple candidate access network devices also include a third access network device; After the terminal switches to the second access network device, the method further includes: receiving a second MAC layer message from the second access network device, where the second MAC layer message includes information for triggering the terminal to switch to a third access network device; Switching to the third access network device according to the parameters in the container of the third access network device; receiving a fourth MAC layer message from the third access network device, where the fourth MAC layer message includes information for indicating a third NCC; According to the third NCC, a key used by the terminal to communicate with the third access network device is determined.

26. The method according to claim 25, characterized in that The second MAC layer message further includes information for indicating the second NCC; The method further comprises: Determine, according to the second NCC, a key used by the terminal to send a handover completion message to the third access network device, and store the key in an AS security context; When the key used for communication between the terminal and the third access network device is determined according to the third NCC, the key determined according to the second NCC in the AS security context is updated to the key determined according to the third NCC.

27. A communication device, characterized in that: The method comprises one or more functional modules for executing the method according to any one of claims 1 to 26.

28. A communication device, characterized in that: It comprises a processor, the processor is coupled to a memory, and a computer program is stored in the memory; the processor is used to call part or all of the computer program in the memory so that the method as claimed in any one of claims 1 to 26 is executed.

29. A computer-readable storage medium, characterized in that: The storage medium stores a computer program, and when part or all of the computer program is executed by a computer, the method according to any one of claims 1 to 26 is executed.

30. A computer program product, characterized in that When a computer reads and executes the computer program product, the method according to any one of claims 1 to 26 is performed.

Images