Communication method and device

Abstract

The invention relates to a communication method, equipment, a computer readable storage medium, a computer program product and a computer program. The method comprises: a first device receiving first information sent by an access network device, the first information carrying a key generation parameter; the first device generates a first key based on the key generation parameter; wherein the first key is used for performing security processing on data transmitted by the first connection; the first connection is the connection between the first device and the second device.

Description

Communication method and device Technical Field

[0001] The present application relates to the field of communications, and more specifically, to a communication method, device, computer-readable storage medium, computer program product, and computer program. Background Art

[0002] In related technologies, terminal devices may need to communicate with network-side access network devices through other terminal devices. In this scenario, the terminal device acting as a relay is called a relay terminal device, and the device connected to the network-side access network device through the relay is called a remote terminal device. However, how to efficiently and securely establish a connection between the remote terminal device and the relay terminal device becomes a problem that needs to be solved.

[0003] Summary of the Invention

[0004] Embodiments of the present application provide a communication method, device, computer-readable storage medium, computer program product, and computer program.

[0005] An embodiment of the present application provides a communication method, including:

[0006] The first device receives first information sent by the access network device, wherein the first information carries a key generation parameter;

[0007] The first device generates a first key based on the key generation parameter; wherein the first key is used to perform security processing on data transmitted through a first connection; and the first connection is a connection between the first device and the second device.

[0008] An embodiment of the present application provides a communication method, including:

[0009] The second device receives second information sent by the access network device, where the second information carries a first key; wherein the first key is used to perform security processing on data transmitted through the first connection; and the first connection is a connection between the first device and the second device.

[0010] An embodiment of the present application provides a communication method, including:

[0011] An access network device sends first information to a first device, and the access network device sends second information to a second device; wherein the first information carries key generation parameters, and the key generation parameters are used to generate a first key; the first key is used to perform security processing on data transmitted on a first connection; the first connection is a connection between the first device and the second device.

[0012] An embodiment of the present application provides a first device, including:

[0013] A first communication unit, configured to receive first information sent by an access network device, wherein the first information carries a key generation parameter;

[0014] The first processing unit is configured to generate a first key based on the key generation parameter; wherein the first key is used to perform security processing on data transmitted via a first connection; and the first connection is a connection between the first device and a second device.

[0015] An embodiment of the present application provides a second device, including:

[0016] The second communication unit is used to receive second information sent by the access network device, where the second information carries a first key; wherein the first key is used to perform security processing on data transmitted by the first connection; the first connection is a connection between the first device and the second device.

[0017] An embodiment of the present application provides an access network device, including:

[0018] A third communication unit is used to send first information to the first device and to send second information to the second device; wherein the first information carries key generation parameters, and the key generation parameters are used to generate a first key; the first key is used to perform security processing on data transmitted on the first connection; the first connection is a connection between the first device and the second device.

[0019] An embodiment of the present application provides a first device, comprising a processor and a memory, wherein the memory is used to store a computer program, and the processor is used to call and execute the computer program stored in the memory, so that the first device performs the above method.

[0020] An embodiment of the present application provides a second device, comprising a processor and a memory, wherein the memory is used to store a computer program, and the processor is used to call and execute the computer program stored in the memory, so that the second device executes the above method.

[0021] An embodiment of the present application provides an access network device, comprising a processor and a memory, wherein the memory is used to store a computer program, and the processor is used to call and execute the computer program stored in the memory, so that the access network device executes the above method.

[0022] The embodiment of the present application provides a chip for implementing the above method.

[0023] Specifically, the chip includes: a processor, which is used to call and run a computer program from a memory, so that a device equipped with the chip executes the above method.

[0024] An embodiment of the present application provides a computer-readable storage medium for storing a computer program, which enables a device to perform the above method when the computer program is executed by the device.

[0025] An embodiment of the present application provides a computer program product, including computer program instructions, which enable a computer to execute the above method.

[0026] An embodiment of the present application provides a computer program, which, when executed on a computer, enables the computer to execute the above method.

[0027] By adopting the above solution, the first device can directly obtain key generation parameters from the access network device and then generate a first key to perform security processing on the data transmitted on the connection between the first device and the second device. This avoids the problem of low processing efficiency caused by a large amount of signaling interaction with the core network device to obtain the key. The solution provided by this application allows the first device to directly interact with the access network device to obtain the first key, thereby improving the processing efficiency of generating the first key and ensuring the efficient establishment of a secure connection between the first device and the second device. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] FIG1 is a schematic diagram of an application scenario according to an embodiment of the present application.

[0029] FIG2 is a system architecture diagram of MP separation bearer according to an embodiment of the present application.

[0030] Figure 3 is a schematic diagram of the 5G dual-link architecture.

[0031] FIG4 is a schematic flowchart of a communication method according to an embodiment of the present application.

[0032] FIG5 is a schematic flowchart of a communication method according to another embodiment of the present application.

[0033] FIG6 is an exemplary flowchart of a communication method according to another embodiment of the present application.

[0034] 7 to 13 are various exemplary flow charts of the processing procedures of the remote UE and the relay UE according to the embodiments of the present application.

[0035] FIG. 14 is a flowchart illustrating an exemplary process of obtaining a key by a remote UE and a relay UE in the related art.

[0036] FIG15 is a schematic block diagram of a first device according to an embodiment of the present application.

[0037] FIG16 is a schematic block diagram of a second device according to an embodiment of the present application.

[0038] FIG17 is a schematic block diagram of an access network device according to an embodiment of the present application.

[0039] FIG18 is a schematic block diagram of an access network device according to another embodiment of the present application.

[0040] FIG19 is a schematic block diagram of a communication device according to an embodiment of the present application.

[0041] FIG20 is a schematic block diagram of a chip according to an embodiment of the present application.

[0042] Figure 21 is a schematic block diagram of a communication system according to an embodiment of the present application. DETAILED DESCRIPTION

[0043] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.

[0044] The technical solutions of the embodiments of the present application can be applied to various communication systems, such as: Global System of Mobile communication (GSM) system, Code Division Multiple Access (CDMA) system, Wideband Code Division Multiple Access (WCDMA) system, General Packet Radio Service (GPRS), Long Term Evolution (LTE) system, Advanced Long Term Evolution (LTE-A) system, New Radio (NR) system, NR system evolution system, LTE on unlicensed spectrum (LTE-U) system, NR on unlicensed spectrum (NR-U) system, Non-Terrestrial Networks (NTN) system, Universal Mobile Telecommunication System (UMTS), Wireless Local Area Networks (WLAN), Wireless Fidelity (Wireless Fidelity) system. Fidelity, WiFi), fifth-generation communication (5th-Generation, 5G) system or other communication systems, etc.

[0045] Generally speaking, traditional communication systems support a limited number of connections and are easy to implement. However, with the development of communication technology, mobile communication systems will not only support traditional communications, but will also support, for example, device-to-device (D2D) communication, machine-to-machine (M2M) communication, machine-type communication (MTC), vehicle-to-vehicle (V2V) communication, or vehicle-to-everything (V2X) communication, etc. The embodiments of the present application can also be applied to these communication systems.

[0046] In one possible implementation, the communication system in the embodiment of the present application can be applied to a carrier aggregation (CA) scenario, a dual connectivity (DC) scenario, and a standalone (SA) networking scenario.

[0047] In one possible implementation, the communication system in the embodiment of the present application can be applied to an unlicensed spectrum, where the unlicensed spectrum can also be considered as a shared spectrum; or, the communication system in the embodiment of the present application can also be applied to an authorized spectrum, where the authorized spectrum can also be considered as an unshared spectrum.

[0048] The embodiments of the present application describe various embodiments in conjunction with network devices and terminal devices, wherein the terminal device may also be referred to as user equipment (UE), access terminal, user unit, user station, mobile station, mobile station, remote station, remote terminal, mobile device, user terminal, terminal, wireless communication device, user agent or user device, etc.

[0049] The terminal device can be a station (STAION, ST) in a WLAN, a cellular phone, a cordless phone, a Session Initiation Protocol (SIP) phone, a Wireless Local Loop (WLL) station, a Personal Digital Assistant (PDA) device, a handheld device with wireless communication capabilities, a computing device or other processing device connected to a wireless modem, a vehicle-mounted device, a wearable device, a terminal device in a next-generation communication system such as an NR network, or a terminal device in a future evolved Public Land Mobile Network (PLMN) network, etc.

[0050] In an embodiment of the present application, the terminal device can be deployed on land, including indoors or outdoors, handheld, wearable or vehicle-mounted; it can also be deployed on the water surface (such as ships, etc.); it can also be deployed in the air (such as airplanes, balloons and satellites, etc.).

[0051] In an embodiment of the present application, the terminal device may be a mobile phone, a tablet computer, a computer with wireless transceiver function, a virtual reality (VR) terminal device, an augmented reality (AR) terminal device, a wireless terminal device in industrial control, a wireless terminal device in self-driving, a wireless terminal device in remote medical, a wireless terminal device in a smart grid, a wireless terminal device in transportation safety, a wireless terminal device in a smart city, or a wireless terminal device in a smart home, etc.

[0052] As an example and not a limitation, in the embodiment of the present application, the terminal device may also be a wearable device. Wearable devices may also be called wearable smart devices, which are a general term for wearable devices that are intelligently designed and developed using wearable technology for daily wear, such as glasses, gloves, watches, clothing, and shoes. A wearable device is a portable device that is worn directly on the body or integrated into the user's clothes or accessories. Wearable devices are not only hardware devices, but also achieve powerful functions through software support, data interaction, and cloud interaction. Broadly speaking, wearable smart devices include those that are fully functional, large in size, and can achieve complete or partial functions without relying on smartphones, such as smart watches or smart glasses, as well as those that only focus on a certain type of application function and need to be used in conjunction with other devices such as smartphones, such as various smart bracelets and smart jewelry for vital sign monitoring.

[0053] In an embodiment of the present application, the network device may be a device for communicating with a mobile device. The network device may be an access point (AP) in WLAN, a base station (BTS) in GSM or CDMA, a base station (NodeB, NB) in WCDMA, an evolved base station (eNB or eNodeB) in LTE, or a relay station or access point, or a vehicle-mounted device, a wearable device, and a network device (gNB) in an NR network, or a network device in a future evolved PLMN network or a network device in an NTN network, etc.

[0054] As an example and not a limitation, in an embodiment of the present application, the network device may have a mobile feature, for example, the network device may be a mobile device. Alternatively, the network device may be a satellite or a balloon station. For example, the satellite may be a low earth orbit (LEO) satellite, a medium earth orbit (MEO) satellite, a geostationary earth orbit (GEO) satellite, a high elliptical orbit (HEO) satellite, etc. Optionally, the network device may also be a base station set up in a location such as land or water.

[0055] In an embodiment of the present application, the network device can provide services for a cell, and the terminal device communicates with the network device through the transmission resources used by the cell (for example, frequency domain resources, or spectrum resources). The cell can be a cell corresponding to the network device (for example, a base station). The cell can belong to a macro base station or a base station corresponding to a small cell. The small cells here may include: metro cells, micro cells, pico cells, femto cells, etc. These small cells have the characteristics of small coverage and low transmission power, and are suitable for providing high-speed data transmission services.

[0056] FIG1 exemplarily illustrates a communication system 100. The communication system includes a network device 110 and two terminal devices 120. In one possible implementation, the communication system 100 may include multiple network devices 110, and each network device 110 may include a different number of terminal devices 120 within its coverage area, which is not limited in this embodiment of the present application.

[0057] In one possible implementation, the communication system 100 may further include other network entities such as a Mobility Management Entity (MME) and an Access and Mobility Management Function (AMF), which is not limited in this embodiment of the present application.

[0058] Among them, the network equipment may include access network equipment and core network equipment. That is, the wireless communication system also includes multiple core networks for communicating with the access network equipment. The access network equipment can be an evolutionary base station (evolutional node B, abbreviated as eNB or e-NodeB) macro base station, micro base station (also called "small base station"), pico base station, access point (AP), transmission point (TP) or new generation base station (new generation Node B, gNodeB), etc. in a long-term evolution (LTE) system, a next-generation (mobile communication system) (next radio, NR) system or an authorized auxiliary access long-term evolution (LAA-LTE) system.

[0059] It should be understood that in the embodiments of the present application, a device having a communication function in a network / system may be referred to as a communication device. Taking the communication system shown in Figure 1 as an example, the communication device may include a network device and a terminal device having a communication function. The network device and the terminal device may be specific devices in the embodiments of the present application and will not be described in detail here. The communication device may also include other devices in the communication system, such as a network controller, a mobility management entity, and other network entities, which are not limited in the embodiments of the present application.

[0060] To facilitate understanding of the embodiments of the present application, the following briefly describes the basic processes and basic concepts involved in the embodiments of the present application. It should be understood that the basic processes and basic concepts introduced below do not limit the embodiments of the present application.

[0061] Multi-path (MP) technology for UE-to-network relay (U2N Relay) refers to the support of MP bearers between UEs and base stations (such as gNBs). This means that UEs connect to the same gNB using both a direct path and an indirect path. Compared to a single link, MP technology offers improved user data throughput and reliability for remote UEs. The gNB can offload congested direct connections from remote UEs to an indirect connection via a relay UE. The relay UE and remote UE can be in different cells, either intra-frequency or inter-frequency. MP technology enables efficient path switching between direct and indirect paths. It should be noted that, unless otherwise specified, remote UE and remote UE are synonymous, direct path and direct connection are synonymous, and indirect path and indirect connection are synonymous. These terms are not further discussed below.

[0062] Direct bearer (bearer mapped to a direct path on Uu), indirect bearer (bearer mapped to an indirect path via a relay UE), and MP split bearer (bearer mapped to both paths) are supported between the UE (i.e., remote UE) and gNB.

[0063] MPs can have two scenarios: Scenario 1 and Scenario 2. Scenario 1 refers to a connection between a UE and a gNB via a Layer 2 UE-to-Network relay; Scenario 2 refers to a connection via another UE. This application focuses on Scenario 1 below, but the following description also applies to Scenario 2.

[0064] For MP split bearer in scenario 1, a PDCP (Packet Data Convergence Protocol) entity of the remote UE configures a direct Uu RLC (Radio Link Control) channel and an indirect PC5 RLC channel. For illustration purposes, Figure 2 illustrates that when the remote UE performs uplink transmission, the PDCP entity of the remote UE transmits data to the remote UE's Uu RLC entity and the PC5 RLC entity with the SRAP (Sidelink Relay Adaptation Protocol) entity. When the remote UE receives downlink data, the PDCP entity of the remote UE receives data from the remote UE's Uu RLC entity and the PC5 RLC entity with the SRAP entity. Figure 2 also shows that when the gNB performs uplink data reception, the PDCP entity of the gNB receives data from the gNB's Uu RLC entity and the RLC entity with the Uu SRAP entity. When the gNB performs downlink transmission, the PDCP entity of the gNB transmits data to the gNB's Uu RLC entity and the RLC entity with the Uu SRAP entity. Correspondingly, the connection between the relay UE and the remote UE is through the PC5SRAP entity, and the RLC, MAC (Medium Access Control), and PHY (Physical) layers associated with the PC5SRAP entity for data transmission; the connection between the relay UE and the gNB is through the Uu SRAP entity, and the RLC, MAC, and PHY entities associated with the Uu SRAP entity for data transmission.

[0065] The 5G dual-link architecture is explained in conjunction with Figure 3. Dual connectivity means that two base stations provide links for the UE at the same time; the two base stations are MN (master node) and SN (slave node). As can be seen in Figure 3, MN and SN transmit with the UE through SRB (signaling radio bearer) and DRB (Data Radio Bearer) respectively; both MN and SN have protocol layers corresponding to SRB and DRB respectively; the protocol layers corresponding to SRB in MN or SN include RRC, PDCP, RLC, MAC, and RHY as shown in Figure 3; the protocol layers corresponding to DRB in MN or SN include SDAP (Service Data Adaptation Protocol), PDCP, RLC, MAC, and PHY. Furthermore, MN and SN are interconnected through the Xn interface. As shown in Figure 3, the Xn interface between SN and MN includes the Xn control plane (Xn-C) interface and the Xn user plane (Xn-U) interface. The security mechanism of 5G dual-link technology is as follows: when the MN first establishes a security context between the SN and the UE for the existing AS (Access Stratum) security context shared between the MN and the UE, the MN generates a key (KSN) for the SN and sends it to the SN via the Xn-C interface; the key can be generated by the MN using the value of the SN Counter as an input for KSN derivation and associating it with the current AS security context to obtain the key. When the MN needs to generate a new KSN, the MN sends the value of the SN Counter to the UE via the RRC signaling path. The aforementioned KSN is also used to derive the RRC key and UP (user plane) key between the UE and the SN.

[0066] It should be understood that the terms "system" and "network" are often used interchangeably herein. The term "and / or" is simply a description of an association between related objects, indicating that three possible relationships exist. For example, "A and / or B" can represent: A exists alone, A and B exist simultaneously, or B exists alone. Furthermore, the character " / " generally indicates that the related objects are in an "or" relationship.

[0067] It should be understood that the "indication" mentioned in the embodiments of this application can be a direct indication, an indirect indication, or an indication of an association. For example, "A indicates B" can mean that A directly indicates B, for example, B can be obtained through A; it can also mean that A indirectly indicates B, for example, A indicates C, and B can be obtained through C; it can also mean that there is an association between A and B.

[0068] In the description of the embodiments of the present application, the term "corresponding" may indicate a direct or indirect correspondence between the two, or an association relationship between the two, or a relationship between indication and being indicated, configuration and being configured, etc.

[0069] To facilitate understanding of the technical solutions of the embodiments of the present application, the relevant technologies of the embodiments of the present application are described below. The following relevant technologies can be arbitrarily combined with the technical solutions of the embodiments of the present application as optional solutions, and they all fall within the protection scope of the embodiments of the present application.

[0070] Figure 4 is a schematic flow chart of a communication method according to an embodiment of the present application. The method includes at least part of the following contents.

[0071] S410. A first device receives first information sent by an access network device, where the first information carries a key generation parameter.

[0072] S420. The first device generates a first key based on the key generation parameter; wherein the first key is used to perform security processing on data transmitted through a first connection; and the first connection is a connection between the first device and a second device.

[0073] Figure 5 is a schematic flow chart of a communication method according to another embodiment of the present application. The method includes at least part of the following contents.

[0074] S510. A second device receives second information sent by an access network device, where the second information carries a first key; wherein the first key is used to perform security processing on data transmitted via a first connection; and the first connection is a connection between the first device and a second device.

[0075] Figure 6 is a schematic flow chart of a communication method according to another embodiment of the present application. The method includes at least part of the following contents.

[0076] S610, the access network device sends first information to the first device, and the access network device sends second information to the second device; wherein, the first information carries key generation parameters, and the key generation parameters are used to generate a first key; the first key is used to perform security processing on data transmitted on the first connection; the first connection is a connection between the first device and the second device.

[0077] Here, the first device is a remote terminal device; the second device is a relay terminal device. The access network device can be any type of base station, gNB, eNB, etc.

[0078] Performing security processing on the data transmitted over the first connection refers to performing security processing such as integrity protection and encryption on the data transmitted over the first connection. That is, in the solution provided by this embodiment, the access network device can send key generation parameters to the first device, causing the first device to generate a first key. The access network device can also directly send the first key to the second device, thereby enabling the first device and the second device to successfully establish a secure first connection based on the first key.

[0079] In some possible implementations, the first device triggers the establishment of the aforementioned first connection.

[0080] Before the first device receives the first information sent by the access network device, the method further includes: the first device sends first request information to the access network device; wherein the first request information is used to request establishment of the first connection.

[0081] Before the access network device sends the first information to the first device and the access network device sends the second information to the second device, the method further includes: the access network device receives the first request information sent by the first device; wherein the first request information is used to request to establish the first connection.

[0082] The first device may first decide whether to send the first request information, which may include: the first device sends the first request information when it determines that the first connection needs to be established based on the current state. For example, the first device determines that the first connection needs to be established when the current state is that the data transmission volume of the first device is higher than the preset threshold value, or when the downlink signal strength between the first device and the access network device is less than the first strength threshold value. The preset threshold value can be set according to actual conditions and is not limited; the first strength threshold value can also be set according to actual conditions and is not limited; the downlink signal strength can be measured by the following: RSRP (Reference Signal Receiving Power) measurement results and / or RSRQ (Reference Signal Receiving Quality) measurement results, etc. It should be understood that this is only an exemplary description. In actual processing, the first device can also use other methods to determine whether to send the first request information, but this is not an exhaustive list.

[0083] Exemplarily, the first request information may be referred to as a first DCR (Direct Communication Request), or may be referred to as a first MP triggering information.

[0084] Optionally, the aforementioned first request information may carry relevant information of the second device. The relevant information of the second device may specifically be the identification information of the second device. The identification information of the second device may be a unique identifier of the second device. For example, the identification information of the second device may be any one of the following: a temporary mobile subscriber identity (TMSI) of the second device, an international mobile subscriber identity (IMSI) of the second device, or an I-RNTI (Inactive Radio Network Temporary Identifier) ​​of the second device. It should be understood that this is only an exemplary explanation, and the identification information of the second device may also be represented by other IDs (identity identification codes), which are not exhaustively listed here.

[0085] If the first request message carries relevant information about the second device, the first device needs to select or discover the second device before sending the first request message. Exemplarily, the way the first device selects or discovers the second device may include: Model A discovery process or Model B discovery process. The Model A discovery process may include: the first device receives announcement messages from multiple candidate devices, where the announcement messages actively broadcast the RSCs (Relay Service Codes) that the multiple candidate devices can provide relay services; the first device can select a suitable device as the second device based on the RSCs contained in the received announcement messages from the multiple candidate devices. The Model B discovery process may include: the first device sends a Solicitation message, where the Solicitation message contains the RSC required by the first device; if there are candidate devices around the first device that support RSC, the candidate devices send a response message to the first device; the first device can select a suitable device as the second device from the candidate devices that sent the response message.

[0086] After receiving the first request information, the access network device will send the first information to the first device and the second information to the second device respectively.

[0087] After the access network device receives the first request information sent by the first device, the method further includes: the access network device generating the first key. The access network device sending second information to the second device includes: the access network device sending the second information to the second device after generating the first key. Accordingly, the second device can receive the second information sent by the access network device.

[0088] Specifically, the access network device generating the first key may include: the access network device generating the first key based on the key generation parameter and the second key; wherein the second key is used to perform security processing on the data transmitted on the second connection; the second connection is the connection between the first device and the access network device.

[0089] Among them, the key generation parameters include at least one of the following: relevant information of the second device, a first random number, a count value related to the first connection, relevant information of the radio bearer (RB) between the first device and the access network device, and a session identifier between the first device and the access network device.

[0090] The relevant information of the second device is the same as that described in the above embodiment and will not be repeated here.

[0091] The first random number may be a first random number generated by the access network device, and the generation method of the first random number is not limited in this embodiment.

[0092] The count value related to the first connection may include at least one of the following: the number of times the first connection is established between the access network device and the first device, the number of RRC messages sent to establish the first connection, the number of times the access network device generates a key, the number of times SMC is initiated, etc. All possible types of count values ​​related to the first connection are not exhaustively listed here, and any count value that may be related to the first connection is within the scope of protection of this embodiment.

[0093] The session identifier between the first device and the access network device may refer to a PDU (Protocol Data Unit) Session ID between the first device and the access network device.

[0094] The related information of the bearer between the first device and the access network device may include at least one of the following: an identifier of the DRB between the first device and the access network device; an identifier of the SRB between the first device and the access network device.

[0095] Exemplarily, generating the first key based on the key generation parameters and the second key may be: using a preset key algorithm to calculate the key generation parameters and the second key to obtain the first key. The preset key algorithm may be a KDF (Key Derivation Function), or other key algorithms may be used, which are not exhaustive here. For example, the aforementioned generation of the first key based on the key generation parameters and the second key may be expressed using the following formula:

[0096] K NR_Pro_MP =KDF(K gNB , parameter); where K NR_Pro_MP Represents the first key, K gNB Represents the second key, parameter represents the key generation parameter, and KDF() represents the use of the KDF algorithm.

[0097] The time when the aforementioned access network device sends the first information to the first device is within the protection scope of this embodiment as long as it is after the access network device receives the first request information.

[0098] Optionally, the access network device sending the first information to the first device may include: after the access network device receives the first request information sent by the first device and before generating the first key, the access network device sends the first information to the first device.

[0099] Optionally, the access network device sending the first information to the first device may include: the access network device sending the first information to the first device after receiving the first request information sent by the first device and generating the first key.

[0100] Optionally, the access network device sending the first information to the first device may include: the access network device generating the first key and sending the first information to the first device at the same time.

[0101] Optionally, the access network device sending the first information to the first device includes: upon receiving confirmation information of the second information sent by the second device, the access network device sending the first information to the first device. That is, after receiving the first request information sent by the first device, generating the first key, and sending the second information to the second device, the access network device sends the first information to the first device upon receiving confirmation information of the second information sent by the second device.

[0102] When the first device sends the first request information to the access network device, the first request information may be carried by a first RRC message. Here, the first RRC message may include one of the following: a first RRC connection establishment message, a first RRC connection reestablishment message, a first RRC connection recovery message, or a first RRC connection reconfiguration message. In a preferred example, the first RRC message is a first RRC connection reconfiguration message.

[0103] The aforementioned first information may be carried by a second RRC message. The second RRC message may be an RRC completion message corresponding to the first RRC message. For example, the second RRC message may include one of the following: a first RRC connection establishment completion message, a first RRC connection reestablishment completion message, a first RRC connection recovery completion message, or a first RRC connection reconfiguration completion message. In a preferred example, the second RRC message is a first RRC connection reconfiguration completion message.

[0104] After receiving the first information, the first device may generate a first key based on the key generation parameters. The first device generating the first key based on the key generation parameters includes: the first device generating the first key based on the key generation parameters and a second key; the second key is used to perform security processing on data transmitted on a second connection; the second connection is a connection between the first device and an access network device. The manner in which the first device generates the first key based on the key generation parameters and the second key is the same as the manner in which the access network device generates the first key, and therefore will not be repeated.

[0105] It should be noted that after the first device sends the first request information to the access network device and before the first device receives the first information sent by the access network device, the processing of the first device may also include: the first device establishing a sidelink connection with the second device. This embodiment does not limit the manner in which the first device and the second device establish the sidelink connection.

[0106] The time when the aforementioned access network device sends the second information to the second device is after the access network device generates the first key. More specifically, when the access network device generates the first key, sending the second information to the second device may include: when the access network device generates the first key and the access network device establishes a secure connection of the Uu interface with the second device, the access network device sends the second information to the second device. Among them, the processing of the access network device generating the first key and the processing of the access network device establishing a secure connection of the Uu interface with the second device can be in any order, and this embodiment does not limit them. In addition, this embodiment does not limit the processing method of the access network device establishing a secure connection of the Uu interface with the second device.

[0107] The second information may also carry the first request information, where the first request information is used to request the establishment of the first connection. That is, the access network device may forward the first request information sent by the first device to the second device.

[0108] It should be noted that, when the second device receives the second information sent by the access network device, the second device may also send confirmation information of the second information to the access network device. The confirmation information of the second information may be used to confirm receipt of the first key.

[0109] The second information may be carried by a sixth RRC message. The sixth RRC message may include one of the following: a sixth RRC connection establishment message, a sixth RRC connection reestablishment message, a sixth RRC connection recovery message, or a sixth RRC connection reconfiguration message. In a preferred example, the sixth RRC message is a sixth RRC connection reconfiguration message.

[0110] The confirmation information of the second information can be used to confirm that the second device has received the first key. The confirmation information of the second information can be carried by a seventh RRC message. The seventh RRC message can be a response message to the sixth RRC message. For example, the seventh RRC message can include one of the following: a sixth RRC connection establishment complete message, a sixth RRC connection reestablishment complete message, a sixth RRC connection recovery complete message, and a sixth RRC connection reconfiguration complete message. In a preferred example, the seventh RRC message is a sixth RRC connection reconfiguration complete message.

[0111] Based on the above process, both the first device and the second device can obtain the first key. Furthermore, the first device and the second device need to perform an air interface encryption and integrity protection confirmation process.

[0112] In some possible implementations, in a scenario where the first device triggers the establishment of the aforementioned first connection, the second device may initiate a confirmation process for performing encryption and integrity protection.

[0113] The timing for the second device to initiate the confirmation process of performing encryption and integrity protection is after the second device receives the second information sent by the access network device. The processing performed on the second device side may include:

[0114] After the second device receives the second information sent by the access network device, the method also includes: the second device sends first indication information; the first indication information is used to indicate the negotiation of a first key with the first device; the second device receives first response information sent by the first device; the first response information is used to confirm the generation of the first key.

[0115] Furthermore, the aforementioned second information also carries first request information, where the first request information is used to request establishment of the first connection. Accordingly, the method may further include: upon receiving the first response information sent by the first device, the second device sending confirmation information of the first request information to the first device; the confirmation information of the first request information is used to confirm that the first connection has been securely established.

[0116] The first indication information may carry identification information of the first key, and the identification information of the first key specifically refers to the ID of the first key. That is, after the second device receives the first key carried by the second information sent by the access network device, it carries the ID of the first key in the first indication information and sends it to the first device. It should also be pointed out that the first indication information is also used to indicate the negotiation of other security parameters with the first device; illustratively, the first indication information may also carry relevant information of the other security parameters, such as at least one of the following: relevant information of the second device, a first random number, a count value related to the first connection, relevant information of the wireless bearer RB between the first device and the access network device, a session identifier between the first device and the access network device, etc., which are not enumerated here. The aforementioned first indication information may be a first SMC (Security Mode Command).

[0117] The first response information is used to confirm the generation of the first key. The first response information can be used to confirm that other security parameters are the same as those of the second device. The description of the security parameters is the same as that of the aforementioned embodiment and is not repeated here. The aforementioned first response information can be a first SMC response (Response). Exemplarily, after the first device generates the first key, if the ID of the first key it generates is the same as the ID of the first key carried in the first indication information, the first device can send a first response information to the second device.

[0118] The description of the first request information is the same as that in the above embodiment and will not be repeated here.

[0119] The confirmation information of the first request information is used to confirm that the first connection is securely established successfully, and specifically may refer to confirming that a secure connection of the PC5 interface is completed (or successfully) established between the first device and the second device.

[0120] The second device sending the first indication information may include one of the following:

[0121] The second device sends confirmation information of the second information to the access network device; wherein the confirmation information of the second information carries the first indication information;

[0122] After the second device sends confirmation information of the second information to the access network device, the second device sends the first indication information to the access network device;

[0123] After the second device sends confirmation information of the second information to the access network device, the second device sends the first indication information to the first device.

[0124] That is, the timing when the second device sends the first indication information is within the protection scope of this embodiment as long as it receives the second information sent by the access network device. The first indication information can be carried by the confirmation information of the second information, or can be sent separately.

[0125] The processing performed on the access network device side may include:

[0126] After the access network device sends the second information to the second device, the method further includes: the access network device receiving first indication information sent by the second device; wherein the first indication information is used to indicate negotiation of a first key with the first device.

[0127] The access network device receives the first indication information sent by the second device, including one of the following: the access network device receives confirmation information of the second information sent by the second device, and the confirmation information of the second information carries the first indication information; after the access network device receives the confirmation information of the second information sent by the second device, it receives the first indication information sent by the second device.

[0128] The manner in which the access network device sends the first indication information to the first device may include: when the access network device receives the first indication information sent by the second device, the access network device sends the first indication information to the first device.

[0129] Alternatively, the access network device may carry the first indication information in the first information and send it. Specifically, the access network device sending the first information to the first device includes: upon receiving the first indication information sent by the second device, the access network device sending the first information to the first device, where the first information carries the first indication information.

[0130] That is, the access network device may send the first message to the first device only after receiving the first indication message sent by the second device, and the first message may carry the first indication message. Alternatively, the access network device may send the first message to the first device at a different time than when sending the first indication message, i.e., using two separate messages. In a preferred example of this situation, the access network device sends the first message to the first device as soon as it receives the first request message; and upon waiting to receive the first indication message sent by the second device, it sends the first indication message to the first device again.

[0131] The time when the first device sends the first response information corresponding to the first indication information needs to be after the first device generates the first key. The processing that the first device can perform may include:

[0132] The manner in which the first device receives the first indication information may include one of the following:

[0133] The first device receives first indication information sent by the second device, where the first indication information is used to instruct negotiation of a first key with the first device;

[0134] The first device receives first indication information sent by the access network device.

[0135] Alternatively, the first information further carries first indication information, and the first indication information is used to instruct the first device to negotiate a first key, that is, the first device can obtain the first indication information from the first information.

[0136] After the first device generates the first key based on the key generation parameters, the method further includes: the first device sends a first response message to the second device; the first response message is used to confirm the generation of the first key; the first device receives confirmation information of the first request information sent by the second device; the confirmation information of the first request information is used to confirm that the first connection is securely established successfully.

[0137] Next, the process of the first device triggering the establishment of the first connection and the second device sending the first indication information in the aforementioned embodiment is described in detail:

[0138] In one embodiment, the second device carries the first indication information in the confirmation information of the second information, and carries the first indication information in the first information. Specifically:

[0139] The processing of the first device may include: the first device sends a first request message to the access network device; the first device receives the first message sent by the access network device, the first message carrying first indication information and key generation parameters; the first device generates a first key based on the key generation parameters and the second key; the first device sends a first response message to the second device; the first device receives confirmation information of the first request message sent by the second device.

[0140] The processing of the access network device may include: the access network device receives a first request message sent by a first device; the access network device generates a first key; the access network device sends the second message to the second device when generating the first key, and the second message carries the first key and the first request message; the access network device receives confirmation information of the second message sent by the second device, and the confirmation information of the second message carries the first indication information; the access network device sends the first message to the first device when receiving the first indication information sent by the second device, and the first message carries the first indication information.

[0141] The processing of the second device may include: the second device receives the second information sent by the access network device, the second information carries the first key and the first request information; the second device sends confirmation information of the second information to the access network device, and the confirmation information of the second information carries the first indication information; the second device receives the first response information sent by the first device, and the first response information is used to confirm the generation of the first key; the second device sends confirmation information of the first request information to the first device, and the confirmation information of the first request information is used to confirm that the first connection is securely established successfully.

[0142] The related descriptions of the first request information, first information, second information, confirmation information of the second information, first indication information, first response information and confirmation information of the first request information are the same as those in the aforementioned embodiment and are not repeated.

[0143] In conjunction with Figure 7, an exemplary description is given by taking the first device as a remote UE, the second device as a relay UE, the access network device as a gNB, the first request information as a first DCR, the first indication information as a first SMC, and the first response information as a first SMC response as an example, specifically including:

[0144] S701. The remote UE sends a first DCR to the gNB, where the first DCR is used to request establishment of the first connection.

[0145] S702: The gNB generates a first key. The time when the gNB generates the first key is within the protection scope of this example as long as it occurs before S703.

[0146] S703. The gNB sends second information to the relay UE, where the second information carries the first key.

[0147] Before executing S703 , a secure connection of a uu interface may be established between the access network device and the second device.

[0148] S704. The relay UE sends confirmation information of the second information to the gNB, where the confirmation information of the second information carries the first SMC.

[0149] S705. The gNB sends a first message to the remote UE, where the first message carries a key generation parameter and a first SMC.

[0150] S706: The remote UE generates a first key based on the key generation parameter and the second key. The time when the remote UE generates the first key based on the key generation parameter and the second key is within the protection scope of this example as long as it is before S707.

[0151] S707. After generating the first key, the remote UE sends a first SMC response to the relay UE.

[0152] It should be noted that, before S707, the PC5 connection has been established between the remote UE and the relay UE. Preferably, before S705, the PC5 connection has been established between the remote UE and the relay UE.

[0153] S708: The relay UE sends confirmation information of the first DCR to the remote UE. The confirmation information of the first DCR is used to confirm that the first connection is successfully established securely, that is, as shown in FIG7 , a secure PC5 connection is established between the relay UE and the remote UE.

[0154] It should be noted that the manner of carrying the first DCR, the second information, the confirmation information of the second information, and the first information is the same as that in the above embodiment. Therefore, for the sake of brevity, the message carried by each type of information is not described in detail in FIG. 7 .

[0155] In one embodiment, after the second device sends confirmation information of the second information to the access network device, the second device sends the first indication information to the access network device. Specifically:

[0156] The processing of the first device may include: the first device sends a first request message to the access network device; the first device receives the first message sent by the access network device, the first message carries a key generation parameter; the first device generates a first key based on the key generation parameter and the second key; the first device receives the first indication message sent by the access network device; the first device sends a first response message to the second device; the first device receives confirmation information of the first request message sent by the second device.

[0157] The processing of the access network device may include: the access network device receives a first request message sent by a first device; the access network device sends the first message to the first device; the access network device generates a first key; when the access network device generates the first key, the access network device sends the second message to the second device, and the second message carries the first key and the first request message; after the access network device receives confirmation information of the second message sent by the second device, the access network device receives the first indication message sent by the second device; when the access network device receives the first indication message sent by the second device, the access network device sends the first indication message to the first device.

[0158] The processing of the second device may include: the second device receives second information sent by the access network device, and the second information carries the first key and the first request information; after the second device sends confirmation information of the second information to the access network device, the second device sends the first indication information to the access network device; the second device receives first response information sent by the first device, and the first response information is used to confirm the generation of the first key; the second device sends confirmation information of the first request information to the first device, and the confirmation information of the first request information is used to confirm that the first connection is securely established successfully.

[0159] It should be pointed out that the time when the aforementioned access network device sends the first information to the first device can be any one of the following: before the access network device generates the first key; at the same time as the access network device generates the first key; after the access network device generates the first key; at the same time as the access network device sends the second information to the second device; after the access network device sends the second information to the second device.

[0160] The time when the first device sends the first response information is within the protection scope of this embodiment as long as the first device generates the first key.

[0161] As long as the second device sends the first indication information after receiving the second information, it is within the protection scope of this embodiment.

[0162] The first indication information sent by the aforementioned second device to the access network device may be carried by an eighth RRC message. The eighth RRC message may be any one of the following: an eighth RRC connection establishment message, an eighth RRC connection reconstruction message, an eighth RRC connection recovery message, and an eighth RRC connection reconfiguration message. In a preferred example, the eighth RRC message is an eighth RRC connection reconfiguration message. After receiving the first indication information sent by the second device, the aforementioned access network device may also send confirmation receipt information of the first indication information to the second device; the confirmation receipt information of the first indication information may be carried by a ninth RRC message. The ninth RRC message may be any one of the following: a ninth RRC connection establishment completion message, a ninth RRC connection reconstruction completion message, a ninth RRC connection recovery completion message, and a ninth RRC connection reconfiguration completion message.

[0163] The related descriptions of the first request information, first information, second information, confirmation information of the second information, first indication information, first response information and confirmation information of the first request information are the same as those in the aforementioned embodiment and are not repeated.

[0164] In conjunction with Figure 8, an exemplary description is given by taking the first device as a remote UE, the second device as a relay UE, the access network device as a gNB, the first request information as a first DCR, the first indication information as a first SMC, and the first response information as a first SMC response as an example, specifically including:

[0165] S801. The remote UE sends a first DCR to the gNB, where the first DCR is used to request establishment of the first connection.

[0166] S802: The gNB generates a first key. The time when the gNB generates the first key is within the protection scope of this example as long as it occurs before S805.

[0167] S803. The gNB sends first information to the remote UE, where the first information carries a key generation parameter.

[0168] S804: The remote UE generates a first key based on the key generation parameter and the second key.

[0169] It should be noted that the time when the remote UE generates the first key based on the key generation parameter and the second key can be any time after S803 and before S809, and this example does not limit it.

[0170] S805. The gNB sends second information to the relay UE, where the second information carries the first key.

[0171] The aforementioned S803 and S805 may be performed in any order.

[0172] For example, before executing S805 , a secure connection of a uu interface may be established between the access network device and the second device. Before S803 , a PC5 connection has been established between the remote UE and the relay UE.

[0173] S806. The relay UE sends confirmation information of the second information to the gNB, which is confirmation information of the second information.

[0174] S807. The relay UE sends a first SMC to the gNB.

[0175] Although not shown in Figure 8, after S807, it may also include: the gNB sends confirmation reception information of the first SMC to the relay UE.

[0176] S808. The gNB sends a first SMC to the remote UE.

[0177] Although not shown in FIG8 , after S808 , the remote UE may also send a confirmation receipt message to the gNB.

[0178] S809. After confirming the generation of the first key, the remote UE sends a first SMC response to the relay UE.

[0179] S810: The relay UE sends confirmation information of the first DCR to the remote UE. The confirmation information of the first DCR is used to confirm that the first connection is successfully established securely, that is, as shown in FIG8 , a secure PC5 connection is established between the relay UE and the remote UE.

[0180] It should be noted that the manner of carrying the first DCR, the second information, the confirmation information of the second information, and the first information is the same as that in the above embodiment. Therefore, for the sake of brevity, the message carried by each type of information is not described in detail in FIG. 8 .

[0181] In one embodiment, after the second device sends confirmation information of the second information to the access network device, the second device sends the first indication information to the first device. Specifically:

[0182] The processing of the first device may include: the first device sends a first request message to the access network device; the first device receives the first message sent by the access network device, the first message carrying a key generation parameter; the first device generates a first key based on the key generation parameter and the second key; the first device receives the first indication message sent by the second device; the first device sends a first response message to the second device; the first device receives confirmation information of the first request message sent by the second device.

[0183] The processing of the access network device may include: the access network device receives a first request message sent by a first device; the access network device sends the first message to the first device; the access network device generates a first key; the access network device sends the second message to the second device when generating the first key, and the second message carries the first key and the first request message; the access network device receives confirmation information of the second message sent by the second device.

[0184] The processing of the second device may include: the second device receives second information sent by the access network device, and the second information carries the first key and the first request information; after the second device sends confirmation information of the second information to the access network device, the second device sends the first indication information to the first device; the second device receives first response information sent by the first device, and the first response information is used to confirm the generation of the first key; the second device sends confirmation information of the first request information to the first device, and the confirmation information of the first request information is used to confirm that the first connection is securely established successfully.

[0185] It should be pointed out that the time when the aforementioned access network device sends the first information to the first device can be any one of the following: before the access network device generates the first key; at the same time as the access network device generates the first key; after the access network device generates the first key; at the same time as the access network device sends the second information to the second device; after the access network device sends the second information to the second device.

[0186] The time when the first device sends the first response information is within the protection scope of this embodiment as long as the first device generates the first key.

[0187] As long as the second device sends the first indication information after receiving the second information, it is within the protection scope of this embodiment.

[0188] The aforementioned first indication information may be carried by a sidelink message; similarly, the first response information may also be carried by a sidelink message. Exemplarily, the sidelink message may be a sidelink RRC message.

[0189] The related descriptions of the first request information, first information, second information, confirmation information of the second information, first indication information, first response information and confirmation information of the first request information are the same as those in the aforementioned embodiment and are not repeated.

[0190] In conjunction with Figure 9, an exemplary description is given by taking the first device as a remote UE, the second device as a relay UE, the access network device as a gNB, the first request information as a first DCR, the first indication information as a first SMC, and the first response information as a first SMC response as an example, specifically including:

[0191] S901. The remote UE sends a first DCR to the gNB, where the first DCR is used to request establishment of the first connection.

[0192] S902: The gNB generates a first key. The time when the gNB generates the first key is within the protection scope of this example as long as it occurs before S905.

[0193] S903. The gNB sends first information to the remote UE, where the first information carries a key generation parameter.

[0194] S904: The remote UE generates a first key based on the key generation parameter and the second key.

[0195] It should be noted that the remote UE may generate the first key based on the key generation parameter and the second key at any time after S903 and before S909, and this example does not limit this.

[0196] S905. The gNB sends second information to the relay UE, where the second information carries the first key.

[0197] The aforementioned S903 and S905 may be performed in any order.

[0198] For example, before executing S905 , a secure connection of a uu interface may be established between the access network device and the second device. Before S903 , a PC5 connection has been established between the remote UE and the relay UE.

[0199] S906. The relay UE sends confirmation information of the second information to the gNB.

[0200] S907. The relay UE sends a first SMC to the remote UE.

[0201] S908. After generating the first key, the remote UE sends a first SMC response to the relay UE.

[0202] S909: The relay UE sends confirmation information of the first DCR to the remote UE. The confirmation information of the first DCR is used to confirm that the first connection is successfully established securely, that is, as shown in FIG9 , a secure PC5 connection is established between the relay UE and the remote UE.

[0203] It should be noted that the manner of carrying the first DCR, the second information, the confirmation information of the second information, and the first information is the same as that in the above embodiment. Therefore, for the sake of brevity, the message carried by each information is not described in detail in FIG. 9 .

[0204] In some possible implementations, in a scenario where the first device triggers the establishment of the aforementioned first connection, the first device may initiate a confirmation process for executing air interface encryption and integrity protection.

[0205] The first device initiates a confirmation process for performing air interface encryption and integrity protection after generating a first key for the first device. The processing performed on the first device side may include:

[0206] After the first device generates the first key based on the key generation parameters, the method further includes: the first device sends second indication information to the second device; the second indication information is used to indicate negotiation of the first key with the second device; the first device receives second response information sent by the second device, and the second response information is used to confirm that the first key is obtained.

[0207] The second indication information may carry identification information of the first key, which may specifically be the ID of the first key. That is, after generating the first key, the first device carries the ID of the first key in the second indication information and sends it to the second device. It should also be noted that the second indication information is also used to instruct negotiation of other security parameters with the second device. The description of these other security parameters is the same as in the aforementioned embodiment and is not repeated here. The aforementioned second indication information may be a second SMC.

[0208] The second response information is used to confirm the acquisition of the first key. The second response information can also be used to confirm the acquisition of other security parameters. The aforementioned second response information can be a second SMC response (Response). Exemplarily, after the second device receives the first key carried by the second information sent by the access network device, if the ID of the first key it obtains is the same as the ID of the first key carried in the second indication information, the second device can send a second response information to the first device.

[0209] Optionally, the second response information is further used to confirm that the first connection is securely established successfully. Specifically, the second response information may carry confirmation information of the first request information; the confirmation information of the first request information is used to confirm that the first connection is securely established successfully.

[0210] Optionally, after the first device receives the second response information sent by the second device, the method further includes: the first device receives confirmation information of the first request information sent by the second device; the confirmation information of the first request information is used to confirm that the first connection is securely established successfully.

[0211] The time when the second device sends the second response information corresponding to the second indication information needs to be after the second device receives the first key carried in the second information sent by the access network device. The processing that the second device can perform may include:

[0212] The method further includes: the second device receiving second indication information sent by the first device, wherein the second indication information is used to instruct negotiation of the first key with the second device. After the second device receives the second information sent by the access network device, the method further includes: the second device sending second response information to the first device, wherein the second response information is used to confirm the acquisition of the first key.

[0213] Optionally, the second message further carries first request information, where the first request information is used to request establishment of the first connection. The method further includes: when the second device sends the second response information to the first device, the second device sends confirmation information of the first request information to the first device; the confirmation information of the first request information is used to confirm that the first connection has been securely established.

[0214] Optionally, the second message also carries first request information, where the first request information is used to request establishment of the first connection; and the second response information is further used to confirm that the first connection has been securely established. Specifically, the second response information may carry confirmation information of the first request information, that is, the second response information is used not only to confirm the acquisition of the first key but also to confirm the completion of establishment of the secure connection between the first device and the second device.

[0215] That is, the second device can directly confirm the first request information through the second response information, so that the first device confirms that the secure connection of the PC5 interface between the second device and the second device has been established. Alternatively, after completing the sending of the second response information, the second device can further send confirmation information of the first request information to the first device, so that the first device confirms that the secure connection of the PC5 interface between the second device and the second device has been established.

[0216] Next, the processing of the second device, the first device, and the access network device in the aforementioned embodiment is described in detail:

[0217] In one embodiment, the processing of the first device may include: the first device sends a first request message to the access network device; the first device receives the first message sent by the access network device, the first message carries a key generation parameter; the first device generates a first key based on the key generation parameter and the second key; the first device sends the second indication message to the access network device; the first device receives a second response message sent by the second device, the second response message is used to confirm the acquisition of the first key, and the second response message can also be used to confirm the completion of establishing the first connection.

[0218] The processing of the access network device may include: the access network device receives a first request message sent by a first device; the access network device sends a first message to the first device, and the first message carries a key generation parameter; the access network device generates a first key; the access network device sends a second message to the second device, and the second message carries the first key.

[0219] The processing of the second device may include: the second device receives second information sent by the access network device, and the second information carries the first key; the second device sends confirmation information of the second information to the access network device; the second device receives second indication information sent by the first device, and the second indication information is used to indicate the negotiation of the first key with the second device; when the second device determines that the first key is received, the second device sends second response information to the first device, and the second response information is used to confirm that the first key is obtained. The second response information is also used to confirm the completion of establishing the first connection.

[0220] The related descriptions of the first request information, first information, second information, confirmation information of the second information, second indication information, second response information and confirmation information of the first request information are the same as those in the aforementioned embodiment and are not repeated.

[0221] It should be understood that the above description is merely illustrative. In actual processing, the first device may also send the second indication information to the second device via the access network device after generating the first key. Alternatively, the first device may send the second indication information to the access network device after generating the first key. Upon receiving the second indication information, the access network device may send a second message to the second device, which carries the second indication information and the first key. The second device then directly sends a second response message to the first device. As long as the second indication information is sent after the first device generates the first key, it is within the scope of protection of this embodiment. This embodiment does not exhaust all possible possibilities.

[0222] In conjunction with Figure 10, an exemplary description is given by taking the first device as a remote UE, the second device as a relay UE, the access network device as a gNB, the first request information as a first DCR, the second indication information as a second SMC, and the second response information as a second SMC response as an example, specifically including:

[0223] S1001. The remote UE sends a first DCR to the gNB, where the first DCR is used to request establishment of the first connection.

[0224] S1002: The gNB generates a first key. The time when the gNB generates the first key is within the protection scope of this example as long as it occurs before S1003.

[0225] S1003. The gNB sends second information to the relay UE, where the second information carries the first key.

[0226] Before executing S1003 , a secure connection of a uu interface may be established between the access network device and the second device.

[0227] In addition, although not illustrated in FIG. 10 , after completing S1003 , the remote UE may further send confirmation information of the second information to the relay UE. The confirmation information of the second information may be carried by the third RRC connection reconfiguration complete message.

[0228] S1004. The gNB sends first information to the remote UE, where the first information carries a key generation parameter.

[0229] The order of the aforementioned S1004 and S1003 is not limited in this embodiment. Before executing S1004, the remote UE and the relay UE have already established a PC5 connection.

[0230] S1005. The remote UE generates a first key based on the key generation parameter and the second key.

[0231] S1006. The remote UE sends a second SMC to the relay UE.

[0232] After completing S1006, you can execute S1007, or execute S1008 to S1009, which are described below:

[0233] S1007. The relay UE sends a second SMC response to the remote UE. The second SMC response is used to confirm that the first key is obtained and is also used to confirm that the first connection is successfully established securely, specifically to confirm that the secure PC5 connection is established.

[0234] S1008. The relay UE sends a second SMC response to the remote UE, where the second SMC response is used to confirm that the first key has been obtained.

[0235] S1009: The relay UE sends confirmation information of the first DCR to the remote UE. The confirmation information of the first DCR is the same as that in the above example and will not be described again.

[0236] It should be noted that the manner of carrying the first DCR, the second information, the confirmation information of the second information, and the first information is the same as that in the above embodiment. Therefore, for the sake of brevity, the message carried by each type of information is not described in detail in FIG. 8 .

[0237] In some possible implementations, the establishment of the aforementioned first connection is triggered by an access network device.

[0238] In this implementation, the access network device may send the second request information at the same time as sending the first information. That is, the first information also carries the second request information, and the second request information is used to request to establish the first connection.

[0239] The access network device may first decide whether to send a second request message, which may include: the access network device sends the second request message when it determines that the first connection needs to be established based on the current state of the first device. For example, the current state of the first device is that the data transmission volume of the first device is higher than the preset threshold value, or it may be that the uplink signal strength between the first device and the access network device is less than the second strength threshold value, and it is determined that the first connection needs to be established. Among them, the preset threshold value can be set according to actual conditions and is not limited; the second strength threshold value can also be set according to actual conditions and is not limited. It should be understood that this is only an exemplary explanation. In actual processing, the access network device can also use other methods to determine whether to send the first request message, but they are not exhaustive here.

[0240] When the access network device sends the first information, the first information may be carried by a third RRC message. Here, the third RRC message may include one of the following: a third RRC connection establishment message, a third RRC connection reestablishment message, a first RRC connection recovery message, or a third RRC connection reconfiguration message. In a preferred example, the third RRC message is a third RRC connection reconfiguration message.

[0241] Exemplarily, the aforementioned second request information may be referred to as second MP trigger information.

[0242] Optionally, the first information may also carry relevant information about the second device, wherein the relevant information about the second device is the same as that described in the above embodiment and will not be repeated.

[0243] If the first information carries relevant information about the second device, the access network device needs to select or discover the second device before sending the first information. Exemplarily, the first device may first select or discover one or more candidate devices, send the identifiers of the one or more candidate devices to the access network device, and the access network device determines the second device. Exemplarily, the first device may first select or discover one or more candidate devices, send the identifiers of the one or more candidate devices to the access network device; the access network device receives the one or more candidate devices reported by the first device, and then determines the second device from the one or more candidate devices based on the geographic location of the candidate devices and the geographic location of the first device. Among them, the access network device may select a candidate device whose distance from the first device meets the requirements as the second device. The requirement can be set according to actual conditions, for example, it can be less than a specified distance. The specified distance is not limited in this embodiment.

[0244] Before the access network device sends the second information to the second device, the method further includes: the access network device generating the first key. In other words, the access network device needs to generate the first key after sending the first information to the first device and before sending the second information to the second device.

[0245] The manner in which the access network device generates the first key is the same as in the aforementioned embodiment and is not described in detail. The time when the access network device generates the first key is within the protection scope of this embodiment as long as it is before the access network device sends the second information to the second device. For example, the access network device may generate the first key before sending the first information; or, the access network device may generate the first key after sending the first information and before sending the second information to the second device. This is only an exemplary description and does not serve as a limitation on the time when the access network device generates the first key. More specifically, when the access network device generates the first key and the access network device establishes a secure connection on the Uu interface with the second device, the access network device sends the second information to the second device. The processing of the access network device generating the first key and the processing of the access network device establishing a secure connection on the Uu interface with the second device can be in any order, and this embodiment does not limit them. In addition, this embodiment does not limit the processing method of the access network device establishing a secure connection on the Uu interface with the second device.

[0246] It should be noted that, upon receiving the second information sent by the access network device, the second device may also send confirmation information of the second information to the access network device. Accordingly, after the access network device sends the second information to the second device, it may also receive confirmation information of the second information sent by the second device. This confirmation information of the second information is used to confirm receipt of the first key. The second information and the message carried in the confirmation information of the second information are the same as those in the previous embodiment and are not described again.

[0247] After the first device receives the first information, it may generate a first key based on the key generation parameters. The process of the first device generating the first key based on the key generation parameters is the same as in the aforementioned embodiment and is not described again. It should be noted that after the first device receives the first information, the process may also include: the first device establishing a sidelink connection with the second device. This embodiment does not limit the manner in which the first device and the second device establish a sidelink connection.

[0248] Based on the above process, both the first device and the second device can obtain the first key. Furthermore, the first device and the second device need to perform an air interface encryption and integrity protection confirmation process.

[0249] In some possible implementations, in a scenario where the access network device triggers the establishment of the aforementioned first connection, the second device may initiate a confirmation process for executing air interface encryption and integrity protection.

[0250] The timing for the second device to initiate the confirmation process of executing air interface encryption and integrity protection is after the second device receives the second information sent by the access network device. The processing performed on the second device side may include:

[0251] After the second device receives the second information sent by the access network device, the method also includes: the second device sends first indication information; the first indication information is used to indicate the negotiation of a first key with the first device; the second device receives first response information sent by the first device; the first response information is used to confirm the generation of the first key.

[0252] The second device sending the first indication information includes: the second device sending the first indication information to the first device.

[0253] The description of the contents of the first indication information and the first response information is the same as that in the above embodiment and will not be repeated.

[0254] The time when the first device sends the first response information corresponding to the first indication information needs to be after the first device generates the first key. The processing that the first device can perform may include:

[0255] The manner in which the first device receives the first indication information may include: the first device receiving the first indication information sent by the second device; the first indication information being used to instruct negotiation of a first key with the first device. After the first device generates the first key based on the key generation parameter, the method further includes: the first device sending a first response information to the second device; the first response information being used to confirm the generation of the first key; and the first device sending a first confirmation information of a second request information to the access network device; the first confirmation information of the second request information being used to confirm that the first connection was securely established successfully.

[0256] The processing of the access network device may include: the access network device receiving first confirmation information of the second request information sent by the first device; the first confirmation information of the second request information is used to confirm that the first connection is successfully established securely.

[0257] The first confirmation information of the second request information is carried by a fourth RRC message. Here, the fourth RRC message may correspond to the third RRC message carrying the first information. For example, the fourth RRC message may include one of the following: a third RRC connection establishment complete message, a third RRC connection reestablishment complete message, a first RRC connection recovery complete message, or a third RRC connection reconfiguration complete message. In a preferred example, the fourth RRC message is a third RRC connection reconfiguration complete message.

[0258] Next, the process of the access network device triggering the establishment of the first connection and the second device sending the first indication information in the aforementioned embodiment is described in detail:

[0259] In one embodiment, the access network device triggers the establishment of the aforementioned first connection, and the second device initiates the confirmation process of executing air interface encryption and integrity protection. Specifically:

[0260] The processing of the access network device may include: the access network device sends a first message to the first device, the first message carries a second request information and a key generation parameter; the access network device generates a first key; the access network device sends the second message to the second device when generating the first key, the second message carries the first key; the access network device receives confirmation information of the second message sent by the second device; the access network device receives a first confirmation information of the second request information sent by the first device; the first confirmation information of the second request information is used to confirm that the first connection is securely established successfully.

[0261] The processing of the first device may include: the first device receives first information sent by the access network device, the first information carries second request information and key generation parameters; the first device generates a first key based on the key generation parameters and the second key; the first device receives first indication information sent by the second device, the first indication information is used to indicate negotiation of the first key with the first device; when the first device determines that the first key is generated, the first device sends a first response information to the second device, the first response information is used to confirm the generation of the first key; the first device sends a first confirmation information of the second request information to the access network device, the first confirmation information of the second request information is used to confirm that the first connection is securely established successfully.

[0262] The processing of the second device may include: the second device receives second information sent by the access network device, and the second information carries the first key; the second device sends first indication information to the first device, and the first indication information is used to indicate the negotiation of the first key with the first device; the second device receives first response information sent by the first device, and the first response information is used to confirm the generation of the first key.

[0263] In conjunction with Figure 11, the first device is a remote UE, the second device is a relay UE, the access network device is a gNB, the second request information is the second MP trigger information, the first indication information is the first SMC, and the first response information is the first SMC response. An example is given for exemplary description, specifically including:

[0264] S1101. The gNB sends a first message to a remote UE. The first message carries a key generation parameter and second MP triggering information. The second MP triggering information is used to request establishment of the first connection.

[0265] S1102. The gNB generates a first key.

[0266] Here, the time when the gNB generates the first key may be before S1101 or after S1101 and before S1103, which is not limited in this embodiment.

[0267] S1103. The gNB sends second information to the relay UE, where the second information carries the first key.

[0268] Before executing S1103 , a secure connection of a uu interface may be established between the access network device and the second device.

[0269] S1104. The relay UE sends confirmation information of the second information to the gNB.

[0270] S1105. The remote UE generates a first key based on the key generation parameter and the second key.

[0271] Here, S1105 can be executed at any time after S1101. As long as the processing of S1105 is completed before sending the first response information (i.e., the first SMC response), it is within the protection scope of this embodiment; or, as long as the processing of S1105 is completed before sending the second indication information (i.e., the second SMC), it is within the protection scope of this embodiment, and is not limited here.

[0272] Next, we will describe the process in detail with reference to process a in FIG11 :

[0273] S1106a. The relay UE sends a first SMC to the remote UE.

[0274] S1107a. The remote UE sends a first SMC response to the relay UE.

[0275] It should be noted that, before S1106a, the PC5 connection has been established between the remote UE and the relay UE. Preferably, before S1105, the PC5 connection has been established between the remote UE and the relay UE.

[0276] S1108. The remote UE sends a first confirmation message of the second MP triggering message to the gNB. The first confirmation message of the second MP triggering message is used to confirm that the first connection is securely established successfully.

[0277] In some possible implementations, in a scenario where the access network device triggers the establishment of the aforementioned first connection, the first device may initiate a confirmation process for executing air interface encryption and integrity protection.

[0278] The first device initiates a confirmation process for performing air interface encryption and integrity protection after generating a first key for the first device. The processing performed on the first device side may include:

[0279] Optionally, after the first device generates the first key based on the key generation parameters, the method further includes: the first device sends a second indication message to the second device; the second indication message is used to indicate negotiation of the first key with the second device; the first device receives a second response message sent by the second device, and the second response message is used to confirm that the first key is obtained; the first device sends a first confirmation message of the second request message to the access network device; wherein the first confirmation message of the second request message is used to confirm that the first connection is securely established successfully.

[0280] Optionally, after the first device generates the first key based on the key generation parameters, the method further includes: the first device sends a second indication message to the second device; wherein the second indication message is used to indicate negotiation of the first key with the second device; the first device receives a second response message sent by the second device; wherein the second response message is used to confirm that the first key is obtained, and the second response message is also used to confirm that the first connection is securely established successfully.

[0281] The difference between the two is that in one case, the second response information can be used to confirm that the first connection is successfully established securely, that is, the second response information can carry the first confirmation information of the second request information. In the other case, the second response information and the first confirmation information of the second request information are sent separately by two signaling messages.

[0282] Furthermore, before the first device generates the first key based on the key generation parameters, the method also includes: the first device sends a second confirmation message of the second request message to the access network device, and the second confirmation message of the second request message is used to confirm the completion of establishing the first connection with the second device; the second confirmation message of the second request message is carried by the fifth RRC message.

[0283] Alternatively, the second indication information further carries second confirmation information of the second request information; the second confirmation information of the second request information is used to confirm the completion of establishing the first connection with the second device.

[0284] That is, after receiving the first message carrying the second request information sent by the access network device, the first device may further send a second confirmation message of the second request information to the access network device, so that the access network device confirms that the first device and the second device have a sidelink connection. The second confirmation message of the second request information may be carried by the second indication message, or may be sent separately from the second indication message by different signaling.

[0285] The time when the second device sends the second response information corresponding to the second indication information needs to be after the second device receives the first key carried in the second information sent by the access network device. The processing that the second device can perform may include:

[0286] The method further includes: the second device receiving second indication information sent by the first device, wherein the second indication information is used to instruct negotiation of the first key with the second device. After the second device receives the second information sent by the access network device, the method further includes: the second device sending second response information to the first device, wherein the second response information is used to confirm the acquisition of the first key.

[0287] Optionally, the second device receives the second information sent by the access network device, which may include: when the second device receives the second indication information sent by the first device, the second device sends key request information to the access network device; the second device receives the second information sent by the access network device.

[0288] The second indication information also carries second confirmation information of the second request information, and the second confirmation information of the second request information is used to confirm the completion of establishing the first connection; the key request information carries the second confirmation information of the second request information.

[0289] Optionally, the second device receives the second information sent by the access network device before or after the second device receives the second indication information sent by the first device.

[0290] The processing of the access network device may also include: the access network device sending first information to the first device, and the access network device sending second information to the second device, including: the access network device sending the first information to the first device; the access network device receiving the key request information sent by the second device; the access network device sending the second information to the second device.

[0291] That is, the access network device may remain in a waiting state after sending the first information, and only send the second information to the second device upon receiving a key request message from the second device. It should be understood that in this case, as long as the access network device generates the first key before sending the second information to the second device, it is within the scope of protection of this embodiment. In one possible example, upon receiving a key request message from the second device, the access network device generates the first key; then the access network device sends the second information to the second device.

[0292] Optionally, the key request information carries second confirmation information of the second request information; the second confirmation information of the second request information is used to confirm that the first connection with the second device is established.

[0293] Optionally, before the access network device receives the key request information sent by the second device, the method also includes: the access network device receives second confirmation information of the second request information sent by the first device, and the second confirmation information of the second request information is used to confirm the completion of establishing the first connection with the second device.

[0294] In this case, after receiving the second confirmation message of the second request message, the access network device waits to receive the key request message sent by the second device. The access network device may generate the first key before sending the second message to the second device. For example, the access network device may generate the first key upon receiving the key request message and then send the second message to the second device; for example, the access network device may generate the first key before sending the first message and send the second message to the second device upon receiving the key request message. It should be understood that this is an exemplary description and does not limit the time point when the access network device generates the first key.

[0295] Next, the process of the access network device triggering the establishment of the first connection and the second device sending the first indication information in the aforementioned embodiment is described in detail:

[0296] In one embodiment, the access network device triggers the establishment of the aforementioned first connection, and the first device initiates the confirmation process of executing air interface encryption and integrity protection. Specifically:

[0297] The processing of the access network device may include: the access network device sends a first message to the first device, the first message carrying second request information and key generation parameters; the access network device generates a first key; the access network device sends the second message to the second device when generating the first key, the second message carrying the first key; the access network device receives confirmation information of the second information sent by the second device; the access network device receives first confirmation information of the second request information sent by the first device.

[0298] The processing of the first device may include: the first device receives first information sent by the access network device, the first information carries second request information and key generation parameters; the first device generates a first key based on the key generation parameters and the second key; when the first device determines that the first key is generated, the first device sends second indication information to the second device; the first device receives second response information sent by the second device; the first device sends first confirmation information of the second request information to the access network device, and the first confirmation information of the second request information is used to confirm that the first connection is securely established successfully.

[0299] The processing by the second device may include: the second device receiving second information sent by the access network device, the second information carrying the first key; the second device receiving second indication information sent by the first device; and the second device sending second response information to the first device.

[0300] In this embodiment, in addition to confirming the acquisition of the first key, the second response information may also be used to confirm the successful secure establishment of the first connection. Specifically, the second response information may carry the first confirmation information for the second request information. In this case, the first device may not need to perform the process of sending the first confirmation information for the second request information to the access network device, or may perform the process of sending the first confirmation information for the second request information to the access network device. Both of these processes are within the scope of this embodiment and are not further described.

[0301] In conjunction with the b process of Figure 11, the first device is a remote UE, the second device is a relay UE, the access network device is a gNB, the second request information is the second MP trigger information, the second indication information is the second SMC, and the second response information is the second SMC response. An example is given for exemplary description, specifically including:

[0302] S1106b. The remote UE sends a second SMC to the relay UE.

[0303] S1107b. The relay UE sends a second SMC response to the remote UE.

[0304] It should be noted that, before S1106b, the PC5 connection has been established between the remote UE and the relay UE.

[0305] In this example, S1101 to S1105 and S1108 are the same as those in the above embodiment, and thus are not described repeatedly.

[0306] It should also be understood that if the second SMC response is also used to confirm that the first connection is securely established successfully, S1108 may not be executed and is not illustrated in Figure 11 for the sake of brevity. It should be noted that the manner in which the aforementioned first information, second information, and confirmation information of the second information are carried is the same as in the aforementioned embodiment, and therefore, for the sake of brevity, the message carried by each type of information is not described in detail in Figure 11.

[0307] In one embodiment, the access network device triggers the establishment of the aforementioned first connection, and the first device initiates the confirmation process of executing air interface encryption and integrity protection. Specifically:

[0308] The processing of the access network device may include: the access network device sends a first message to the first device, and the first message carries a second request information and a key generation parameter; the access network device receives a key request message sent by the second device, and the key request message carries a second confirmation information of the second request information, and the second confirmation information of the second request information is used to confirm that the first connection with the second device is established; the access network device generates a first key; and when the first key is generated, the access network device sends the second message to the second device, and the second message carries the first key.

[0309] The processing of the first device may include: the first device receives the first information sent by the access network device, the first information carries the second request information and the key generation parameter; the first device generates the first key based on the key generation parameter and the second key; when the first device determines that the first key is generated, the first device sends a second indication message to the second device, the second indication message also carries the second confirmation information of the second request information, and the second confirmation information of the second request information is used to confirm the completion of the establishment of the first connection with the second device; the first device receives the second response message sent by the second device; wherein the second response message is used to confirm the acquisition of the first key, and the second response message is also used to confirm that the first connection is successfully established securely.

[0310] The processing of the second device may include: the second device receives the second indication information sent by the first device; upon receiving the second indication information sent by the first device, the second device sends a key request information to the access network device, and the key request information carries the second confirmation information of the second request information; the second device receives the second information sent by the access network device; the second device sends a second response information to the first device.

[0311] In conjunction with Figure 12, the first device is a remote UE, the second device is a relay UE, the access network device is a gNB, the second request information is the second MP trigger information, the second indication information is the second SMC, and the second response information is the second SMC response. An example is given for exemplary description, specifically including:

[0312] S1201. The gNB sends a first message to a remote UE. The first message carries a key generation parameter and second MP triggering information. The second MP triggering information is used to request establishment of the first connection.

[0313] S1202. The remote UE generates a first key based on the key generation parameter.

[0314] S1203: The remote UE sends a second SMC to the relay UE, where the second SMC carries second confirmation information of the second MP triggering information.

[0315] Before S1203 , the remote UE needs to complete the establishment of a PC5 connection with the relay UE.

[0316] S1204. The relay UE sends a key request message to the gNB, where the key request message carries second confirmation information of the second MP triggering information.

[0317] S1205: The gNB generates a first key. Any time before S1206 when the gNB generates the first key is protected in this example.

[0318] S1206. The gNB sends second information to the relay UE, where the second information carries the first key.

[0319] Before executing S1206 , a secure connection of a uu interface may be established between the access network device and the second device.

[0320] S1207. The relay UE sends a second SMC response to the remote UE. The second SMC response is used to confirm that the first key is obtained and is also used to confirm that the first connection is securely established successfully.

[0321] In one embodiment, the access network device triggers the establishment of the aforementioned first connection, and the first device initiates the confirmation process of executing air interface encryption and integrity protection. Specifically:

[0322] The processing of the access network device may include: the access network device sends a first message to the first device, and the first message carries a second request information and a key generation parameter; the access network device receives a second confirmation message of the second request message sent by the first device, and the second confirmation message of the second request message is used to confirm that the first connection with the second device is established; the access network device receives a key request message sent by the second device, and the key request message carries the second confirmation information of the second request message; the access network device generates a first key; and when generating the first key, the access network device sends the second message to the second device, and the second message carries the first key.

[0323] The processing of the first device may include: the first device receives the first information sent by the access network device, the first information carries the second request information and the key generation parameter; the first device sends the second confirmation information of the second request information to the access network device, and the second confirmation information of the second request information is used to confirm that the first connection with the second device is established; the first device generates the first key based on the key generation parameter and the second key; when the first device determines that the first key is generated, the first device sends the second indication information to the second device; the first device receives the second response information sent by the second device; wherein, the second response information is used to confirm that the first key is obtained, and the second response information is also used to confirm that the first connection is successfully established securely.

[0324] The processing of the second device may include: the second device receives the second indication information sent by the first device; upon receiving the second indication information sent by the first device, the second device sends a key request information to the access network device, and the key request information carries the second confirmation information of the second request information; the second device receives the second information sent by the access network device; the second device sends a second response information to the first device.

[0325] In conjunction with Figure 13, an exemplary description is given by taking the first device as a remote UE, the second device as a relay UE, the access network device as a gNB, the second request information as the second MP trigger information, the second indication information as the second SMC, and the second response information as the second SMC response as an example, specifically including:

[0326] S1301. The gNB generates a first key.

[0327] Here, the execution order of the gNB generating the first key can be any time before S1307. This example does not limit the time when the gNB generates the first key.

[0328] S1302. The gNB sends a first message to the remote UE. The first message carries a key generation parameter and second MP triggering information. The second MP triggering information is used to request establishment of the first connection.

[0329] S1303. The remote UE sends a second confirmation message of the second MP triggering information to the gNB.

[0330] S1304. The remote UE generates a first key based on the key generation parameter.

[0331] Here, the execution order of S1304 and S1303 may not be prioritized.

[0332] S1305: The remote UE sends a second SMC to the relay UE, where the second SMC carries second confirmation information of the second MP triggering information.

[0333] Before S1305 , the remote UE needs to complete the establishment of a PC5 connection with the relay UE.

[0334] S1306. The relay UE sends a key request message to the gNB.

[0335] S1307. The gNB sends second information to the relay UE, where the second information carries the first key.

[0336] Before executing S1307 , a secure connection of a uu interface may be established between the access network device and the second device.

[0337] S1308. The relay UE sends a second SMC response to the remote UE. The second SMC response is used to confirm that the first key is obtained and is also used to confirm that the first connection is securely established successfully.

[0338] It should be noted that the manner of carrying the aforementioned first information, second information, confirmation information of the second information and other information is the same as that in the aforementioned embodiment. Therefore, for the sake of brevity, the carrying messages of each type of information are not described in detail in the accompanying drawings corresponding to the aforementioned examples.

[0339] Finally, the remote UE and relay UE layer 2 security establishment process in the related art of Figure 14 is described: S1401, the remote UE AUSF (Authentication Server Function) generates a key, which can be expressed as K NR_ProSe ; S1402, the AUSF of the remote UE sends a response to the AMF of the relay UE, which carries the key and key-related parameters. The key-related parameters may include a second random number (which may be expressed as Nonce-2) and may also include an EAP (Extensible Authentication Protocol) success identifier. The response may be an authentication response, which is not limited here; S1403, the AMF of the relay UE sends a response to the relay UE, which carries the key and key-related parameters; S1404, the relay UE sends a direct SMC to the remote UE, which carries key-related parameters; S1405, the remote UE generates a key. In the diagram of the aforementioned Figure 14, only the process of the remote UE and the relay UE obtaining the key is explained. Before S1401, the remote UE and the relay UE will also interact with other network elements of the core network, such as the process of the remote UE discovering the relay UE, the process of the relay UE performing authentication, etc., which are not described in detail in Figure 14; in addition, after S1405, the remote UE can also complete the SMC confirmation process and other processes with the relay UE, which are also not described in detail in Figure 14.

[0340] As shown in the example of Figure 14, in related technologies, the relay UE and the remote UE need to perform extensive interactions with network elements such as the AMF and AUSF of the core network to obtain keys and key-related parameters. This results in low efficiency in obtaining keys for the relay UE and the remote UE, making it unsuitable for efficiently establishing a secure first connection in the MP scenario.

[0341] By adopting the solution provided in this embodiment, the first device can directly obtain the key generation parameters from the access network device and then generate the first key to perform security processing on the data transmitted on the connection between the first device and the second device. In addition, the second device can also directly obtain the first key from the access network device. In this way, the problem of low processing efficiency caused by a large amount of signaling interaction with the core network device to obtain the key is avoided. The solution provided in this application can enable the first device to directly interact with the access network device to obtain the first key, thereby improving the processing efficiency of generating the first key, and then ensuring the efficient establishment of a secure connection between the first device and the second device, and also improving the processing efficiency of the entire communication system.

[0342] FIG15 is a schematic diagram of the composition structure of a first device according to an embodiment of the present application, including:

[0343] The first communication unit 1501 is configured to receive first information sent by an access network device, wherein the first information carries a key generation parameter;

[0344] The first processing unit 1502 is configured to generate a first key based on the key generation parameter; wherein the first key is used to perform security processing on data transmitted via a first connection; and the first connection is a connection between the first device and the second device.

[0345] The first processing unit is used to generate the first key based on the key generation parameter and the second key; wherein the second key is used to perform security processing on data transmitted on the second connection; the second connection is a connection between the first device and the access network device.

[0346] The first communication unit is configured to send first request information to the access network device before receiving the first information sent by the access network device; wherein the first request information is used to request establishment of the first connection.

[0347] The first request information carries relevant information of the second device.

[0348] The first information also carries first indication information; the first indication information is used to instruct negotiation of a first key with the first device.

[0349] The first communication unit is used to perform one of the following: receiving first indication information sent by the second device; wherein the first indication information is used to indicate negotiation of a first key with the first device; receiving first indication information sent by the access network device.

[0350] The first communication unit is used to send a first response message to the second device after the first processing unit generates the first key based on the key generation parameters; wherein the first response message is used to confirm the generation of the first key; and receive confirmation information of the first request information sent by the second device; wherein the confirmation information of the first request information is used to confirm that the first connection is securely established successfully.

[0351] The first communication unit is used to send a second indication message to the second device after the first processing unit generates the first key based on the key generation parameters; wherein the second indication message is used to indicate the negotiation of the first key with the second device; and receive a second response message sent by the second device, wherein the second response message is used to confirm the acquisition of the first key.

[0352] The second response information is also used to confirm that the first connection is successfully established securely.

[0353] The first communication unit is configured to receive confirmation information of the first request information sent by the second device after receiving the second response information sent by the second device; wherein the confirmation information of the first request information is used to confirm that the first connection is securely established successfully.

[0354] The first request information is carried by a first radio resource control RRC message; and the first information is carried by a second RRC message.

[0355] The first information also carries second request information, where the second request information is used to request establishment of the first connection.

[0356] The first information also carries relevant information of the second device.

[0357] The first information is carried by a third RRC message.

[0358] The first communication unit is used to receive a first indication message sent by the second device; wherein the first indication message is used to indicate negotiation of a first key with the first device; and after the first processing unit generates the first key based on the key generation parameters, send a first response message to the second device, and the first response message is used to confirm the generation of the first key; send a first confirmation message of the second request message to the access network device, and the first confirmation message of the second request message is used to confirm that the first connection is securely established successfully.

[0359] The first communication unit is used to send a second indication message to the second device after the first processing unit generates the first key based on the key generation parameters; wherein the second indication message is used to indicate the negotiation of the first key with the second device; receive a second response message sent by the second device, wherein the second response message is used to confirm the acquisition of the first key; send a first confirmation message of the second request message to the access network device; wherein the first confirmation message of the second request message is used to confirm that the first connection is securely established successfully.

[0360] The first confirmation information of the second request information is carried by a fourth RRC message.

[0361] The first communication unit is used to send a second indication message to the second device after the first processing unit generates the first key based on the key generation parameters; wherein the second indication message is used to indicate the negotiation of the first key with the second device; and receive a second response message sent by the second device; wherein the second response message is used to confirm the acquisition of the first key, and the second response message is also used to confirm that the first connection is securely established successfully.

[0362] The second indication information further carries second confirmation information of the second request information; the second confirmation information of the second request information is used to confirm that the first connection with the second device is established.

[0363] The first communication unit is used to send second confirmation information of the second request information to the access network device before the first processing unit generates the first key based on the key generation parameters, the second confirmation information of the second request information is used to confirm the completion of establishing the first connection with the second device, and the first confirmation information of the second request information is carried by the fifth RRC message.

[0364] The key generation parameters include at least one of the following: relevant information of the second device, a random number, a count value related to the first connection, relevant information of the radio bearer RB between the first device and the access network device, and a session identifier between the first device and the access network device.

[0365] The related information of the bearer between the first device and the access network device includes at least one of the following: the identifier of the data radio bearer DRB between the first device and the access network device; the identifier of the signaling radio bearer SRB between the first device and the access network device.

[0366] The first device is a remote terminal device; the second device is a relay terminal device.

[0367] FIG16 is a schematic diagram of the structure of a second device according to an embodiment of the present application, including:

[0368] The second communication unit 1601 is used to receive second information sent by the access network device, where the second information carries a first key; wherein the first key is used to perform security processing on data transmitted through the first connection; the first connection is a connection between the first device and the second device.

[0369] The second communication unit is used to send first indication information after receiving second information sent by the access network device; wherein the first indication information is used to indicate the negotiation of a first key with the first device; and receive first response information sent by the first device; wherein the first response information is used to confirm the generation of the first key.

[0370] The second communication unit is configured to send the first indication information to the first device.

[0371] The second information further carries first request information, where the first request information is used to request establishment of the first connection;

[0372] The second communication unit is configured to send confirmation information of the first request information to the first device upon receiving the first response information sent by the first device; wherein the confirmation information of the first request information is used to confirm that the first connection is securely established successfully.

[0373] The second communication unit is used to perform one of the following: sending confirmation information of the second information to the access network device; wherein the confirmation information of the second information carries the first indication information; after sending the confirmation information of the second information to the access network device, sending the first indication information to the access network device; after sending the confirmation information of the second information to the access network device, sending the first indication information to the first device.

[0374] The second communication unit is used to receive second indication information sent by the first device; wherein the second indication information is used to indicate negotiation of the first key with the second device; and after receiving the second information sent by the access network device, send a second response information to the first device, wherein the second response information is used to confirm the acquisition of the first key.

[0375] The second information further carries first request information, where the first request information is used to request establishment of the first connection;

[0376] The second communication unit is configured to send confirmation information of the first request information to the first device when sending the second response information to the first device; wherein the confirmation information of the first request information is used to confirm that the first connection is securely established successfully.

[0377] The second information also carries first request information, where the first request information is used to request establishment of the first connection; the second response information is also used to confirm that the first connection is successfully and securely established.

[0378] The second communication unit is configured to send key request information to the access network device upon receiving second indication information sent by the first device; and receive second information sent by the access network device.

[0379] The second indication information also carries second confirmation information of the second request information; the second confirmation information of the second request information is used to confirm the completion of establishing the first connection; and the key request information carries the second confirmation information of the second request information.

[0380] The second information is carried by a sixth RRC message.

[0381] The first device is a remote terminal device; the second device is a relay terminal device.

[0382] FIG17 is a schematic diagram of the structure of an access network device according to an embodiment of the present application, including:

[0383] The third communication unit 1701 is used to send first information to the first device and send second information to the second device; wherein, the first information carries key generation parameters, and the key generation parameters are used to generate a first key; the first key is used to perform security processing on data transmitted on the first connection; the first connection is a connection between the first device and the second device.

[0384] The third communication unit is configured to send first information to the first device, and before sending second information to the second device, receive first request information sent by the first device; wherein the first request information is used to request establishment of the first connection.

[0385] The first request information carries relevant information of the second device.

[0386] Based on FIG17 , as shown in FIG18 , the access network device further includes:

[0387] The third processing unit 1702 is configured to generate the first key after the third communication unit receives the first request information sent by the first device;

[0388] The third communication unit 1701 is configured to send the second information to the second device when the third processing unit generates the first key.

[0389] The second information also carries the first request information.

[0390] The third communication unit is configured to receive first indication information sent by the second device after sending the second information to the second device; wherein the first indication information is used to instruct negotiation of a first key with the first device.

[0391] The third communication unit is used to perform one of the following: receiving confirmation information of the second information sent by the second device, the confirmation information of the second information carries the first indication information; after receiving the confirmation information of the second information sent by the second device, receiving the first indication information sent by the second device.

[0392] The third communication unit is configured to send first information to the first device upon receiving the first indication information sent by the second device, where the first information carries the first indication information.

[0393] The third communication unit is configured to send the first indication information to the first device upon receiving the first indication information sent by the second device.

[0394] The first request information is carried by a first RRC message; and the first information is carried by a second RRC message.

[0395] The first information also carries second request information, where the second request information is used to request establishment of the first connection.

[0396] The first information also carries relevant information of the second device.

[0397] The first information is carried by a third RRC message.

[0398] The third communication unit is used to receive the first confirmation information of the second request information sent by the first device; the first confirmation information of the second request information is used to confirm that the first connection is successfully established securely, and the first confirmation information of the second request information is carried by the fourth RRC message.

[0399] The third communication unit is configured to send first information to the first device; receive key request information sent by the second device; and send the second information to the second device.

[0400] The key request information carries second confirmation information of the second request information; the second confirmation information of the second request information is used to confirm that the first connection with the second device is established.

[0401] The third communication unit is used to receive the second confirmation information of the second request information sent by the first device before receiving the key request information sent by the second device, and the second confirmation information of the second request information is used to confirm the completion of establishing the first connection with the second device; the second confirmation information of the second request information is carried by the fifth RRC message.

[0402] The second information is carried by a sixth RRC message.

[0403] The access network device further includes: a third processing unit, configured to generate the first key before the third communication unit sends the second information to the second device.

[0404] The third processing unit is used to generate the first key based on the key generation parameter and the second key; wherein the second key is used to perform security processing on data transmitted on the second connection; the second connection is the connection between the first device and the access network device.

[0405] The key generation parameters include at least one of the following: relevant information of the second device, a random number, a count value related to the first connection, relevant information of the radio bearer RB between the first device and the access network device, and a session identifier between the first device and the access network device.

[0406] The related information of the bearer between the first device and the access network device includes at least one of the following: the identifier of the data radio bearer DRB between the first device and the access network device; the identifier of the signaling radio bearer SRB between the first device and the access network device.

[0407] The first device is a remote terminal device; the second device is a relay terminal device.

[0408] Figure 19 is a schematic structural diagram of a communication device 1900 according to an embodiment of the present application. The communication device 1900 includes a processor 1910, which can call and execute a computer program from a memory to enable the communication device 1900 to implement the method in the embodiment of the present application.

[0409] In a possible implementation, the communication device 1900 may further include a memory 1920. The processor 1910 may call and execute a computer program from the memory 1920 to enable the communication device 1900 to implement the method in the embodiment of the present application.

[0410] The memory 1920 may be a separate device independent of the processor 1910 , or may be integrated into the processor 1910 .

[0411] In one possible implementation, the communication device 1900 may further include a transceiver 1930 , and the processor 1910 may control the transceiver 1930 to communicate with other devices. Specifically, it may send information or data to other devices, or receive information or data sent by other devices.

[0412] The transceiver 1930 may include a transmitter and a receiver. The transceiver 1930 may further include an antenna, and the number of antennas may be one or more.

[0413] In one possible implementation, the communication device 1900 may be the first device of the embodiment of the present application, and the communication device 1900 may implement the corresponding processes implemented by the first device in each method of the embodiment of the present application. For the sake of brevity, they will not be repeated here.

[0414] In one possible implementation, the communication device 1900 may be the second device of the embodiment of the present application, and the communication device 1900 may implement the corresponding processes implemented by the second device in each method of the embodiment of the present application. For the sake of brevity, they will not be repeated here.

[0415] In one possible implementation, the communication device 1900 may be the access network device of the embodiment of the present application, and the communication device 1900 may implement the corresponding processes implemented by the access network device in each method of the embodiment of the present application. For the sake of brevity, they will not be repeated here.

[0416] 20 is a schematic structural diagram of a chip 2000 according to an embodiment of the present application. The chip 2000 includes a processor 2010, which can call and execute a computer program from a memory to implement the method according to the embodiment of the present application.

[0417] In a possible implementation, the chip 2000 may further include a memory 2020. The processor 2010 may call and execute a computer program from the memory 2020 to implement the method executed by the access network device or the first core network device in the embodiment of the present application.

[0418] The memory 2020 may be a separate device independent of the processor 2010 , or may be integrated into the processor 2010 .

[0419] In a possible implementation, the chip 2000 may further include an input interface 2030. The processor 2010 may control the input interface 2030 to communicate with other devices or chips, and specifically, may obtain information or data sent by other devices or chips.

[0420] In a possible implementation, the chip 2000 may further include an output interface 2040. The processor 2010 may control the output interface 2040 to communicate with other devices or chips, and specifically, may output information or data to other devices or chips.

[0421] In one possible implementation, the chip can be applied to the access network device in the embodiment of the present application, and the chip can implement the corresponding processes implemented by the access network device in the various methods of the embodiment of the present application. For the sake of brevity, they are not described in detail here. In one possible implementation, the chip can be applied to the first device in the embodiment of the present application, and the chip can implement the corresponding processes implemented by the first device in the various methods of the embodiment of the present application. For the sake of brevity, they are not described in detail here. In one possible implementation, the chip can be applied to the second device in the embodiment of the present application, and the chip can implement the corresponding processes implemented by the second device in the various methods of the embodiment of the present application. For the sake of brevity, they are not described in detail here. The chips applied to the access network device, the first device, and the second device can be the same chip or different chips.

[0422] It should be understood that the chip mentioned in the embodiments of the present application can also be called a system-level chip, a system chip, a chip system or a system-on-chip chip, etc.

[0423] The processor mentioned above may be a general-purpose processor, a digital signal processor (DSP), a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), or other programmable logic devices, transistor logic devices, discrete hardware components, etc. The general-purpose processor mentioned above may be a microprocessor or any conventional processor, etc.

[0424] The memory mentioned above may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories. The non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM).

[0425] It should be understood that the above-mentioned memories are exemplary but not restrictive. For example, the memories in the embodiments of the present application may also be static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), and direct RAM RAM (DR RAM), etc. In other words, the memories in the embodiments of the present application are intended to include, but are not limited to, these and any other suitable types of memories.

[0426] Figure 21 is a schematic block diagram of a communication system 2100 according to an embodiment of the present application. The communication system 2100 includes an access network device 2110, a first device 2120, and a second device 2130. The access network device 2110 can be used to implement the corresponding functions implemented by the access network device in the above-described method, the first device 2120 can be used to implement the corresponding functions implemented by the first device in the above-described method, and the second device 2130 can be used to implement the corresponding functions implemented by the second device in the above-described method. For the sake of brevity, these details are not further described here.

[0427] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When software is used for implementation, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function in accordance with the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from a website, computer, server or data center by wired (such as coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (such as infrared, wireless, microwave, etc.) mode to another website, computer, server or data center. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrations. The available medium may be a magnetic medium (eg, a floppy disk, a hard disk, a magnetic tape), an optical medium (eg, a DVD), or a semiconductor medium (eg, a solid state disk (SSD)).

[0428] It should be understood that in the various embodiments of the present application, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0429] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0430] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any modifications or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in the present application should be included within the scope of protection of the present application. Therefore, the scope of protection of the present application should be based on the scope of protection of the claims.

Claims

1. A communication method, comprising: The first device receives first information sent by the access network device, wherein the first information carries a key generation parameter; The first device generates a first key based on the key generation parameter; wherein the first key is used to perform security processing on data transmitted through a first connection; and the first connection is a connection between the first device and the second device.

2. The method according to claim 1, wherein The first device generates a first key based on the key generation parameter, including: The first device generates the first key based on the key generation parameter and the second key; wherein the second key is used to perform security processing on data transmitted on the second connection; the second connection is a connection between the first device and an access network device.

3. The method according to claim 2, wherein: Before the first device receives the first information sent by the access network device, the method further includes: The first device sends first request information to the access network device; wherein the first request information is used to request establishment of the first connection.

4. The method according to claim 3, wherein: The first request information carries relevant information of the second device.

5. The method according to claim 3 or 4, wherein: The first information also carries first indication information; the first indication information is used to instruct negotiation of a first key with the first device.

6. The method according to claim 3 or 4, wherein: The method further comprises one of the following: The first device receives first indication information sent by the second device, wherein the first indication information is used to instruct negotiation of a first key with the first device; The first device receives first indication information sent by the access network device.

7. The method according to claim 5 or 6, wherein: After the first device generates the first key based on the key generation parameter, the method further includes: The first device sends a first response message to the second device; wherein the first response message is used to confirm the generation of the first key; The first device receives confirmation information of the first request information sent by the second device; wherein the confirmation information of the first request information is used to confirm that the first connection is successfully established securely.

8. The method according to claim 3 or 4, wherein: After the first device generates the first key based on the key generation parameter, the method further includes: The first device sends second indication information to the second device; wherein the second indication information is used to instruct negotiation of a first key with the second device; The first device receives second response information sent by the second device, where the second response information is used to confirm that the first key is obtained.

9. The method according to claim 8, wherein The second response information is also used to confirm that the first connection is successfully established securely.

10. The method according to claim 8, wherein After the first device receives the second response information sent by the second device, the method further includes: The first device receives confirmation information of the first request information sent by the second device; wherein the confirmation information of the first request information is used to confirm that the first connection is successfully established securely.

11. The method according to any one of claims 3 to 10, wherein: The first request information is carried by a first radio resource control RRC message; and the first information is carried by a second RRC message.

12. The method according to claim 2, wherein: The first information also carries second request information, where the second request information is used to request establishment of the first connection.

13. The method according to claim 12, wherein: The first information also carries relevant information of the second device.

14. The method according to claim 12 or 13, wherein: The first information is carried by a third RRC message.

15. The method according to any one of claims 12 to 14, wherein: The method further includes: the first device receiving first indication information sent by the second device; wherein the first indication information is used to instruct negotiation of a first key with the first device; After the first device generates the first key based on the key generation parameters, the method further includes: the first device sends a first response message to the second device, and the first response message is used to confirm the generation of the first key; the first device sends a first confirmation message of the second request message to the access network device, and the first confirmation message of the second request message is used to confirm that the first connection is securely established successfully.

16. The method according to any one of claims 12 to 14, wherein: After the first device generates the first key based on the key generation parameter, the method further includes: The first device sends second indication information to the second device; wherein the second indication information is used to instruct negotiation of a first key with the second device; The first device receives second response information sent by the second device, wherein the second response information is used to confirm that the first key is obtained; The first device sends first confirmation information of the second request information to the access network device; wherein the first confirmation information of the second request information is used to confirm that the first connection is successfully established securely.

17. The method according to claim 16, wherein The first confirmation information of the second request information is carried by a fourth RRC message.

18. The method according to any one of claims 12 to 14, wherein: After the first device generates the first key based on the key generation parameter, the method further includes: The first device sends second indication information to the second device; wherein the second indication information is used to instruct negotiation of a first key with the second device; The first device receives a second response message sent by the second device; wherein the second response message is used to confirm that the first key is obtained, and the second response message is also used to confirm that the first connection is successfully established securely.

19. The method according to claim 16 or 18, wherein The second indication information further carries second confirmation information of the second request information; the second confirmation information of the second request information is used to confirm that the first connection with the second device is established.

20. The method according to claim 16 or 18, wherein Before the first device generates the first key based on the key generation parameter, the method further includes: The first device sends second confirmation information of the second request information to the access network device, where the second confirmation information of the second request information is used to confirm the completion of establishing the first connection with the second device, and the first confirmation information of the second request information is carried by the fifth RRC message.

21. The method according to any one of claims 1 to 20, wherein: The key generation parameters include at least one of the following: relevant information of the second device, a first random number, a count value related to the first connection, relevant information of the radio bearer RB between the first device and the access network device, and a session identifier between the first device and the access network device.

22. The method according to claim 21, wherein The related information of the bearer between the first device and the access network device includes at least one of the following: the identifier of the data radio bearer DRB between the first device and the access network device; the identifier of the signaling radio bearer SRB between the first device and the access network device.

23. The method according to any one of claims 1 to 22, wherein: The first device is a remote terminal device; the second device is a relay terminal device.

24. A communication method, comprising: The second device receives second information sent by the access network device, where the second information carries a first key; wherein the first key is used to perform security processing on data transmitted through the first connection; and the first connection is a connection between the first device and the second device.

25. The method according to claim 24, wherein After the second device receives the second information sent by the access network device, the method further includes: The second device sends first indication information; wherein the first indication information is used to instruct negotiation of a first key with the first device; The second device receives first response information sent by the first device, wherein the first response information is used to confirm the generation of the first key.

26. The method according to claim 25, wherein The second device sending the first indication information includes: The second device sends the first indication information to the first device.

27. The method according to claim 25, wherein The second information further carries first request information, where the first request information is used to request establishment of the first connection; The method also includes: when the second device receives the first response information sent by the first device, the second device sends confirmation information of the first request information to the first device; wherein the confirmation information of the first request information is used to confirm that the first connection is successfully established securely.

28. The method according to claim 27, wherein The second device sends the first indication information, including one of the following: The second device sends confirmation information of the second information to the access network device; wherein the confirmation information of the second information carries the first indication information; After the second device sends confirmation information of the second information to the access network device, the second device sends the first indication information to the access network device; After the second device sends confirmation information of the second information to the access network device, the second device sends the first indication information to the first device.

29. The method according to claim 24, wherein The method further includes: the second device receiving second indication information sent by the first device; wherein the second indication information is used to instruct negotiation of the first key with the second device; After the second device receives the second information sent by the access network device, the method further includes: the second device sending second response information to the first device, wherein the second response information is used to confirm that the first key is obtained.

30. The method according to claim 29, wherein The second information further carries first request information, where the first request information is used to request establishment of the first connection; The method further includes: when the second device sends second response information to the first device, the second device sends confirmation information of the first request information to the first device; wherein the confirmation information of the first request information is used to confirm that the first connection is successfully established securely.

31. The method according to claim 29, wherein The second information also carries first request information, where the first request information is used to request establishment of the first connection; the second response information is also used to confirm that the first connection is successfully and securely established.

32. The method of claim 29, wherein: The second device receiving the second information sent by the access network device includes: When the second device receives the second indication information sent by the first device, the second device sends key request information to the access network device; The second device receives second information sent by the access network device.

33. The method according to claim 32, wherein The second indication information further carries second confirmation information of the second request information; the second confirmation information of the second request information is used to confirm the completion of establishing the first connection; The key request information carries second confirmation information of the second request information.

34. The method according to any one of claims 24 to 33, wherein: The second information is carried by a sixth RRC message.

35. The method according to any one of claims 24 to 34, wherein: The first device is a remote terminal device; the second device is a relay terminal device.

36. A communication method comprising: An access network device sends first information to a first device, and the access network device sends second information to a second device; wherein the first information carries key generation parameters, and the key generation parameters are used to generate a first key; the first key is used to perform security processing on data transmitted on a first connection; the first connection is a connection between the first device and the second device.

37. The method according to claim 36, wherein Before the access network device sends the first information to the first device and the access network device sends the second information to the second device, the method further includes: The access network device receives first request information sent by the first device; wherein the first request information is used to request establishment of the first connection.

38. The method of claim 37, wherein: The first request information carries relevant information of the second device.

39. The method according to claim 37 or 38, wherein After the access network device receives the first request information sent by the first device, the method further includes: the access network device generating the first key; The access network device sending the second information to the second device includes: the access network device sending the second information to the second device when generating the first key.

40. The method of claim 39, wherein The second information also carries the first request information.

41. The method according to claim 39 or 40, wherein After the access network device sends the second information to the second device, the method further includes: The access network device receives first indication information sent by the second device, wherein the first indication information is used to instruct negotiation of a first key with the first device.

42. The method according to claim 41, wherein The access network device receiving the first indication information sent by the second device includes one of the following: The access network device receives confirmation information of the second information sent by the second device, where the confirmation information of the second information carries the first indication information; After receiving confirmation information of the second information sent by the second device, the access network device receives the first indication information sent by the second device.

43. The method according to claim 41 or 42, wherein The access network device sending first information to the first device includes: When the access network device receives the first indication information sent by the second device, the access network device sends first information to the first device, where the first information carries the first indication information.

44. The method according to claim 41 or 42, wherein The method further comprises: When the access network device receives the first indication information sent by the second device, the access network device sends the first indication information to the first device.

45. The method according to any one of claims 37 to 44, wherein: The first request information is carried by a first RRC message; and the first information is carried by a second RRC message.

46. ​​The method of claim 36, wherein The first information also carries second request information, where the second request information is used to request establishment of the first connection.

47. The method of claim 46, wherein The first information also carries relevant information of the second device.

48. The method according to claim 46 or 47, wherein The first information is carried by a third RRC message.

49. The method according to any one of claims 46 to 48, wherein: The method further comprises: The access network device receives the first confirmation information of the second request information sent by the first device; the first confirmation information of the second request information is used to confirm that the first connection is successfully established securely, and the first confirmation information of the second request information is carried by the fourth RRC message.

50. The method according to any one of claims 46 to 48, wherein The access network device sends first information to the first device, and the access network device sends second information to the second device, including: The access network device sends first information to the first device; The access network device receives key request information sent by the second device; The access network device sends the second information to the second device.

51. The method of claim 50, wherein: The key request information carries second confirmation information of the second request information; the second confirmation information of the second request information is used to confirm that the first connection with the second device is established.

52. The method of claim 50, wherein: Before the access network device receives the key request information sent by the second device, the method further includes: The access network device receives second confirmation information of the second request information sent by the first device, where the second confirmation information of the second request information is used to confirm the completion of establishing the first connection with the second device; the second confirmation information of the second request information is carried by the fifth RRC message.

53. The method according to any one of claims 36 to 52, wherein: The second information is carried by a sixth RRC message.

54. The method according to any one of claims 46 to 52, wherein: Before the access network device sends the second information to the second device, the method further includes: The access network device generates the first key.

55. The method according to claim 39 or 54, wherein The access network device generating the first key includes: The access network device generates the first key based on the key generation parameter and the second key; wherein the second key is used to perform security processing on data transmitted on the second connection; the second connection is the connection between the first device and the access network device.

56. The method according to any one of claims 36 to 55, wherein: The key generation parameters include at least one of the following: relevant information of the second device, a first random number, a count value related to the first connection, relevant information of the radio bearer RB between the first device and the access network device, and a session identifier between the first device and the access network device.

57. The method of claim 56, wherein The related information of the bearer between the first device and the access network device includes at least one of the following: the identifier of the data radio bearer DRB between the first device and the access network device; the identifier of the signaling radio bearer SRB between the first device and the access network device.

58. The method according to any one of claims 36 to 57, wherein: The first device is a remote terminal device; the second device is a relay terminal device.

59. A first device comprising: A first communication unit, configured to receive first information sent by an access network device, wherein the first information carries a key generation parameter; The first processing unit is configured to generate a first key based on the key generation parameter; wherein the first key is used to perform security processing on data transmitted via a first connection; and the first connection is a connection between the first device and a second device.

60. The first device according to claim 59, wherein The first processing unit is used to generate the first key based on the key generation parameter and the second key; wherein the second key is used to perform security processing on data transmitted on the second connection; the second connection is a connection between the first device and the access network device.

61. The first device according to claim 60, wherein The first communication unit is configured to send first request information to the access network device before receiving the first information sent by the access network device; wherein the first request information is used to request establishment of the first connection.

62. The first device according to claim 61, wherein The first request information carries relevant information of the second device.

63. The first device according to claim 61 or 62, wherein The first information also carries first indication information; the first indication information is used to instruct negotiation of a first key with the first device.

64. The first device according to claim 61 or 62, wherein The first communication unit is configured to perform one of the following: receiving first indication information sent by the second device, wherein the first indication information is used to instruct negotiation of a first key with the first device; Receive first indication information sent by the access network device.

65. The first device according to claim 63 or 64, wherein The first communication unit is used to send a first response message to the second device after the first processing unit generates the first key based on the key generation parameters; wherein the first response message is used to confirm the generation of the first key; and receive confirmation information of the first request information sent by the second device; wherein the confirmation information of the first request information is used to confirm that the first connection is securely established successfully.

66. The first device according to claim 61 or 62, wherein The first communication unit is used to send a second indication message to the second device after the first processing unit generates the first key based on the key generation parameters; wherein the second indication message is used to indicate the negotiation of the first key with the second device; and receive a second response message sent by the second device, wherein the second response message is used to confirm the acquisition of the first key.

67. The first device according to claim 66, wherein The second response information is also used to confirm that the first connection is successfully established securely.

68. The first device of claim 66, wherein: The first communication unit is configured to receive confirmation information of the first request information sent by the second device after receiving the second response information sent by the second device; wherein the confirmation information of the first request information is used to confirm that the first connection is securely established successfully.

69. The first device according to any one of claims 61 to 68, wherein: The first request information is carried by a first radio resource control RRC message; and the first information is carried by a second RRC message.

70. The first device according to claim 60, wherein The first information also carries second request information, where the second request information is used to request establishment of the first connection.

71. The first device according to claim 70, wherein The first information also carries relevant information of the second device.

72. The first device according to claim 70 or 71, wherein The first information is carried by a third RRC message.

73. The first device according to any one of claims 70 to 72, wherein: The first communication unit is configured to receive first indication information sent by the second device; wherein the first indication information is used to instruct negotiation of a first key with the first device; And after the first processing unit generates the first key based on the key generation parameters, it sends a first response message to the second device, and the first response message is used to confirm the generation of the first key; and sends a first confirmation message of the second request message to the access network device, and the first confirmation message of the second request message is used to confirm that the first connection is securely established successfully.

74. The first device according to any one of claims 70 to 72, wherein: The first communication unit is used to send a second indication message to the second device after the first processing unit generates the first key based on the key generation parameters; wherein the second indication message is used to indicate the negotiation of the first key with the second device; receive a second response message sent by the second device, wherein the second response message is used to confirm the acquisition of the first key; send a first confirmation message of the second request message to the access network device; wherein the first confirmation message of the second request message is used to confirm that the first connection is securely established successfully.

75. The first device of claim 74, wherein The first confirmation information of the second request information is carried by a fourth RRC message.

76. The first device according to any one of claims 70 to 72, wherein: The first communication unit is used to send a second indication message to the second device after the first processing unit generates the first key based on the key generation parameters; wherein the second indication message is used to indicate the negotiation of the first key with the second device; and receive a second response message sent by the second device; wherein the second response message is used to confirm the acquisition of the first key, and the second response message is also used to confirm that the first connection is securely established successfully.

77. The first device according to claim 74 or 76, wherein The second indication information further carries second confirmation information of the second request information; the second confirmation information of the second request information is used to confirm that the first connection with the second device is established.

78. The first device according to claim 74 or 76, wherein The first communication unit is used to send second confirmation information of the second request information to the access network device before the first processing unit generates the first key based on the key generation parameters, the second confirmation information of the second request information is used to confirm the completion of establishing the first connection with the second device, and the first confirmation information of the second request information is carried by the fifth RRC message.

79. The first device according to any one of claims 59 to 78, wherein: The key generation parameters include at least one of the following: relevant information of the second device, a random number, a count value related to the first connection, relevant information of the radio bearer RB between the first device and the access network device, and a session identifier between the first device and the access network device.

80. The first device of claim 79, wherein The related information of the bearer between the first device and the access network device includes at least one of the following: the identifier of the data radio bearer DRB between the first device and the access network device; the identifier of the signaling radio bearer SRB between the first device and the access network device.

81. The first device according to any one of claims 59-80, wherein The first device is a remote terminal device; the second device is a relay terminal device.

82. A second device comprising: The second communication unit is used to receive second information sent by the access network device, where the second information carries a first key; wherein the first key is used to perform security processing on data transmitted by the first connection; the first connection is a connection between the first device and the second device.

83. The second device according to claim 82, wherein The second communication unit is used to send first indication information after receiving second information sent by the access network device; wherein the first indication information is used to indicate the negotiation of a first key with the first device; and receive first response information sent by the first device; wherein the first response information is used to confirm the generation of the first key.

84. The second device according to claim 83, wherein The second communication unit is configured to send the first indication information to the first device.

85. The second device according to claim 83, wherein The second information further carries first request information, where the first request information is used to request establishment of the first connection; The second communication unit is configured to send confirmation information of the first request information to the first device upon receiving the first response information sent by the first device; wherein the confirmation information of the first request information is used to confirm that the first connection is securely established successfully.

86. The second device according to claim 85, wherein The second communication unit is configured to perform one of the following: Sending confirmation information of the second information to the access network device; wherein the confirmation information of the second information carries the first indication information; After sending confirmation information of the second information to the access network device, sending the first indication information to the access network device; After sending confirmation information of the second information to the access network device, the first indication information is sent to the first device.

87. The second device according to claim 82, wherein The second communication unit is configured to receive second indication information sent by the first device; wherein the second indication information is used to instruct negotiation of a first key with the second device; And after receiving the second information sent by the access network device, sending second response information to the first device, wherein the second response information is used to confirm the acquisition of the first key.

88. The second device according to claim 87, wherein The second information further carries first request information, where the first request information is used to request establishment of the first connection; The second communication unit is configured to send confirmation information of the first request information to the first device when sending the second response information to the first device; wherein the confirmation information of the first request information is used to confirm that the first connection is securely established successfully.

89. The second device according to claim 87, wherein The second information also carries first request information, where the first request information is used to request establishment of the first connection; the second response information is also used to confirm that the first connection is successfully and securely established.

90. The second device according to claim 87, wherein The second communication unit is configured to send key request information to the access network device when receiving the second indication information sent by the first device; Receive second information sent by the access network device.

91. The second device according to claim 90, wherein The second indication information further carries second confirmation information of the second request information; the second confirmation information of the second request information is used to confirm the completion of establishing the first connection; The key request information carries second confirmation information of the second request information.

92. The second device according to any one of claims 82 to 91, wherein: The second information is carried by a sixth RRC message.

93. The second device according to any one of claims 82-93, wherein The first device is a remote terminal device; the second device is a relay terminal device.

94. An access network device comprising: A third communication unit is used to send first information to the first device and to send second information to the second device; wherein the first information carries key generation parameters, and the key generation parameters are used to generate a first key; the first key is used to perform security processing on data transmitted on the first connection; the first connection is a connection between the first device and the second device.

95. The access network device according to claim 94, wherein: The third communication unit is configured to send first information to the first device, and before sending second information to the second device, receive first request information sent by the first device; wherein the first request information is used to request establishment of the first connection.

96. The access network device according to claim 95, wherein: The first request information carries relevant information of the second device.

97. The access network device according to claim 95 or 96, wherein: The access network device further includes: a third processing unit, configured to generate the first key after the third communication unit receives the first request information sent by the first device; The third communication unit is configured to send the second information to the second device when the third processing unit generates the first key.

98. The access network device according to claim 97, wherein: The second information also carries the first request information.

99. The access network device according to claim 97 or 98, wherein: The third communication unit is configured to receive first indication information sent by the second device after sending the second information to the second device; wherein the first indication information is used to instruct negotiation of a first key with the first device.

100. The access network device according to claim 99, wherein: The third communication unit is configured to perform one of the following: receiving confirmation information of the second information sent by the second device, where the confirmation information of the second information carries the first indication information; After receiving confirmation information of the second information sent by the second device, receive the first indication information sent by the second device.

101. The access network device according to claim 99 or 100, wherein: The third communication unit is configured to send first information to the first device upon receiving the first indication information sent by the second device, where the first information carries the first indication information.

102. The access network device according to claim 99 or 100, wherein: The third communication unit is configured to send the first indication information to the first device upon receiving the first indication information sent by the second device.

103. The access network device according to any one of claims 95 to 102, wherein: The first request information is carried by a first RRC message; and the first information is carried by a second RRC message.

104. The access network device according to claim 94, wherein: The first information also carries second request information, where the second request information is used to request establishment of the first connection.

105. The access network device according to claim 104, wherein: The first information also carries relevant information of the second device.

106. The access network device according to claim 104 or 105, wherein: The first information is carried by a third RRC message.

107. The access network device according to any one of claims 104 to 106, wherein: The third communication unit is used to receive the first confirmation information of the second request information sent by the first device; the first confirmation information of the second request information is used to confirm that the first connection is successfully established securely, and the first confirmation information of the second request information is carried by the fourth RRC message.

108. The access network device according to any one of claims 104 to 106, wherein: The third communication unit is configured to send the first information to the first device and receive the key request information sent by the second device; The second information is sent to the second device.

109. The access network device according to claim 108, wherein: The key request information carries second confirmation information of the second request information; the second confirmation information of the second request information is used to confirm that the first connection with the second device is established.

110. The access network device according to claim 109, wherein: The third communication unit is used to receive the second confirmation information of the second request information sent by the first device before receiving the key request information sent by the second device, and the second confirmation information of the second request information is used to confirm the completion of establishing the first connection with the second device; the second confirmation information of the second request information is carried by the fifth RRC message.

111. The access network device according to any one of claims 94 to 110, wherein: The second information is carried by a sixth RRC message.

112. The access network device according to any one of claims 104 to 110, wherein: The access network device further includes: The third processing unit is configured to generate the first key before the third communication unit sends the second information to the second device.

113. The access network device according to claim 94 or 112, wherein: The third processing unit is used to generate the first key based on the key generation parameter and the second key; wherein the second key is used to perform security processing on data transmitted on the second connection; the second connection is the connection between the first device and the access network device.

114. The access network device according to any one of claims 94 to 113, wherein: The key generation parameters include at least one of the following: relevant information of the second device, a random number, a count value related to the first connection, relevant information of the radio bearer RB between the first device and the access network device, and a session identifier between the first device and the access network device.

115. The access network device according to claim 114, wherein: The related information of the bearer between the first device and the access network device includes at least one of the following: the identifier of the data radio bearer DRB between the first device and the access network device; the identifier of the signaling radio bearer SRB between the first device and the access network device.

116. The access network device according to any one of claims 94 to 115, wherein: The first device is a remote terminal device; the second device is a relay terminal device.

117. A first device comprising: A processor and a memory, the memory being used to store a computer program, the processor being used to call and run the computer program stored in the memory, so that the first device executes the method according to any one of claims 1 to 23.

118. A second device comprising: A processor and a memory, the memory being used to store a computer program, the processor being used to call and run the computer program stored in the memory, so that the second device executes the method according to any one of claims 24 to 35.

119. An access network device comprising: A processor and a memory, the memory being used to store a computer program, the processor being used to call and run the computer program stored in the memory so that the access network device executes the method as described in any one of claims 36 to 58.

120. A chip comprising: A processor, configured to call and run a computer program from a memory, so that a device equipped with the chip executes a method according to any one of claims 1 to 23, or claims 24 to 35, or claims 36 to 58.

121. A computer-readable storage medium for storing a computer program, which, when executed by a device, causes the device to perform the method according to any one of claims 1 to 23, or claims 24 to 35, or claims 36 to 58.

122. A computer program product comprising computer program instructions for causing a computer to perform the method of any one of claims 1 to 23, or claims 24 to 35, or claims 36 to 58.

123. A computer program causing a computer to perform the method of any one of claims 1 to 23, or claims 24 to 35, or claims 36 to 58.

Images