Communication method and device

Abstract

The invention relates to the technical field of communication, and discloses a communication method and device. The method comprises the following steps: a source base station sends a switching request message to a candidate base station to request the configuration of a candidate cell; and the candidate base station obtains the key information from the core network equipment according to the switching request message, and sends the key information and the configuration of the candidate cell to the source base station. Or, the source base station deduces the candidate base station to obtain the security key, and sends the security key to the candidate base station. By adopting the method, the key information can be respectively maintained by the candidate base stations, and the security problem of inter-gNB LTM is avoided; alternatively, the source base station can maintain the key information and deduce the security key for the candidate base station, thereby avoiding the security problem of inter-gNB LTM.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a communication method and device. Background Art

[0002] Cell switching is a very important feature in communication systems. It is mainly triggered by the movement of the terminal when the terminal is in a radio resource control (RRC) connection state, so that the terminal can be switched to a neighboring cell with better signal quality before the signal quality of the serving cell becomes incapable of communication, thereby providing continuous and uninterrupted communication services.

[0003] There are two types of cell handovers, one of which is based on layer 1 / layer 2, which can be called layer 1 / layer 2 handover or layer 1 / layer 2 triggered mobility (L1 / L2 triggered mobility, LTM), and the other is based on layer 3, which can be called layer 3 handover (L3 handover).

[0004] Currently, in LTM, the terminal can implement cell switching under the same base station, that is, intra-gNBLTM. However, in LTM, the terminal can implement cell switching between different base stations, that is, inter-gNB LTM, which still needs further research. Summary of the invention

[0005] The present application provides a communication method and apparatus for implementing support for inter-gNB LTM.

[0006] In the first aspect, an embodiment of the present application provides a communication method, which is applied to a second access network device (such as a candidate base station) or a module (such as a chip or circuit) in the second access network device. Taking the application of the method to the second access network device as an example, in the method, the second access network device receives a first request message from the first access network device, and the first request message is used to request the configuration of a first candidate cell; according to the first request message, obtain first key information and second key information from a core network device, the first key information is used to identify the second key information, and the second key information is used for security protection of data between a terminal device and the second access network device; wherein the first key information and the second key information correspond to the first candidate cell; send a first response message to the first access network device, and the first response message includes the configuration of the first candidate cell and the first key information.

[0007] Through this method, in inter-gNB LTM, the key information is maintained based on the candidate base station to avoid security issues.

[0008] In one possible design, the method also includes: receiving a second request message from the first access network device, the second request message being used to request the configuration of a second candidate cell; sending the configuration of the second candidate cell and first indication information to the first access network device, the first indication information being used to indicate key information corresponding to the second candidate cell; wherein the key information corresponding to the second candidate cell is the same as the key information corresponding to the first candidate cell.

[0009] In this design, the key information used by multiple candidate cells included in the candidate base station is shared. In this way, when the terminal accesses a candidate cell of the candidate base station and needs to switch to another candidate cell of the candidate base station, there is no need to update the security key, thereby reducing the switching delay within the base station; wherein the security key is derived based on the key information.

[0010] In one possible design, the first request message includes key request information, and the key request information is used to request (or instruct) the second access network device to obtain the security key corresponding to the first candidate cell.

[0011] In this design, when the source base station sends a first request message to the candidate base station, it requests the candidate base station through the first request message to obtain the security key corresponding to the first candidate cell. Therefore, the candidate base station responds to the key request information, obtains the key information corresponding to the first candidate cell from the key information maintained by itself, and derives the security key based on the key information corresponding to the first candidate cell.

[0012] In one possible design, the key request information includes information of a third candidate cell, and the information of the third candidate cell is used to obtain a security key corresponding to the first candidate cell; wherein the third candidate cell is the same as or different from the first candidate cell.

[0013] In this design, the candidate base station determines the candidate cell for key derivation, which is indicated by the source base station through the first request message.

[0014] In one possible design, the first response message also includes information of a third candidate cell corresponding to the first key information, and the information of the third candidate cell is used to obtain the security key corresponding to the first candidate cell; wherein the third candidate cell is the same as or different from the first candidate cell.

[0015] In this design, the candidate base station determines the candidate cell for key derivation, which is determined by the candidate base station itself. In addition, the candidate base station indicates the candidate cell for key derivation to the source base station through the first response message.

[0016] In one possible design, the method also includes: deducing a security key corresponding to the first candidate cell based on the second key information, the PCI of the third candidate cell and the downlink frequency of the third candidate cell; receiving data from the terminal device, and processing the data of the terminal device according to the security key corresponding to the first candidate cell.

[0017] In this design, after the candidate base station obtains the first key information and the second key information from the key information maintained by itself, it performs key deduction based on the first key information and the second key information to obtain the security key. In this way, the candidate base station uses the security key to achieve security protection of data between the candidate base station and the terminal.

[0018] In one possible design, obtaining the first key information and the second key information from the core network device according to the first request message includes: sending a third request message to the core network device according to the first request message, the third request message being used to request the key information corresponding to the first candidate cell; and receiving the first key information and the second key information from the core network device.

[0019] In this design, the candidate base station requests the core network device to allocate the first key information and the second key information by sending a third request message to the core network device.

[0020] In the second aspect, an embodiment of the present application provides a communication method, which is applied to a first access network device (such as a source base station) or a module in the first access network device (such as a chip or a circuit). Taking the application of the method to the first access network device as an example, in the method, the first access network device sends a first request message to the second access network device, and the first request message is used to request the configuration of a first candidate cell; receives a first response message from the second access network device, and the first response message includes the configuration of the first candidate cell and first key information; wherein the first key information corresponds to the first candidate cell.

[0021] In one possible design, the method also includes: sending a second request message to the second access network device, the second request message is used to request the configuration of a second candidate cell; receiving the configuration of the second candidate cell and first indication information from the second access network device, the first indication information is used to indicate the key information corresponding to the second candidate cell; wherein the key information corresponding to the second candidate cell is the same as the key information corresponding to the first candidate cell.

[0022] In one possible design, the first request message includes key request information, and the key request information is used to request the second access network device to obtain the security key corresponding to the first candidate cell.

[0023] In one possible design, the key request information includes information of a third candidate cell, and the information of the third candidate cell is used to obtain a security key corresponding to the first candidate cell; wherein the third candidate cell is the same as or different from the first candidate cell.

[0024] In one possible design, the first response message also includes information of a third candidate cell corresponding to the first key information, and the information of the third candidate cell is used to obtain the security key corresponding to the first candidate cell; wherein the third candidate cell is the same as or different from the first candidate cell.

[0025] In a possible design, the method also includes: sending information of a first list, the first key information, and second indication information to a terminal device; wherein the first list includes identifiers of multiple candidate cells, and the multiple candidate cells include a first candidate cell; the first list corresponds to the first key information; the second indication information is used to indicate that the input parameters of key derivation correspond to the first candidate cell; and sending a first switching message to the terminal device, wherein the first switching message is used to instruct the terminal device to switch to a candidate cell in the first list.

[0026] In one possible design, the method further includes: sending a second switching message to the second access network device, wherein the second switching message is used to indicate that a switching has been initiated to a candidate cell in the first list.

[0027] In the third aspect, an embodiment of the present application provides a communication method, which is applied to a terminal device or a module (such as a chip or circuit) in a terminal device. Taking the application of the method to a terminal device as an example, in the method, the terminal device receives information from a first list, a first key information, and a second indication information from a first access network device; wherein the first list includes identifiers of multiple candidate cells, and the multiple candidate cells include a first candidate cell; the second indication information is used to indicate that the input parameters of the key derivation correspond to the first candidate cell; a first switching message is received from the first access network device, and the first switching message is used to instruct the terminal device to switch to a candidate cell in the first list; access a candidate cell in the first list; derive a security key corresponding to the first candidate cell according to the first key information and the second indication information; and communicate with the second access network device on a candidate cell in the first list according to the security key.

[0028] In one possible design, the security key corresponding to the first candidate cell is deduced based on the first key information and the second indication information, including: deducing the security key corresponding to the first candidate cell based on the second key information corresponding to the first key information, the PCI of the first candidate cell and the downlink frequency of the first candidate cell.

[0029] In a fourth aspect, an embodiment of the present application provides a communication method, which is applied to a core network device (such as an AMF) or a module in a core network device (such as a chip or circuit). Taking the application of the method to a core network device as an example, in the method, the core network device receives a third request message from a second access network device, and the third request message is used to request key information; sends first key information and second key information to the second access network device; wherein the first key information is used to identify the second key information, and the second key information is used for security protection of data between a terminal device and the second access network device.

[0030] In one possible design, the third request message also includes information of a third candidate cell corresponding to the first key information, and the information of the third candidate cell is used to obtain the security key corresponding to the first candidate cell; wherein the third candidate cell is the same as or different from the first candidate cell.

[0031] It can be understood that the method for which protection is sought in the second aspect, the third aspect or the fourth aspect corresponds to the first aspect, and the beneficial effects of the relevant technical features in the second aspect or the third aspect can be referred to the description of the first aspect and will not be repeated here.

[0032] In the fifth aspect, an embodiment of the present application provides a communication method, which is applied to a first access network device (such as a source base station) or a module in the first access network device (such as a chip or circuit). Taking the application of the method to the first access network device as an example, in the method, the first access network device sends a first request message to the second access network device, and the first request message is used to request the configuration of a first candidate cell. The first request message is also used to indicate the key information corresponding to the first candidate cell; the configuration of the first candidate cell is received from the second access network device.

[0033] In this method, in inter-gNB LTM, key information is maintained by the source base station and keys are derived for candidate base stations, thereby avoiding security issues.

[0034] In one possible design, the method also includes: sending a second request message to the second access network device, the second request message is used to request the configuration of a second candidate cell; receiving the configuration of the second candidate cell and first indication information from the second access network device, the first indication information is used to indicate the key information corresponding to the second candidate cell; wherein the key information corresponding to the second candidate cell is the same as the key information corresponding to the first candidate cell.

[0035] In this design, the key information used by multiple candidate cells included in the candidate base station is shared. In this way, when the terminal accesses a candidate cell of the candidate base station and needs to switch to another candidate cell of the candidate base station, there is no need to update the security key, thereby reducing the switching delay within the base station; wherein the security key is derived based on the key information.

[0036] In one possible design, the first request message includes: information about a first security key corresponding to the first candidate cell and a cell corresponding to the first security key; wherein the first security key corresponding to the first candidate cell and information about a cell corresponding to the first security key are used to indicate key information corresponding to the first candidate cell.

[0037] In one possible design, the cell corresponding to the first security key is the first candidate cell, and the method also includes: deducing the first security key according to the second key information corresponding to the first key information, the PCI of the first candidate cell, and the downlink frequency of the first candidate cell; wherein the first key information is used to identify the second key information, and the second key information is used for security protection of data between the terminal device and the second access network device; the first key information and the second key information correspond to the first candidate cell.

[0038] In one possible design, the method also includes: sending a third request message to the core network device, the third request message being used to request key information corresponding to the first candidate cell; receiving the first key information and the second key information from the core network device; or, determining the key information corresponding to the second security key as the first key information; wherein the second security key corresponds to the source cell.

[0039] In one possible design, the first request message also includes: the first key information.

[0040] In a possible design, the method also includes: sending information of a first list, the first key information, and second indication information to the terminal device; wherein the first list includes identifiers of multiple candidate cells, and the multiple candidate cells include the first candidate cell; the first list corresponds to the first key information; the second indication information is used to indicate that the input parameters of key derivation correspond to the first candidate cell; and sending a first switching message to the terminal device, wherein the first switching message is used to instruct the terminal device to switch to a candidate cell in the first list.

[0041] In a possible design, the cell corresponding to the first security key is the first candidate cell, and the method also includes: deducing the first security key according to the second key information, the PCI of the first candidate cell, and the downlink frequency of the first candidate cell; wherein the second key information is jointly identified by the first key information and the first extended key information, and the second key information is used for security protection of data between the terminal device and the second access network device; the first key information and the second key information correspond to the first candidate cell.

[0042] In this design, the source base station combines the extended key information with the first key information to increase the number of key information that the source base station can distribute. When the number of candidate base stations is greater than the number of NCCs, additional extended key information needs to be introduced to identify the second key information through the first key information and the first extended key information to avoid key misalignment.

[0043] In one possible design, the method also includes: sending a third request message to the core network device, wherein the third request message is used to request the key information corresponding to the first candidate cell; receiving the first key information, the first extended key information, and the second key information from the core network device; or, determining the key information corresponding to the second security key as the first key information; wherein the second security key corresponds to the source cell.

[0044] In one possible design, the first request message also includes: the first key information and the first extended key information.

[0045] In one possible design, the method also includes: sending information of a first list, the first key information, the first extended key information, and second indication information to the terminal device; wherein the first list includes identifiers of multiple candidate cells, and the multiple candidate cells include the first candidate cell; the first list corresponds to the first key information and the first extended key information; the second indication information is used to indicate that the input parameters of key derivation correspond to the first candidate cell; and sending a first switching message to the terminal device, wherein the first switching message is used to instruct the terminal device to switch to a candidate cell in the first list.

[0046] In one possible design, the method further includes: sending a second switching message to the second access network device, wherein the second switching message is used to indicate that a switching has been initiated to a candidate cell in the first list.

[0047] In the sixth aspect, an embodiment of the present application provides a communication method, which is applied to a second access network device (such as a candidate base station) or a module in the second access network device (such as a chip or circuit). Taking the application of the method to the second access network device as an example, in the method, the second access network device receives a first request message from the first access network device, and the first request message is used to request the configuration of a first candidate cell. The first request message is also used to indicate the key information corresponding to the first candidate cell; the configuration of the first candidate cell is sent to the first access network device.

[0048] In one possible design, the method also includes: receiving a second request message from the first access network device, the second request message being used to request the configuration of a second candidate cell; sending the configuration of the second candidate cell and first indication information to the first access network device, the first indication information being used to indicate key information corresponding to the second candidate cell; wherein the key information corresponding to the second candidate cell is the same as the key information corresponding to the first candidate cell.

[0049] In one possible design, the first request message includes: information about a first security key corresponding to the first candidate cell and a cell corresponding to the first security key; wherein the first security key corresponding to the first candidate cell and information about a cell corresponding to the first security key are used to indicate key information corresponding to the first candidate cell.

[0050] In a possible design, the first request message also includes: first key information; wherein the first key information is used to identify second key information, and the second key information is used for security protection of data between the terminal device and the second access network device.

[0051] In a possible design, the first request message also includes: first key information and first extended key information; wherein, the first key information and the first extended key information are used to jointly identify second key information, and the second key information is used for security protection of data between the terminal device and the second access network device.

[0052] In one possible design, the method further includes: receiving a second switching message from the first access network device, the second switching message being used to indicate that a switch has been initiated to a candidate cell included in the second access device.

[0053] In one possible design, the method also includes: sending a fourth request message to the core network device; receiving third key information and fourth key information from the core network device; wherein the third key information is used to identify the fourth key information, and the fourth key information is used for security protection of data between the terminal device and the third access network device.

[0054] In another possible design, the method also includes: sending a fourth request message to the core network device; receiving third key information, second extended key information and fourth key information from the core network device; wherein the third key information and the second extended key information are used to jointly identify the fourth key information, and the fourth key information is used for security protection of data between the terminal device and the third access network device.

[0055] In the seventh aspect, an embodiment of the present application provides a communication method, which is applied to a terminal device or a module (such as a chip or circuit) in a terminal device. Taking the application of the method to a terminal device as an example, in the method, the terminal device receives information from a first list, first key information, and second indication information from a first access network device; wherein the first list includes identifiers of multiple candidate cells, and the multiple candidate cells include a first candidate cell; the second indication information is used to indicate that the input parameters of the key derivation correspond to the first candidate cell; a first switching message is received from the first access network device, and the first switching message is used to instruct the terminal device to switch to a candidate cell in the first list; access a candidate cell in the first list; derive a security key corresponding to the first candidate cell according to the first key information and the second indication information; and communicate with the second access network device on a candidate cell in the first list according to the security key.

[0056] In one possible design, the security key corresponding to the first candidate cell is deduced based on the first key information and the second indication information, including: deducing the security key corresponding to the first candidate cell based on the second key information corresponding to the first key information, the PCI of the first candidate cell and the downlink frequency of the first candidate cell.

[0057] In the eighth aspect, an embodiment of the present application provides a communication method, which is applied to a terminal device or a module (such as a chip or circuit) in a terminal device. Taking the application of the method to a terminal device as an example, in the method, the terminal device receives information from a first list, a first key information, a first extended key information, and a second indication information from a first access network device; wherein the first list includes identifiers of multiple candidate cells, and the multiple candidate cells include a first candidate cell; the second indication information is used to indicate that the input parameters of the key derivation correspond to the first candidate cell; a first switching message is received from the first access network device, and the first switching message is used to instruct the terminal device to switch to a candidate cell in the first list; access a candidate cell in the first list; derive a security key corresponding to the first candidate cell according to the first key information, the first extended key information and the second indication information; and communicate with the second access network device on a candidate cell in the first list according to the security key.

[0058] In a possible design, the security key corresponding to the first candidate cell is deduced based on the first key information, the first extended key information and the second indication information, including: deducing the security key corresponding to the first candidate cell based on the second key information, the PCI of the first candidate cell and the downlink frequency of the first candidate cell; wherein the second key information is jointly identified by the first key information and the first extended key information.

[0059] It can be understood that the method for which protection is requested in the sixth aspect, the seventh aspect or the eighth aspect corresponds to the fifth aspect, and the beneficial effects of the relevant technical features in the sixth aspect, the seventh aspect or the eighth aspect can be referred to the description of the first aspect and will not be repeated here.

[0060] In a ninth aspect, the present application provides a communication device, which has the function of implementing the functions involved in the first to eighth aspects above. For example, the communication device includes modules or units or means corresponding to the operations involved in the first to eighth aspects above. The functions or units or means can be implemented by software, or by hardware, or the corresponding software can be implemented by hardware.

[0061] In one possible design, the communication device includes a processing unit and a communication unit, wherein the communication unit is used to send and receive signals to realize communication between the communication device and other devices, for example, the communication unit is used to send system information to a terminal; and the processing unit is used to perform some internal operations of the communication device. The functions performed by the processing unit and the communication unit may correspond to the operations involved in the first to eighth aspects described above.

[0062] In one possible design, the communication device includes a processor, and the processor is coupled to a memory. The memory can store necessary computer programs or instructions for implementing the functions involved in the first to eighth aspects above. The processor can execute the computer program or instructions stored in the memory, and when the computer program or instructions are executed, the communication device implements the method in any possible design or implementation of the first to eighth aspects above.

[0063] In one possible design, the communication device includes a processor and a memory, and the memory can store necessary computer programs or instructions for implementing the functions involved in the first to eighth aspects. The processor can execute the computer program or instructions stored in the memory, and when the computer program or instructions are executed, the communication device implements the method in any possible design or implementation of the first to eighth aspects.

[0064] In one possible design, the communication device includes a processor and an interface circuit, wherein the processor is used to communicate with other devices through the interface circuit and execute the method in any possible design or implementation of the first to eighth aspects above.

[0065] It can be understood that in the fourth aspect above, the processor can be implemented by hardware or by software. When implemented by hardware, the processor can be a logic circuit, an integrated circuit, etc.; when implemented by software, the processor can be a general-purpose processor, which is implemented by reading the software code stored in the memory. In addition, the above processors can be one or more, and the memories can be one or more. The memory can be integrated with the processor, or the memory can be separately set from the processor. In the specific implementation process, the memory can be integrated with the processor on the same chip, or can be set on different chips respectively. The embodiment of the present application does not limit the type of memory and the setting method of the memory and the processor.

[0066] In the tenth aspect, the present application provides a communication system, which may include a first communication device, a second communication device, a third communication device and a fourth communication device; wherein the first communication device is used to execute the method described in the first aspect, and the second communication device is used to execute the method described in the second aspect; the third communication device is used to execute the method described in the third aspect, and the fourth communication device is used to execute the method described in the fourth aspect; or, the first communication device is used to execute the method described in the fifth aspect, and the second communication device is used to execute the method described in the sixth aspect; the third communication device is used to execute the method described in the seventh aspect, and the fourth communication device is used to execute the method described in the eighth aspect.

[0067] In the eleventh aspect, the present application provides a computer-readable storage medium, in which computer-readable instructions are stored. When a computer reads and executes the computer-readable instructions, the computer executes a method in any possible design of the first to eighth aspects above.

[0068] In a twelfth aspect, the present application provides a computer program product. When a computer reads and executes the computer program product, the computer executes the method in any possible design of the first to eighth aspects above.

[0069] In the thirteenth aspect, the present application provides a chip, comprising a processor, wherein the processor is coupled to a memory and is used to read and execute a software program stored in the memory to implement a method in any possible design of the first to eighth aspects above. BRIEF DESCRIPTION OF THE DRAWINGS

[0070] Figure 1 A schematic diagram of the architecture of a communication system applicable to an embodiment of the present application;

[0071] Figure 2A A schematic diagram of a random access process provided in an embodiment of the present application;

[0072] Figure 2B A schematic diagram of another random access process provided in an embodiment of the present application;

[0073] Figure 3 A flow chart corresponding to a communication method;

[0074] Figure 4 A schematic diagram of a key deduction;

[0075] Figure 5A A flow chart corresponding to the communication method provided in Example 1 of the present application;

[0076] Figure 5B A schematic diagram of a list provided in Example 1 of the present application;

[0077] Figure 6 A flow chart corresponding to the communication method provided in Embodiment 2 of the present application;

[0078] Figure 7 A flow chart corresponding to the communication method provided in Embodiment 3 of the present application;

[0079] Figure 8 A flow chart corresponding to the communication method provided in Embodiment 4 of the present application;

[0080] Fig. 9 A possible exemplary block diagram of a device involved in an embodiment of the present application;

[0081] Fig.10 A schematic diagram of the structure of a communication device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0082] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.

[0083] The technical solutions in the embodiments of the present application can be applied to various communication systems, such as universal mobile telecommunications system (UMTS), wireless local area network (WLAN), wireless fidelity (Wi-Fi) system, 4th generation (4G) mobile communication system, such as long term evolution (LTE) system, fifth generation (5G) mobile communication system, such as new radio (NR) system, and future evolved communication systems, such as sixth generation (6G) mobile communication system, etc.

[0084] The present application will present various aspects, embodiments or features around a system that may include multiple devices, components, modules, etc. It should be understood and appreciated that each system may include additional devices, components, modules, etc., and / or may not include all the devices, components, modules, etc. discussed in conjunction with the drawings. In addition, combinations of these schemes may also be used. In addition, in the embodiments of the present application, words such as "exemplarily" and "for example" are used to represent examples, illustrations or descriptions. Any embodiment or design described as an "example" in the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of the word "example" is intended to present concepts in a specific way. In the embodiments of the present application, "of", "corresponding, relevant" and "corresponding" can sometimes be used interchangeably. It should be noted that when the distinction is not emphasized, the meanings to be expressed are consistent.

[0085] To facilitate understanding of the embodiments of the present application, first Figure 1 The communication system shown in the figure is used as an example to describe in detail the communication system applicable to the embodiment of the present application. Figure 1 As shown, the communication system 10 includes one or more network devices 20, and one or more terminals 30. Among them, the interface between the network device and the terminal can be a Uu interface (or called an air interface), and data can be transmitted between the network device 20 and the terminal 30 through air interface resources. Exemplarily, the terminal can be located within the communication coverage of one or more cells of the network device, and the cell providing service to the terminal (i.e., the service cell of the terminal) can be one or more. When there are multiple service cells of the terminal, the terminal can work according to one or more transmission technologies such as carrier aggregation (CA), dual connectivity (DC), coordinated multipoint (CoMP) transmission, and multiple transmission and reception point (mTRP).

[0086] (1) Terminal

[0087] The terminal can be a device that accesses the above communication system and has wireless transceiver functions. The terminal can also be called user equipment (UE), terminal equipment, user device, access terminal, user unit, user station, mobile station, mobile station (MS), remote station, remote terminal, mobile device, user terminal, terminal unit, terminal station, terminal device, wireless communication equipment, user agent or user device.

[0088] For example, the terminal in the embodiment of the present application can be a mobile phone, a personal digital assistant (PDA), a laptop computer, a tablet computer (Pad), a drone, a computer with wireless transceiver function, a machine type communication (MTC) terminal, a virtual reality (VR) terminal, an augmented reality (AR) terminal, an Internet of Things (IoT) terminal, a wireless terminal in industrial control, a wireless terminal in self driving, a wireless terminal in remote medical, a wireless terminal in smart grid, a wireless terminal in transportation safety, a wireless terminal in a smart city, a wireless terminal in a smart home (such as a game console, a smart TV, a smart speaker, a smart refrigerator, and fitness equipment, etc.), a vehicle-mounted terminal, and an RSU with terminal function.

[0089] (2) Network equipment

[0090] The network device is a device located at the network side of the above communication system and has wireless transceiver functions.

[0091] For example, the network device in the embodiment of the present application can be an access point (AP) in a Wi-Fi system, such as a home gateway, a router, a server, a switch, a bridge, etc., a base station, an evolved Node B (eNB), a radio network controller (RNC), a base station controller (BSC), a base transceiver station (BTS), a home base station, a baseband unit (BBU), a wireless relay node, a wireless backhaul node, a transmission point (TRP; or TP), etc., and can also be a next-generation base station (next generation NodeB, gNB) in a 5G system, or a network node constituting a gNB, such as a centralized unit (CU), a distributed unit (DU), a road side unit (RSU) with a base station function, etc., or can also be a satellite or various future forms of base stations.

[0092] (3) Communication between terminals and network devices

[0093] The communication between the terminal and the network device follows a certain protocol layer structure. For example, the control plane protocol layer structure may include the RRC layer, the packet data convergence protocol (PDCP) layer, the radio link control (RLC) layer, the media access control (MAC) layer and the physical layer (PHY); the user plane protocol layer structure may include the PDCP layer, the RLC layer, the MAC layer and the physical layer. In a possible implementation, the service data adaptation protocol (SDAP) layer may also be included above the PDCP layer. Among them, the SDAP layer, the PDCP layer, the RLC layer, the MAC layer and the physical layer may also be collectively referred to as the access layer. For a detailed description of each of the above protocol layers, please refer to the relevant technical specifications of the 3rd Generation Partnership Project (3GPP).

[0094] Taking downlink data transmission as an example, downlink data can be encapsulated in each layer of the network device. The data received by a layer from the upper layer of the layer is regarded as the service data unit (SDU) of the layer. After layer encapsulation, it becomes a protocol data unit (PDU) and is passed to the next layer. For example, the data received by the PDCP layer entity from the SDAP layer can be called PDCP SDU. After the PDCP layer entity encapsulates the PDCP SDU, it obtains the PDCP PDU and sends it to the RLC layer; the PDCP PDU received by the RLC layer entity from the PDCP layer can be called RLC SDU. After the RLC layer entity encapsulates the RLC SDU, it obtains the RLC PDU and sends it to the MAC layer.

[0095] From the perspective of the terminal, after the physical layer of the terminal receives the transmission block from the network device, it can be delivered from the physical layer to the upper layer in sequence, and the corresponding decapsulation can be performed in each layer. In other words, the processing performed by each layer in the terminal can be the reverse process of the processing performed by each layer in the network device.

[0096] (4) CU-DU separation architecture

[0097] For example, in some possible network structures, the network device may include one or more centralized units (CU) and / or one or more distributed units (DU), and multiple DUs may be centrally controlled by one CU, and this architecture may be referred to as a CU-DU separation architecture. As an example, the interface between the CU and the DU may be referred to as an F1 interface, wherein the control plane (CP) interface may be an F1-C interface, and the user plane (UP) interface may be an F1-U interface.

[0098] The processing functions of CU and DU can be divided according to the protocol layer of the wireless network: for example Figure 2A As shown, the functions of the PDCP layer and the protocol layers above are set in the CU, and the functions of the protocol layers below the PDCP layer (such as the RLC layer and the MAC layer, etc.) are set in the DU. It can be understood that the above-mentioned division of the processing functions of the CU and DU according to the protocol layer is only an example, and can also be divided in other ways, such as the functions of the protocol layers above the RLC layer are set in the CU, and the functions of the protocol layers below the RLC layer are set in the DU. For example, the CU or DU can be divided into functions with more protocol layers, and for example, the CU or DU can also be divided into partial processing functions with protocol layers. The embodiments of the present application are not limited to this.

[0099] Furthermore, the functions of CU can be implemented by one entity, or by different entities. For example, the functions of CU can be further divided, that is, the control plane and the user plane are separated and implemented through different entities, namely the control plane CU entity (i.e., CU-CP entity) and the user plane CU entity (i.e., CU-UP entity). The CU-CP entity and the CU-UP entity can be coupled with the DU to jointly complete the functions of the RAN device. The interface between the CU-CP entity and the CU-UP entity can be an E1 interface, the interface between the CU-CP entity and the DU can be an F1-C interface, and the interface between the CU-UP entity and the DU can be an F1-U interface. Among them, a DU and a CU-UP can be connected to a CU-CP. Under the control of the same CU-CP, a DU can be connected to multiple CU-UPs, a CU-UP can be connected to multiple DUs, and under the collaboration of multiple CU-CPs, a CU-UP can also be connected to multiple collaborative CU-CPs, thereby improving the elasticity of the CU-CP. Figure 2B Figure 1 is a schematic diagram of the air interface protocol stack distribution. Figure 2B As shown, for both the user plane and the control plane, the air interface protocol stack can be RLC, MAC, PHY in DU, and PDCP and above protocol layers in CU.

[0100] It is understandable that in the above Figure 2A and Figure 2B In the illustrated architecture, the signaling generated by the CU can be sent to the terminal through the DU, or the signaling generated by the terminal can be sent to the CU through the DU. The DU may not parse the signaling but directly encapsulate it through the protocol layer and transparently transmit it to the terminal or CU. In the following embodiments, if the transmission of such signaling between the DU and the terminal is involved, then the sending or receiving of the signaling by the DU includes this scenario. For example, the signaling of the RRC or PDCP layer will eventually be processed into physical layer data and sent to the terminal, or converted from the received physical layer data. Under this architecture, the signaling of the RRC layer or PDCP layer can also be considered to be sent by the DU, or by the DU and the radio frequency device.

[0101] The communication system and business scenarios described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application, and do not constitute a limitation on the technical solutions provided in the embodiments of the present application. A person of ordinary skill in the art can appreciate that with the evolution of network architecture and the emergence of new business scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0102] The relevant technical features involved in the embodiments of the present application are first explained below. These explanations are intended to make the embodiments of the present application easier to understand and should not be regarded as limiting the scope of protection claimed for the present application.

[0103] 1. Cell switching

[0104] Cell handover can be divided into two types, one of which is cell handover based on layer 1 / layer 2 (L1 / L2), which can be called L1 / L2 handover or L1 / L2 triggered mobility (L1 / L2 triggered mobility, LTM), and the other is cell handover based on layer 3 (L3), which can be called L3 handover (L3 handover). Among them, L1 refers to the physical layer, L2 refers to any one or more layers of the MAC layer, RLC layer, PDCP layer, and SDAP layer, and L3 refers to the RRC layer. It can be understood that L1 / L2 handover can also be understood as L1 and / or L2 handover; when it is an "and" relationship, the operations related to the handover process are mainly completed by L1 and L2; when it is an "or" relationship, the operations related to the handover process are mainly completed by L1 or L2. Since L1 and L2 are located at a lower level of the protocol stack than the RRC layer (L3), L1 / L2 handover can also be called low-layer handover, or bottom layer handover, or lower layer handover.

[0105] For L3 switching, in the CU-DU separation architecture, the CU receives the measurement results of the terminal (the measurement results are sent to the CU via the DU), and determines whether to initiate switching based on the measurement results. If it is determined to initiate switching, the switching command is sent to the DU, and the DU sends it to the terminal. Since this process involves communication interaction between the CU and DU (i.e., interaction of the F1 interface), and the maximum transmission delay of the F1 interface is about 3ms to 10ms, it will cause a certain switching delay.

[0106] The switching decision of L1 / L2 switching is delegated from CU to DU. That is, DU determines whether to initiate switching (LTM cell switch) based on the measurement results of the terminal and sends the switching command directly to the terminal, which can effectively reduce F1 interaction and reduce switching latency.

[0107] 2. Cell switching scenarios

[0108] As mentioned above, the network device includes one or more CUs and one or more DUs. For example, the network device includes a CU and multiple DUs, the multiple DUs are centrally controlled by a CU, and each of the multiple DUs includes one or more cells. It can be understood that "DU includes one or more cells" can also be described as "DU manages or controls one or more cells", or "one or more cells of DU", or "one or more cells belong to DU".

[0109] In LTM, the terminal can move from one gNB-DU (also referred to as "source gNB-DU" in the following embodiments) to another gNB-DU (also referred to as "candidate gNB-DU" in the following embodiments) in the same gNB-CU, which can also be understood as cell switching under the same base station, that is, intra-gNB LTM. For example, Figure 3 A flow chart corresponding to a communication method is shown in FIG. Figure 3 As shown, the method includes:

[0110] S301A. The terminal sends a measurement report message to the source gNB-DU.

[0111] The measurement report message may include L3 measurement results, and specifically may include neighboring cell measurement results. A neighboring cell refers to a cell to which a terminal may switch after moving.

[0112] S301B. The source gNB-DU sends an uplink (UL) RRC message to the gNB-CU, wherein the UL RRC message includes a measurement report message.

[0113] S302. The gNB-CU decides to initiate LTM configuration based on the measurement results of the neighboring cells.

[0114] S303. The gNB-CU sends a UE context establishment request message to the candidate gNB-DU.

[0115] The UE context establishment request message may include the ID of the first candidate cell. It is understandable that the gNB-CU also indicates the identity (ID) of the source gNB-DU, which is used to request the candidate gNB-DU to provide physical random access channel (PRACH) resources for the source gNB-DU.

[0116] S304. If the candidate gNB-DU accepts the request for LTM configuration, it sends a UE context establishment response message to the gNB-CU.

[0117] Among them, the UE context establishment response message includes at least one of the following information: the lower layer RRC configuration corresponding to the first candidate cell, the transmission configuration indicator (TCI) state configuration, the random access channel (RACH) resource configuration and the reference signal (RS) configuration.

[0118] S305. The gNB-CU sends a UE context modification request message to the source gNB-DU.

[0119] The UE context modification request message includes: RS configuration of the first candidate cell, TCI state configuration of the first candidate cell and RACH resource configuration of the first candidate cell.

[0120] S306. The source gNB-DU sends a UE context modification response message to the gNB-CU.

[0121] The UE context modification response message may include: channel state information (CSI) resource configuration of the source cell, which is used to send the lower layer measurement result of the first candidate cell in the source cell.

[0122] S307. The gNB-CU sends a UE context modification request message to one or more candidate gNB-DUs.

[0123] The UE context modification request message may include: a cell ID of a source cell, and an RS configuration of the source cell. It should be noted that the candidate cells include the source cell.

[0124] S308. The candidate gNB-DU sends a UE context modification response message to the gNB-CU.

[0125] The UE context modification response message may include: a generated CSI resource configuration, which is used to send the CSI of the candidate cell on the first candidate cell.

[0126] S309. gNB-CU sends a downlink (DL) RRC message to the source gNB-DU.

[0127] The DL RRC message may include: an RRC reconfiguration message including an LTM configuration (eg, a lower layer RRC configuration corresponding to the first candidate cell).

[0128] S310. The source gNB-DU sends the received RRC reconfiguration message to the terminal.

[0129] S311. The terminal sends an RRC reconfiguration completion message to the source gNB-DU.

[0130] S312. The source gNB-DU sends the RRC reconfiguration completion message to the gNB-CU via a UL RRC message.

[0131] S313. According to the random access resource configuration of the first candidate cell, the terminal and the candidate gNB-DU perform early synchronization on the first candidate cell. Early synchronization includes early uplink synchronization or downlink synchronization.

[0132] S314. The candidate gNB-DU sends the timing advance (TA) and associated non-contention free random access (CFRA) resource information of the first candidate cell to the source gNB-DU through the gNB-CU.

[0133] Among them, S313 and S314 are optional steps and may not be executed.

[0134] S315. The terminal sends the lower layer measurement result to the source gNB-DU. The terminal measures the RS according to the RS configuration, and then sends the measurement result to the source gNB-DU according to the CSI resource configuration.

[0135] S316. The source gNB-DU decides to perform LTM on the candidate cell.

[0136] S317. The source gNB-DU sends an LTM command to the terminal.

[0137] The LTM command includes the identifier of the target cell, which is used to indicate the first candidate cell as the target cell for switching. The LTM command may also include beam information of the target cell (for example, TCI state identifier) ​​and timing advance information of the target cell, which is used for the terminal device to receive downlink control information in a random access-free manner.

[0138] S318. The source gNB-DU sends an LTM cell change notification message to the gNB-CU to indicate that an LTM command has been initiated to the terminal.

[0139] The LTM cell change notification message may include the target cell ID and the beam information. It can be understood that the target cell is a candidate cell in the above steps.

[0140] S319. gNB-CU sends the target cell ID and the beam information to the target gNB-DU.

[0141] It can be understood that the target gNB-DU is one of the candidate gNB-DUs in the aforementioned steps, that is, the gNB-DU corresponding to the target cell.

[0142] S320. The target gNB-DU detects terminal access.

[0143] For example, the terminal device accesses the target gNB-DU through random access or random access-free mode. If it is the random access-free mode, the target gNB-DU sends downlink control information to the terminal device based on the beam information. The random access-free mode is that the terminal device accesses the target cell through the physical uplink shared channel (PUSCH) according to the timing advance information in the LTM command, instead of accessing the target cell through the physical random access channel (PRACH).

[0144] S321. After detecting the access of the terminal device, the target gNB-DU sends a successful access message to the gNB-CU.

[0145] S322. gNB-CU sends a UE context release command message to the source gNB-DU.

[0146] Among them, the UE context release command message is used to release the resources of the candidate cell of the source gNB-DU.

[0147] S323. The source gNB-DU replies with a UE context release completion message to the gNB-CU.

[0148] 3. Key (also called "secret key") deduction

[0149] For secure transmission between the terminal and the base station, a security key is used to protect the data. In addition, the terminal uses different security keys to communicate with different base stations. Currently, the security key is determined based on {next hop parameter (NH), next hop chaining counter (NCC)}; NCC corresponds to NH, so NCC is used to identify NH; NH is used to determine the security key. For example, Figure 4 A schematic diagram of key deduction.

[0150] In Xn mobility (also known as mobility in 5G networks), if the source gNB has unused {NH, NCC} pairs, vertical key derivation shall be performed. If vertical key derivation is performed, the security key is determined based on the NH. Specifically, the source gNB shall determine K based on the unused NH, the physical cell identify (PCI) of the target cell, and the downlink frequency of the target cell. NG-RAN* , so as to realize the security protection of communication data by using unused {NH, NCC}.

[0151] If the source gNB has no unused {NH, NCC} pair, horizontal key derivation shall be performed. If horizontal key derivation is performed, the key derivation is based on the K used by the source gNB. gNB Determine the security key. Specifically, the source gNB determines K based on the NH currently used by the source gNB, the PCI of the target cell, and the downlink frequency of the target cell. NG-RAN* , in order to achieve the security protection of communication data by using {NH, NCC}.

[0152] Then, the source gNB determines {K NG-RAN* , NCC} is sent to the target gNB.

[0153] The target gNB uses the received {K NG-RAN* , K in NCC} NG-RAN* , as the security key (K gNB ). And, the target gNB then calculates the gNB Determine the security key (K) for data transmission up or K rrc ), using (K up or K rrc ) performs security protection on the data. And, the target gNB includes the NCC in a handover command, and returns the handover command to the source gNB, which is sent to the terminal by the source gNB.

[0154] When an access layer (AS) security context needs to be established between the terminal and the gNB, the terminal determines K based on the NCC. gNB and NH. Exemplary, K gNB and NH come from AMF. Among them, NCC and K gNB and NH value, and K gNB Associated with the NCC corresponding to the NH value from which it was derived.

[0155] After the terminal accesses the target gNB, the terminal gNB Determine the security key (K) for data transmission up or K rrc ), using the security key (K up or K rrc ) to protect data security. For example, the terminal uses a security key (K up or K rrc ) encrypts the data and sends the encrypted data to the target gNB; and the terminal receives the data from the target gNB using the security key (K up or K rrc ) to decrypt the data. Correspondingly, the target gNB uses the security key (K up or K rrc) encrypts the data and sends the encrypted data to the terminal; and the target gNB receives the data from the terminal and uses the security key (K up or K rrc ) to decrypt the data.

[0156] According to the description of the above-mentioned related technical features, after determining the target base station, the source base station derives the key for the target base station. However, the existing communication system does not take into account the inter-base station handover in LTM, and inter-gNB LTM has security risks.

[0157] In view of this, an embodiment of the present application provides a communication method for implementing key processing of inter-gNB LTM, thereby achieving security protection of inter-gNB LTM.

[0158] The communication method provided in the embodiment of the present application is described in detail below in combination with Example 1 to Example 4. Among them, the communication method provided in the embodiment of the present application involves communication between multiple network devices (such as a first access network device, a second access network device, and a core network device) and a terminal. Unless otherwise specified, "terminal" may refer to the terminal itself or to a component in the terminal, such as a chip or a chip system; "network device" may refer to the network device itself or to a component in the network device, such as a chip or a chip system. The following description will be taken as an example of "the first access network device is the source base station, the second access network device is the candidate base station, and the core network device is the AMF".

[0159] Embodiment 1

[0160] Figure 5A This is a flow chart corresponding to the communication method provided in Example 1 of the present application, such as Figure 5A As shown, the method includes:

[0161] S501: The terminal sends an L3 measurement report to a source base station.

[0162] The L3 measurement report includes measurement results of one or more neighboring cells, and the one or more neighboring cells belong to at least one candidate base station.

[0163] It can be understood that at this time, the terminal transmits data with the source base station, and the data is transmitted using the first security key (for example, the first K gNB ) for security protection. The key information used by the source base station is {first NCC, first NH}. Figure 4 The key derivation content introduced in the present invention, the terminal and the source base station use the first NH, the first PCI and the first downlink frequency corresponding to the first NCC as parameter inputs to determine the first K gNB; Wherein, the first PCI is the PCI of the source cell, and the first downlink frequency is the downlink frequency of the source cell. The source cell is the cell where the terminal accesses the source base station.

[0164] In the embodiment of the present application, one candidate base station will be taken as an example, and other candidate base stations will be processed accordingly.

[0165] S502: The source base station decides to perform LTM configuration.

[0166] Exemplarily, the source base station determines multiple cells under the candidate base station as candidate cells; wherein the PCIs corresponding to different candidate cells are different, and the downlink frequencies corresponding to different candidate cells may be the same or may be different.

[0167] In the embodiment of the present application, the first candidate cell and the second candidate cell are taken as examples, and other candidate cells are processed with reference to the second candidate cell. The first candidate cell and the second candidate cell are two different cells, belonging to the candidate base station. The processing of the first candidate cell and the second candidate cell is respectively introduced below.

[0168] First candidate cell

[0169] S503: The source base station sends a first switching request message to the candidate base station.

[0170] The first handover request message includes: an identifier of the first candidate cell; an LTM configuration request. The identifier of the first candidate cell is used to indicate a request for LTM configuration of the first candidate cell or a request for a cell as a candidate cell; and the LTM configuration request is used to request LTM configuration. For the specific content of the first handover request message, see the aforementioned Figure 3 UE context establishment request message in.

[0171] S504: The candidate base station sends a key request message to the AMF according to the received first switching request message.

[0172] Optionally, when the source base station does not indicate a cell for key derivation, the candidate base station determines the first candidate cell as the cell for key derivation. For example, the candidate base station randomly selects the first candidate cell from multiple candidate cells.

[0173] Alternatively, the candidate base station determines the first candidate cell as the cell for key derivation according to the instruction of the source base station. Exemplarily, the source base station indicates through the first handover request message in S503. For example, the first handover request message also includes: first indication information; wherein the first indication information is used to indicate the first candidate cell as the cell for key derivation. Based on this, the candidate base station determines the first candidate cell as the cell for key derivation according to the first indication information in the first handover request message.

[0174] Exemplarily, the candidate base station sends a key request message to the AMF based on the determined first candidate cell, wherein the key request message is used to allocate corresponding key information to the first candidate cell.

[0175] S505, AMF sends key information to the candidate base station according to the key request message.

[0176] Exemplarily, the key information includes: a second NCC and a second NH. It can be understood that the second NCC corresponds to the second NH, and the second NCC is used to identify the second NH. The second NH is used by the candidate base station and the terminal to perform key derivation to obtain a second security key (for example, the second K gNB ). Second K gNB Used to provide security protection for data between the terminal and the candidate base station.

[0177] S506: The candidate base station sends a first handover request confirmation message to the source base station according to the key information. Figure 3 After receiving the key information from the AMF, the candidate base station sends a first handover request confirmation message to the source base station.

[0178] Optionally, when the source base station does not indicate a cell for key derivation, the candidate base station determines the first candidate cell as the cell for key derivation, and the candidate base station indicates it to the source base station through a first handover request confirmation message. At this time, the first handover request confirmation message includes: second indication information or a second NCC; configuration of the candidate cell. The second indication information is used to indicate the first candidate cell as the cell for key derivation by the candidate base station.

[0179] Alternatively, when the candidate base station determines the first candidate cell as the cell for key derivation according to the instruction of the source base station, the first handover request confirmation message includes: the second NCC; the configuration of the candidate cell. It can be understood that in this scenario, the first handover request confirmation message does not need to include the second indication information.

[0180] Second candidate cell

[0181] S507: The source base station sends a second handover request message to the candidate base station.

[0182] The second handover request message includes: the identifier of the second candidate cell; the LTM configuration request. The identifier of the first candidate cell is used to indicate the request for LTM configuration of the second candidate cell or to request a cell as a candidate cell; the LTM configuration request is used to request LTM configuration. For the specific content of the first handover request message, see the aforementioned Figure 3 UE context establishment request message in.

[0183] S508: The candidate base station sends a second handover request confirmation message to the source base station.

[0184] The second switching request confirmation message includes: third indication information. The third indication information includes multiple forms, as follows:

[0185] (1-1), the third indication information is used to indicate that the second candidate cell and the first candidate cell use the same NCC, that is, the second NCC and the second NH. Exemplarily, the third indication information includes an identifier of the first candidate cell.

[0186] (1-2), the third indication information is used to indicate the second NCC corresponding to the second candidate cell; wherein the second NCC corresponding to the second candidate cell is the same as the second NCC corresponding to the first candidate cell.

[0187] It can be understood that at this time, the candidate base station does not need to send a key request to the AMF, and the AMF does not need to send key information to the candidate base station.

[0188] The source base station may determine at least the following contents according to the first handover request confirmation message and the second handover request confirmation message from the candidate base station:

[0189] (2-1) The first candidate cell and the second candidate cell of the candidate base station accept the handover request. Based on this, the source base station determines a first list; the first list is the candidate cells for which the candidate base station accepts the handover request.

[0190] (2-2) The second candidate cell and the first candidate cell use the same NCC. It can also be understood that the first list corresponds to the same NCC, that is, the first list corresponds to the second NCC.

[0191] (2-3) The source base station determines the first candidate cell as the cell for key derivation.

[0192] Based on the above determination, the source base station instructs the terminal to reconfigure, which is implemented through the following S509 and S510:

[0193] S509: The source base station sends an RRC reconfiguration message to the terminal. The RRC reconfiguration message includes at least the following information:

[0194] (3-1), a first list, the list including the identifier of the first candidate cell and the identifier of the second candidate cell. It should be noted that the first list may include only the identifier of one candidate cell, that is, the identifier of the first candidate cell, or may include identifiers of multiple candidate cells, wherein the multiple candidate cells include the first candidate cell.

[0195] (3-2), second NCC. The second NCC is used to identify the second NH, which can be understood as the second NH being one of the input parameters for key derivation of the first list. The second NCC corresponds to the first list.

[0196] (3-3), the cell corresponding to the first list for key deduction, that is, the first candidate cell in the above step, can be understood as the PCI and downlink frequency of the first candidate cell as the input parameters for key deduction of the first list. Among them, the cells in the first list all use the same security key. The specific deduction method is shown in the above Figure 4 Introduction.

[0197] Exemplarily, the RRC reconfiguration message includes different fields, and the different fields can be used to indicate the above information respectively.

[0198] For example, Figure 5B A schematic diagram of a list provided in Example 1 of the present application. Figure 5B 1 and 2 are shown in FIG. Candidate base station 1 corresponds to list 1. List 1 includes the identifier of candidate cell 1 and the identifier of candidate cell 2, indicating that candidate cell 1 and candidate cell 2 of the candidate base station accept the handover request of the source base station. List 1 corresponds to NCC1, indicating that candidate cell 1 and candidate cell 2 both correspond to NCC1. The cell for key derivation corresponding to list 1 is candidate cell 1.

[0199] List 2 corresponding to candidate base station 2. List 2 includes the identifier of candidate cell 3 and the identifier of candidate cell 4, indicating that candidate cell 3 and candidate cell 4 of the candidate base station accept the handover request of the source base station. List 2 corresponds to NCC2, indicating that candidate cell 3 and candidate cell 4 both correspond to NCC2. The cell for key deduction corresponding to List 2 is candidate cell 3.

[0200] S510: After completing reconfiguration according to the RRC reconfiguration message, the terminal sends an RRC reconfiguration completion message to the source base station.

[0201] After the terminal reconfiguration is completed, the source base station instructs the terminal to perform cell switching according to the measurement report from the terminal. In the following embodiments, the terminal switches from the source cell to the second candidate cell as an example, and the processing flow of switching to the first candidate cell can refer to the processing flow of the second candidate cell.

[0202] S511, the terminal sends a measurement report of the second candidate cell to the source base station, wherein the measurement report is used to indicate the signal quality of the second candidate cell.

[0203] The source base station determines the candidate cell for the terminal to switch based on the measurement report of the candidate cell sent by the terminal. It can be understood that when the candidate cell is used as the cell for the terminal to switch, the candidate cell is the target cell, and the base station corresponding to the target cell is the target base station.

[0204] S512, the terminal receives the LTM cell switching command sent by the source base station. The LTM cell switching command is used to instruct switching to the second candidate cell. That is, the second candidate cell is used as the target cell for the terminal to switch. The specific content of the LTM cell switching command is as described above. Figure 3 The LTM command.

[0205] S513, the terminal deduce the second K gNB .

[0206] Exemplarily, the terminal derives the second K according to the second NH corresponding to the second NCC, the PCI of the first candidate cell, and the downlink frequency of the first candidate cell. gNB For the specific deduction process, see Figure 4 Introduced key deduction content.

[0207] S514, based on the second K gNB , and securely protect the data between the terminal and the target base station. Exemplarily, on the second candidate cell (also known as the "target cell"), data is sent to the candidate base station (also known as the "target base station"), or data from the target base station is received. The data is based on the second K gNB For security protection.

[0208] In addition, the candidate base station refers to the processing of the terminal introduced in S513 and S514 to deduce the second K gNB For the detailed deduction process, see Figure 4 Introduced key deduction content.

[0209] It should be noted that, since the security keys corresponding to the first candidate cell and the second candidate cell are both derived based on the key information of the first candidate cell, when the terminal subsequently switches from the second candidate cell to the first candidate cell, the security key used between the terminal and the candidate base station is not updated.

[0210] Through the content introduced in Example 1, in inter-gNB LTM, the candidate base station maintains its own key information to avoid security issues.

[0211] Embodiment 2

[0212] Figure 6 This is a flow chart corresponding to the communication method provided in Example 2 of the present application, such as Figure 6 As shown, the method includes:

[0213] S601: The terminal sends an L3 measurement report to a source base station.

[0214] The L3 measurement report includes measurement results of one or more neighboring cells, and the one or more neighboring cells belong to at least one candidate base station.

[0215] It can be understood that at this time, the terminal transmits data with the source base station, and the data is protected by the first security key (for example, the first KgNB). The key information used by the source base station is {first NCC, first NH}. Figure 4 In the key derivation content introduced, the terminal and the source base station use the first NH, the first PCI and the first downlink frequency corresponding to the first NCC as parameter input to determine the first KgNB; wherein the first PCI is the PCI of the source cell, and the first downlink frequency is the downlink frequency of the source cell. The source cell is the cell where the terminal accesses the source base station.

[0216] In the embodiment of the present application, one candidate base station will be taken as an example, and other candidate base stations will be processed accordingly.

[0217] S602: The source base station decides to perform LTM configuration.

[0218] At this point, the source base station performs the following steps:

[0219] S602-a, the source base station determines multiple cells under the candidate base station as candidate cells; wherein the PCIs corresponding to different candidate cells are different, and the downlink frequencies corresponding to different candidate cells may be the same or may be different.

[0220] In the embodiment of the present application, the first candidate cell and the second candidate cell are taken as examples, and other candidate cells are processed with reference to the second candidate cell. The first candidate cell and the second candidate cell are two different cells and belong to candidate base stations.

[0221] Wherein, based on the fact that the first candidate cell and the second candidate cell belong to the same candidate base station, the first candidate cell and the second candidate cell correspond to the same key information, that is, the key information corresponding to the candidate base station, such as the second NCC and the second NH. It can also be understood that the second candidate cell uses the security key corresponding to the first candidate cell.

[0222] S602-b, from the first candidate cell and the second candidate cell, determine the first candidate cell as the cell for key derivation. And, use the key information corresponding to the candidate base station, the PCI of the first candidate cell and the downlink frequency of the first candidate cell as input parameters for key derivation to derive a key for the candidate base station. Among them, the key information corresponding to the candidate base station includes at least the following two determination methods:

[0223] Determination method 1: The source base station uses the key information (such as the first NCC and the first NH) used by the source cell as the key information corresponding to the candidate base station.

[0224] Exemplarily, the source base station derives a security key (for example, a second K corresponding to the first candidate cell) based on the first NH corresponding to the first NCC, the PCI of the first candidate cell, and the downlink frequency of the first candidate cell. gNB ). Among them, the first NH is the NH used by the source cell.

[0225] Determination method 2: the source base station obtains the key information corresponding to the candidate base station from the AMF. Exemplarily, the source base station obtains the key information corresponding to the candidate base station from the AMF through the following S602-c1 and S602-c2.

[0226] S602-c1, the source base station sends a key request message to the AMF, wherein the key request message is used to request key information corresponding to the candidate base station.

[0227] S602-c2, AMF sends key information to the source base station.

[0228] For example, the key information includes: a second NCC and a second NH; wherein the second NCC is used to identify the second NH. Exemplarily, the source base station obtains the security key corresponding to the first candidate cell (for example, the second K gNB ').

[0229] For another example, the key information includes the second NCC and the first extended NCC (first H-NCC), and the second NH; wherein the first H-NCC is used to jointly identify the second NH with the second NCC. Exemplarily, the source base station obtains the security key corresponding to the first candidate cell (for example, the second K gNB ').

[0230] It is understandable that when the key information sent by the AMF includes the H-NCC, the key information used in the subsequent process is the second NCC and the first H-NCC. It is also understandable that when the key information sent by the AMF does not include the H-NCC, the key information used in the subsequent process is the second NCC.

[0231] The following describes the processing of the first candidate cell and the second candidate cell by the source base station respectively.

[0232] First candidate cell

[0233] S603: The source base station sends a first handover request message to the candidate base station according to the process of S602.

[0234] The first handover request message includes: the identifier of the first candidate cell; the LTM configuration request; the key information corresponding to the first candidate cell. The identifier of the first candidate cell is used to indicate the request for LTM configuration of the first candidate cell; the LTM configuration request is used to request LTM configuration; the key information corresponding to the first candidate cell is used to indicate NCC and security keys. For the specific content of the first handover request message, please refer to the above Figure 3 UE context establishment request message in.

[0235] Based on S602, the key information corresponding to the first candidate cell includes multiple forms, as follows:

[0236] (4-1), including the first NCC and the second K gNB .

[0237] (4-2), including the second NCC and the second K gNB '.

[0238] (4-3), including the second NCC, the first H-NCC and the second K gNB '.

[0239] S604: The candidate base station sends a first handover request confirmation message to the source base station in response to the first handover request message.

[0240] The first handover request confirmation message includes the configuration of the candidate cell. Figure 3 UE context establishment response message in.

[0241] In addition, the candidate base station carries the NCC in the first handover request message; for example, the first handover request confirmation message also includes: the first NCC, or the second NCC, or the second NCC and the first H-NCC. Alternatively, the candidate base station carries the NCC in the configuration of the candidate cell; for example, the configuration of the candidate cell includes: the first NCC, or the second NCC, or the second NCC and the first H-NCC.

[0242] Second candidate cell

[0243] S605: The source base station sends a second handover request message to the candidate base station according to the process of S602.

[0244] The second handover request message includes: an identifier of the second candidate cell; and an LTM configuration request. The identifier of the second candidate cell is used to indicate a request for LTM configuration of the second candidate cell; and the LTM configuration request is used to request LTM configuration. For details of the second handover request message, see the aforementioned Figure 3 Based on the first candidate cell being the cell from which the source base station derives the key for the candidate base station, the second handover request message does not include the key information.

[0245] S606: The candidate base station sends a second handover request confirmation message to the source base station.

[0246] At this time, the candidate base station determines from the second handover request message that the second candidate cell uses the security key of the first candidate cell (for example, the second K gNB or the second K gNB '). Based on this, the second handover request confirmation message includes: fourth indication information. The fourth indication information is used to instruct the second candidate cell to use the security key corresponding to the first candidate cell (for example, the second K gNB or the second K gNB ').

[0247] After receiving the first handover request confirmation message and the second handover request confirmation message from the candidate base station, the source base station instructs the terminal to perform reconfiguration based on the LTM configuration performed in S602.

[0248] S607: The source base station sends an RRC reconfiguration message to the terminal. The RRC reconfiguration message includes at least the following information:

[0249] (5-1), a first list, the list including the identifier of the first candidate cell and the identifier of the second candidate cell. The first list is determined by the source base station in S602.

[0250] It should be noted that the first list may include only one candidate cell identifier, that is, the identifier of the first candidate cell, or may include identifiers of multiple candidate cells, where the multiple candidate cells include the first candidate cell.

[0251] (5-2), the second NCC (or the second NCC and the first H-NCC) or the first NCC. The first NCC is the NCC corresponding to the source cell. It can be understood that when the source base station does not request key information from the AMF, the first NCC is carried; when the source base station requests key information from the AMF, the second NCC (or the second NCC and the first H-NCC) is carried. The second NCC (or the second NCC and the first H-NCC) or the first NCC corresponds to the first list.

[0252] The first NCC is used to identify the first NH, and the second NCC (or the second NCC and the first H-NCC are used to jointly identify the second NH. It can be understood that the first NH or the second NH is used as one of the input parameters for key derivation of the first list.

[0253] (5-3), the cell corresponding to the first list for key deduction, that is, the first candidate cell in the above step, can be understood as the PCI and downlink frequency of the first candidate cell as the input parameters for key deduction of the first list. Among them, the cells in the first list all use the same security key. The specific deduction method is shown in the above Figure 4 Introduction.

[0254] Exemplarily, the RRC reconfiguration message includes different fields, and the different fields can be used to indicate the above information respectively. Among them, the first list is used to indicate that the first candidate cell and the second candidate cell both use the second NCC (or the second NCC and the first H-NCC) or the first NCC, and the security keys corresponding to the first candidate cell and the second candidate cell both correspond to the first candidate cell.

[0255] S608: After completing reconfiguration according to the RRC reconfiguration message, the terminal sends an RRC reconfiguration completion message to the source base station.

[0256] After the terminal reconfiguration is completed, the source base station instructs the terminal to perform cell switching according to the measurement report from the terminal. In the following embodiments, the terminal switches from the source cell to the second candidate cell as an example, and the processing flow of switching to the first candidate cell or other candidate cells can refer to the processing flow of the second candidate cell.

[0257] S609: The terminal sends a measurement report of the second candidate cell to the source base station, wherein the measurement report is used to indicate the signal quality of the second candidate cell.

[0258] The source base station determines the candidate cell for the terminal to switch based on the measurement report of the candidate cell sent by the terminal. It can be understood that when the candidate cell is used as the cell for the terminal to switch, the candidate cell is the target cell, and the base station corresponding to the target cell is the target base station.

[0259] S610, the terminal receives the LTM cell switching command sent by the source base station. The LTM cell switching command is used to instruct switching to the second candidate cell. That is, the second candidate cell is used as the target cell for the terminal to switch. The specific content of the LTM cell switching command is as described above. Figure 3 The LTM command.

[0260] S611, the terminal deduces the second K gNB .

[0261] Exemplarily, the terminal derives the second K according to the second NH corresponding to the second NCC, the PCI of the first candidate cell, and the downlink frequency of the first candidate cell. gNB '. Or, the terminal derives the second K according to the first NH corresponding to the second NCC and the first H-NCC, the PCI of the first candidate cell, and the downlink frequency of the first candidate cell. gNB '. For the specific deduction process, see Figure 4 Introduced key deduction content.

[0262] In another exemplary embodiment, the terminal derives the second K according to the first NH corresponding to the first NCC, the PCI of the first candidate cell, and the downlink frequency of the first candidate cell. gNB For the detailed deduction process, see Figure 4 Introduced key deduction content.

[0263] S612, based on the second K gNB or the second K gNB ', and securely protect the data between the terminal and the target base station. Exemplarily, on the second candidate cell (also known as the "target cell"), data is sent to the candidate base station (also known as the "target base station"), or data from the target base station is received. The data is based on the second K gNB Or the second KgNB' for security protection.

[0264] S613: After the target base station determines that the cell switching is completed, the target base station sends a path switching request message (eg, path switch request) to the AMF.

[0265] S614, the AMF sends a path switch confirmation message (eg, path switch acknowledgement) to the target base station in response to the path switch request message, wherein the path switch confirmation message includes key information.

[0266] Exemplarily, the key information included in the path switch confirmation message includes: a third NCC; a third NH.

[0267] In another exemplary embodiment, the key information included in the path switch confirmation message includes: a third NCC and a second H-NCC; and a third NH, wherein the second H-NCC is the same as or different from the first H-NCC, and the third NCC is different from the second NCC.

[0268] It can be understood that the key information included in the path switching confirmation message is used to protect the data security after switching from the target base station to the cell of other base stations, and is also used to protect the data security after switching back to the second candidate cell.

[0269] It should be noted that, since the security keys corresponding to the first candidate cell and the second candidate cell are both derived based on the key information of the first candidate cell, when the terminal subsequently switches from the second candidate cell to the first candidate cell, the security key used between the terminal and the candidate base station is not updated.

[0270] Through the content introduced in Example 2, in inter-gNB LTM, the key information is maintained by the source base station, and the key is derived for the candidate base station, thereby avoiding security issues.

[0271] Embodiment 3

[0272] Figure 7 This is a flow chart corresponding to the communication method provided in Example 3 of the present application, such as Figure 7 As shown, the method includes:

[0273] S701, a first access network device (eg, a source base station) sends a first request message to a second access network device (eg, a candidate base station). Correspondingly, the second access network device receives the first request message from the first access network device.

[0274] The first request message is used to request the configuration of the first candidate cell. Figure 3 UE context establishment request message.

[0275] Exemplarily, the first request message includes: an identifier of a first candidate cell and LTM configuration request information; wherein the identifier of the first candidate cell is used to indicate a request for LTM configuration of the first candidate cell or a request for a cell as a candidate cell; and the LTM configuration request information is used to request LTM configuration.

[0276] In another exemplary embodiment, the first request information is also used to request the second access network device to obtain the security key corresponding to the first candidate cell, including key request information.

[0277] It should be noted that the embodiment of the present application does not limit the form of the first request information and the specific information included in the first request information.

[0278] S702, the second access network device obtains the first key information (eg, the second NCC) and the second key information (eg, the second NH) from the core network device (eg, AMF) according to the first request message.

[0279] The second NCC is used to identify the second NH; the second key information NH is used for security protection of data between the terminal and the second access network device. For example, the candidate base station obtains the second K based on the second NH, the PCI of the first candidate cell and the downlink frequency of the first candidate cell.gNB ; Based on the second K gNB The data between the candidate base station and the terminal is securely protected based on K gNB For security protection, see the above Figure 4 Contents of the introduction.

[0280] In an optional embodiment, the second access network device obtains the first key information and the second key information, including the following steps S702A and S702B:

[0281] S702A: The second access network device sends a third request message to the core network device according to the first request message. Correspondingly, the core network device receives the third request message from the second access network device.

[0282] The third request message is used to request key information, including an identifier of the first candidate cell and / or key request information, wherein the key information corresponds to the first candidate cell.

[0283] S702B: The core network device sends the first key information and the second key information to the second access network device in response to the third request message. Correspondingly, the second access network device receives the first key information and the second key information from the core network device.

[0284] S703: The second access network device sends a first response message to the first access network device. Correspondingly, the first access network device receives the first response message from the first access network device.

[0285] Wherein, illustratively, the first response message includes the configuration of the first candidate cell and the first key information (eg, the second NCC). Figure 3 The configuration of the first candidate cell includes at least one of the following information: the lower layer RRC configuration, TCI state configuration, RACH resource configuration and RS configuration corresponding to the first candidate cell. For the specific content of the first response message, see the aforementioned Figure 3 After receiving the first key information and the second key information, the second access network device sends a first response message to the first access network device.

[0286] In another exemplary embodiment, the first response message includes the configuration of the first candidate cell, and the configuration of the first candidate cell also includes the first key information. In this way, when the terminal receives the configuration of the first candidate cell, the terminal can obtain the first key information from the configuration of the first candidate cell, and then the terminal can obtain the security key corresponding to the first candidate cell based on the first key information (for example, the second NCC). For example, the terminal obtains the second K based on the second NH corresponding to the second NCC, the PCI of the first candidate cell, and the downlink frequency of the first candidate cell. gNB ; Use the second K gNB Provide security protection for data between the terminal and the candidate base station.

[0287] S704: The first access network device sends the first list information, the first key information, and the second indication information to the terminal according to the first response message. Correspondingly, the terminal receives the first list information, the first key information, and the second indication information from the first access network device.

[0288] (6-1), the first list is used to indicate at least one cell information, including the identifier of the first candidate cell. It should be noted that the first list may include only one candidate cell identifier, that is, the identifier of the first candidate cell, or may include identifiers of multiple candidate cells, wherein the multiple candidate cells include the first candidate cell. In a possible embodiment, the first list also includes the identifier of the second candidate cell introduced in the subsequent S801.

[0289] (6-2), the first key information. The first key information (such as the second NCC) is used to identify the second key information (such as the second NH), which can be understood as the second NH being one of the input parameters for key derivation of the first list, and the first key information corresponds to the first list.

[0290] (6-3) The second indication information is used to indicate that the input parameters of the key derivation correspond to the first candidate cell. It can be understood that the PCI and downlink frequency of the first candidate cell are used as the input parameters of the key derivation of the first list. The cells in the first list all use the same security key. The specific derivation method is as described above. Figure 4 Introduction.

[0291] Exemplarily, the second indication information includes an identifier of the first candidate cell, and the identifier of the first candidate cell indicates that an input parameter of key derivation corresponds to the first candidate cell.

[0292] In another exemplary manner, the second indication information is used to indicate the first candidate cell as the cell for key derivation in the first list, so as to indicate that the PCI and downlink frequency of the first candidate cell are used as input parameters for key derivation in the first list.

[0293] It should be noted that the embodiment of the present application does not limit the form of the second indication information and the specific information included in the second indication information.

[0294] S705, the first access network device decides to execute LTM on the candidate cell and sends a first handover message to the terminal. Correspondingly, the terminal receives the first handover message from the first access network device.

[0295] The first switching message is used to instruct the terminal device to switch to the target cell. The first switching message is transmitted via a MAC control element (CE). The target cell is the first candidate cell or the second candidate cell introduced in the subsequent S801. It can be understood that the candidate cell to which the terminal device switches is now called the target cell, and the base station corresponding to the target cell is now called the target base station. The specific content of the first switching message is shown in the above Figure 3 The LTM command.

[0296] S706, the terminal accesses the target cell.

[0297] For details on accessing the target cell, see Figure 3 Introduction.

[0298] S707: The terminal communicates with the second access network device in the target cell according to the security key.

[0299] The terminal device derives the security key corresponding to the target cell according to the first key information and the second indication information received in S704. The specific derivation method is described above. It can be understood that the terminal uses the same security key to access the first candidate cell or the second candidate cell.

[0300] In addition, the second access network device also derives the security key corresponding to the target cell according to the first key information and / or the second key information obtained in S702. The specific derivation method is described in the above description. It can be understood that the second access network device uses the same security key when the terminal accesses the first candidate cell or the second candidate cell.

[0301] Through the content introduced in Example 3, the first access network device requests the key information and configuration of the candidate cell from the second access network device, and the second access network device determines the key information by itself. Then, after the first access network device obtains the key information, it sends the key information to the terminal. Therefore, after the LTM is switched to the second access network device, the data security in the inter-gNB LTM is guaranteed.

[0302] In an optional embodiment, before S704, the first access network device further requests the second access network device for configuration of the second candidate cell, including the following steps S801 and S802:

[0303] S801, a first access network device (eg, a source base station) sends a second request message to a second access network device (eg, a candidate base station). Correspondingly, the second access network device receives the second request message from the first access network device.

[0304] The second request message is used to request the configuration of the second candidate cell. Figure 3 UE context establishment request message.

[0305] Exemplarily, the second request message includes: an identifier of the second candidate cell and LTM configuration request information; wherein the identifier of the second candidate cell is used to indicate a request for LTM configuration of the second candidate cell; and the LTM configuration request information is used to request LTM configuration.

[0306] In another exemplary embodiment, the second request information is also used to request the second access network device to obtain the security key corresponding to the second candidate cell, including key request information.

[0307] It should be noted that the embodiment of the present application does not limit the form of the second request information, nor the specific information included in the second request information.

[0308] S802: The second access network device sends the configuration of the second candidate cell and first indication information to the first access network device. Correspondingly, the first access network device receives the configuration of the second candidate cell and the first indication information from the second access network device.

[0309] It can be understood that the second access network device determines that the second candidate cell uses the same key information as the first candidate cell.

[0310] Exemplarily, the first indication information is used to indicate the key information corresponding to the second candidate cell; wherein the key information corresponding to the second candidate cell is the same as the key information corresponding to the first candidate cell. The first indication information can be a direct indication, for example, a newly added parameter, or an implicit indication, for example, the key information parameter is not carried.

[0311] In another exemplary embodiment, the first indication information is used to indicate that the key information corresponding to the second candidate cell is the same as the key information corresponding to the first candidate cell.

[0312] In another exemplary embodiment, the configuration of the second candidate cell also includes the first indication information. In this way, when the first access network device sends the configuration of the second candidate cell to the terminal, the terminal can obtain the first indication information from the configuration of the second candidate cell, and then the terminal can determine that the second candidate cell shares the corresponding security key of the first candidate cell according to the first indication information.

[0313] Through the contents introduced in S801 and S802, the first candidate cell and the second candidate cell use the same key, so that in the scenario of moving within the second network device, there is no need to update the key, thereby reducing the switching delay within the base station.

[0314] Further, based on the fact that the first candidate cell and the second candidate cell use the same key, the second access network device determines the cell for key derivation from the first candidate cell and the second candidate cell, thereby obtaining the key used by the second access network device. The cell for key derivation may be determined by the second access network device itself, or may be indicated by the first access network device to the second access network device, and the specific implementation method is as follows:

[0315] Implementation method 1: The first access network device determines a cell for key derivation, and indicates it to the second access network device through the first request message in S701, and also indicates it to the terminal through S704.

[0316] At this time, the first request message includes information about a third candidate cell, and the information about the third candidate cell is used to obtain or determine a security key corresponding to the first candidate cell; wherein the third candidate cell is the same as or different from the first candidate cell.

[0317] Exemplarily, the first candidate cell is the same as the third candidate cell, and the first access network device requests configuration of the first candidate cell and indicates that a key of the first candidate cell is determined based on the first candidate cell.

[0318] In another exemplary embodiment, the first candidate cell is different from the third candidate cell, and the first access network device requests configuration of the first candidate cell and indicates to determine the key of the first candidate cell based on the third candidate cell.

[0319] In the second implementation method, the second access network device determines the cell for key derivation in response to the first request message, and indicates it to the first access network device through the first response message in S703; then, the first access network device indicates the cell for key derivation to the terminal through S704.

[0320] At this time, the first response message also includes the first key information and information of a third candidate cell corresponding to the first key information, and the information of the third candidate cell is used to obtain or determine the security key corresponding to the first candidate cell; wherein the third candidate cell is the same as or different from the first candidate cell.

[0321] Exemplarily, the first candidate cell is the same as the third candidate cell, and the second access network device sends the configuration of the first candidate cell to the first access network device, and indicates that the key of the first candidate cell is also determined based on the first candidate cell.

[0322] In another exemplary embodiment, the first candidate cell is different from the third candidate cell, and the second access network device sends the configuration of the first candidate cell to the first access network device, and at the same time instructs to determine the key of the first candidate cell based on the third candidate cell.

[0323] Embodiment 4

[0324] Figure 8 This is a flow chart corresponding to the communication method provided in Example 4 of the present application, such as Figure 8 As shown, the method includes:

[0325] S901, a first access network device (eg, a source base station) decides to perform LTM configuration and sends a first request message to a second access network device (eg, a candidate base station). Correspondingly, the second access network device receives the first request message from the first access network device.

[0326] The first request message is used to request the configuration of the first candidate cell, and the first request message is also used to indicate the key information corresponding to the first candidate cell. For example, the first request message includes: the security key corresponding to the first candidate cell and the cell information corresponding to the security key. The cell information corresponding to the security key is used as an input parameter for deducing the security key, for example, the first candidate cell. For the specific content of the first request message, please refer to the aforementioned Figure 3 The first request information also includes key information (such as NCC) for deducing the security key.

[0327] Exemplarily, the first request message includes: an identifier of a first candidate cell and LTM configuration request information; wherein the identifier of the first candidate cell is used to indicate a request for LTM configuration of the first candidate cell or a request for a cell as a candidate cell; and the LTM configuration request information is used to request LTM configuration.

[0328] In S901, the deducing key information (such as NCC) of the security key includes multiple acquisition methods, as follows:

[0329] Acquisition method A: The first access network device uses key information (such as the first NCC) as the key information for deducing the security key. The first NCC is the NCC corresponding to the source cell, which is the key information of the terminal device, and the first NCC is used to identify the first NH.

[0330] Acquisition method B: The first access network device acquires from the core network device. For example, Figure 8 The method further includes the following steps S1001 and S1002A (or S1002B):

[0331] S1001, a first access network device sends a third request message to the core network device (eg, AMF). Correspondingly, the core network device receives the third request message from the first access network device.

[0332] The third request message is used to request key information, including an identifier of the first candidate cell and / or key request information, wherein the key information corresponds to the first candidate cell.

[0333] S1002A, the core network device sends first key information (eg, second NCC) and second key information (eg, second NH) to the first access network device.

[0334] Correspondingly, the first access network device receives the first key information and the second key information from the core network device.

[0335] Alternatively, S1002B, the core network device sends first key information (eg, second NCC), first extended key information (eg, first H-NCC), and second key information (eg, second NH) to the first access network device.

[0336] Correspondingly, the first access network device receives the first key information, the first extended key information and the second key information from the core network device. The first key information and the first extended key information are used to jointly identify the second key information. When the number of candidate base stations is greater than the number of NCCs, it is necessary to additionally introduce extended key information, and identify the second key information through the first key information and the first extended key information to avoid key misalignment.

[0337] S902: The second access network device sends the configuration of the first candidate cell to the first access network device. Correspondingly, the first access network device receives the configuration of the first candidate cell from the second access network device.

[0338] Among them, see the aforementioned Figure 3According to the introduction, the configuration of the first candidate cell includes at least one of the following information: the lower layer RRC configuration, TCI state configuration, RACH resource configuration and RS configuration corresponding to the first candidate cell. The configuration of the first candidate cell also includes the key information corresponding to the first candidate cell. In this way, when the terminal receives the configuration of the first candidate cell, the terminal can obtain the key information from the configuration of the first candidate cell, and then the terminal can obtain the security key corresponding to the first candidate cell based on the key information (for example, the first NCC, or the second NCC, or the second NCC and the first H-NCC). For example, the terminal obtains the second KgNB based on the first NH corresponding to the first NCC (or the second NH corresponding to the second NCC, or the second NH corresponding to the second NCC and the first H-NCC), the PCI of the first candidate cell and the downlink frequency of the first candidate cell; the second KgNB is used to securely protect the data between the terminal and the candidate base station.

[0339] S903: The first access network device sends the first list information, the first key information, and the second indication information to the terminal according to the first response message. Correspondingly, the terminal receives the first list information, the first key information, and the second indication information from the first access network device.

[0340] (7-1), the first list is used to indicate at least one cell information, including the identifier of the first candidate cell. It should be noted that the first list may include only one candidate cell identifier, that is, the identifier of the first candidate cell, or may include multiple candidate cell identifiers, and the multiple candidate cells include the first candidate cell. In a possible embodiment, the first list also includes the identifier of the second candidate cell introduced in the subsequent S1001.

[0341] (7-2), key information corresponding to the first candidate cell. The key information (e.g., the first NCC, or the second NCC, or the second NCC and the first H-NCC) is used to identify the second key information (e.g., the first NH or the second NH), which can be understood as the first NH or the second NH being one of the input parameters for key derivation of the first list, and the key information corresponds to the first list. The first NCC is the NCC used by the first access network device. The second NCC is the NCC obtained by the first access network device from the core network device.

[0342] (7-3) The second indication information is used to indicate that the input parameters of the key derivation correspond to the first candidate cell. It can be understood that the PCI and downlink frequency of the first candidate cell are used as the input parameters of the key derivation of the first list. The cells in the first list all use the same security key. The specific derivation method is described above.

[0343] Exemplarily, the second indication information includes an identifier of the first candidate cell, and the identifier of the first candidate cell indicates that an input parameter of key derivation corresponds to the first candidate cell.

[0344] In another exemplary manner, the second indication information is used to indicate the first candidate cell as the cell for key derivation in the first list, so as to indicate that the PCI and downlink frequency of the first candidate cell are used as input parameters for key derivation in the first list.

[0345] It should be noted that the embodiment of the present application does not limit the form of the second indication information and the specific information included in the second indication information.

[0346] S904, the first access network device decides to execute LTM on the candidate cell and sends a first handover message to the terminal. Correspondingly, the terminal receives the first handover message from the first access network device.

[0347] The first switching message is used to instruct the terminal device to switch to the target cell. The first switching message is transmitted via a MAC control element (CE). The target cell is the first candidate cell or the second candidate cell introduced in the subsequent S1001. It can be understood that the candidate cell to which the terminal device switches is now called the target cell, and the base station corresponding to the target cell is now called the target base station. The specific content of the first switching message is shown in the above Figure 3 The LTM command.

[0348] S905, the terminal accesses the target cell.

[0349] For details on accessing the target cell, see Figure 3 Introduction.

[0350] S906: The terminal communicates with the second access network device in the target cell according to the security key.

[0351] The terminal derives the security key corresponding to the target cell according to the first key information and the second indication information received in S903. The specific derivation method is described above. It can be understood that the terminal uses the same security key to access the first candidate cell or the second candidate cell.

[0352] In addition, the security key used by the second access network device is indicated by the first request message in S901. It can be understood that the second access network device uses the same security key when the terminal accesses the first candidate cell or the second candidate cell.

[0353] Through the content introduced in the fourth embodiment, the first access network device derives the security key of the candidate cell for the second access network device; then, while requesting the configuration of the first candidate cell to the second access network device through the first request message, the first access network device is provided with the key information and the security key. Therefore, after the LTM is switched to the second network device, the data security in the inter-gNB LTM is guaranteed.

[0354] In an optional embodiment, before S903, the first access network device further requests the second access network device for configuration of the second candidate cell, including the following steps S1101 and S1102:

[0355] S1101, a first access network device (eg, a source base station) sends a second request message to a second access network device (eg, a candidate base station). Correspondingly, the second access network device receives the second request message from the first access network device.

[0356] The second request message is used to request the configuration of the second candidate cell or to request a cell as a candidate cell. Figure 3 UE context establishment request message.

[0357] Exemplarily, the second request message includes: an identifier of the second candidate cell and LTM configuration request information; wherein the identifier of the second candidate cell is used to indicate a request for LTM configuration of the second candidate cell; and the LTM configuration request information is used to request LTM configuration.

[0358] It should be noted that the embodiment of the present application does not limit the form of the second request information, nor the specific information included in the second request information.

[0359] S1102: The second access network device sends the configuration of the second candidate cell and first indication information to the first access network device. Correspondingly, the first access network device receives the configuration of the second candidate cell and the first indication information from the second access network device.

[0360] It can be understood that the second access network device determines that the second candidate cell and the first candidate cell use the same security key.

[0361] Exemplarily, the first indication information is used to indicate the key information corresponding to the second candidate cell; wherein the key information corresponding to the second candidate cell is the same as the key information corresponding to the first candidate cell. The first indication information can be a direct indication, for example, a newly added parameter, or an implicit indication, for example, the key information parameter is not carried.

[0362] In another exemplary embodiment, the first indication information is used to indicate that the key information corresponding to the second candidate cell is the same as the key information corresponding to the first candidate cell.

[0363] In another exemplary embodiment, the configuration of the second candidate cell also includes the first indication information. In this way, when the first access network device sends the configuration of the second candidate cell to the terminal, the terminal can obtain the first indication information from the configuration of the second candidate cell, and then the terminal can determine that the second candidate cell shares the corresponding security key of the first candidate cell according to the first indication information.

[0364] Through the contents introduced in S1101 and S1102, the first candidate cell and the second candidate cell use the same key, so that in the scenario of moving within the second network device, there is no need to update the key, thereby reducing the switching delay within the base station.

[0365] On the basis of S905, after the terminal switches to the candidate cell corresponding to the second access network device, the second access network device obtains or determines key information for the candidate access network device of the second access network device (for example, the third access network device) to deduce the security key of the candidate cell corresponding to the third access network device. For example, Figure 8 The method further includes the following steps S1201 and S1202A (or S1202B):

[0366] S1201: The second access network device sends a fourth request message to the core network device. Correspondingly, the core network device receives the fourth request message from the second access network device.

[0367] S1202A, the core network device sends third key information (eg, third NCC) and fourth key information (eg, third NH) to the second access network device. Correspondingly, the second access network device receives the third key information and fourth key information from the core network device.

[0368] The third key information is used to identify the fourth key information, and the fourth key information is used for security protection of data between the terminal and the third access network device.

[0369] Alternatively, S1202B, the core network device sends third key information (e.g., a third NCC), second extended key information (e.g., a second H-NCC), and fourth key information (e.g., a third NH) to the second access network device. Correspondingly, the second access network device receives the third key information, second extended key information (e.g., a second H-NCC), and fourth key information from the core network device.

[0370] The third key information and the second extended key information are used to jointly identify the fourth key information, and the fourth key information is used for security protection of data between the terminal and the third access network device.

[0371] Illustratively, the second H-NCC is the same as or different from the first H-NCC in S1002B.

[0372] In another exemplary embodiment, the third NCC is different from the second NCC and the first NCC in the aforementioned S901.

[0373] The above mainly introduces the solution provided by the embodiment of the present application from the perspective of the interaction between the terminal and the network device. It is understandable that in order to achieve the above functions, the terminal and the network device may include hardware structures and / or software modules corresponding to the execution of each function. It should be easily appreciated by those skilled in the art that, in combination with the units and algorithm steps of each example described in the embodiments disclosed herein, the embodiments of the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of the present application.

[0374] The embodiment of the present application can divide the network device into functional units according to the above method example. For example, each functional unit can be divided according to each function, or two or more functions can be integrated into one unit. The above integrated unit can be implemented in the form of hardware or software functional unit.

[0375] In the case of an integrated unit, Fig. 9 A possible exemplary block diagram of the device involved in the embodiments of the present application is shown. Fig. 9 As shown, the device 900 may include: a processing unit 902 and a communication unit 903. The processing unit 902 is used to control and manage the actions of the device 900. The communication unit 903 is used to support the communication between the device 900 and other devices. Optionally, the communication unit 903 is also called a transceiver unit, and may include a receiving unit and / or a sending unit, which are respectively used to perform receiving and sending operations. The device 900 may also include a storage unit 901 for storing program code and / or data of the device 900.

[0376] (1) The apparatus 900 may be the second access network device in the above embodiment. The processing unit 902 may support the apparatus 900 to execute the actions of the second access network device in the above embodiment 1 or embodiment 3. Alternatively, the processing unit 902 mainly executes the internal actions of the second access network device in the method example, and the communication unit 903 may support the communication between the apparatus 900 and other devices.

[0377] For example, in one embodiment, the communication unit 903 is used to receive a first request message from a first access network device, wherein the first request message is used to request the configuration of a first candidate cell; the processing unit 902 is used to obtain first key information and second key information from a core network device according to the first request message, wherein the first key information is used to identify the second key information, and the second key information is used for security protection of data between a terminal device and the second access network device; wherein the first key information and the second key information correspond to the first candidate cell; the communication unit 903 is used to send a first response message to the first access network device, wherein the first response message includes the configuration of the first candidate cell and the first key information.

[0378] In one possible design, the communication unit 903 is also used to: receive a second request message from the first access network device, the second request message is used to request the configuration of a second candidate cell; send the configuration of the second candidate cell and first indication information to the first access network device, the first indication information is used to indicate the key information corresponding to the second candidate cell; wherein the key information corresponding to the second candidate cell is the same as the key information corresponding to the first candidate cell.

[0379] In one possible design, the first request message includes key request information, and the key request information is used to request the second access network device to obtain the security key corresponding to the first candidate cell.

[0380] In one possible design, the key request information includes information of a third candidate cell, and the information of the third candidate cell is used to obtain a security key corresponding to the first candidate cell; wherein the third candidate cell is the same as or different from the first candidate cell.

[0381] In one possible design, the first response message also includes information of a third candidate cell corresponding to the first key information, and the information of the third candidate cell is used to obtain the security key corresponding to the first candidate cell; wherein the third candidate cell is the same as or different from the first candidate cell.

[0382] In a possible design, the processing unit 902 is also used to deduce the security key corresponding to the first candidate cell based on the second key information, the PCI of the third candidate cell and the downlink frequency of the third candidate cell; the communication unit 903 is also used to receive data from the terminal device and process the data of the terminal device according to the security key corresponding to the first candidate cell.

[0383] In a possible design, the processing unit 902 is used to obtain the first key information and the second key information from the core network device according to the first request message, and is specifically used to: send a third request message to the core network device through the communication unit 903 according to the first request message, and the third request message is used to request the key information corresponding to the first candidate cell; receive the first key information and the second key information from the core network device through the communication unit 903.

[0384] (2) The apparatus 900 may be the first access network device in the above embodiment. The processing unit 902 may support the apparatus 900 in executing the actions of the first access network device in the above embodiment 1 or embodiment 3. Alternatively, the processing unit 902 mainly executes the internal actions of the first access network device in the method example, and the communication unit 903 may support the communication between the apparatus 900 and other devices.

[0385] For example, in one embodiment, the communication unit 903 is used to: send a first request message to a second access network device, wherein the first request message is used to request the configuration of a first candidate cell; receive a first response message from the second access network device, wherein the first response message includes the configuration of the first candidate cell and first key information; wherein the first key information corresponds to the first candidate cell.

[0386] In one possible design, the communication unit 903 is also used to: send a second request message to the second access network device, the second request message is used to request the configuration of the second candidate cell; receive the configuration and first indication information of the second candidate cell from the second access network device, the first indication information is used to indicate the key information corresponding to the second candidate cell; wherein the key information corresponding to the second candidate cell is the same as the key information corresponding to the first candidate cell.

[0387] In one possible design, the first request message includes key request information, and the key request information is used to request the second access network device to obtain the security key corresponding to the first candidate cell.

[0388] In one possible design, the key request information includes information of a third candidate cell, and the information of the third candidate cell is used to obtain a security key corresponding to the first candidate cell; wherein the third candidate cell is the same as or different from the first candidate cell.

[0389] In one possible design, the first response message also includes information of a third candidate cell corresponding to the first key information, and the information of the third candidate cell is used to obtain the security key corresponding to the first candidate cell; wherein the third candidate cell is the same as or different from the first candidate cell.

[0390] In a possible design, the communication unit 903 is also used to: send information of a first list, the first key information, and second indication information to a terminal device; wherein the first list includes identifiers of multiple candidate cells, and the multiple candidate cells include a first candidate cell; the first list corresponds to the first key information; the second indication information is used to indicate that the input parameters of key derivation correspond to the first candidate cell; and send a first switching message to the terminal device, wherein the first switching message is used to indicate that the terminal device switches to a candidate cell in the first list.

[0391] In a possible design, the communication unit 903 is further used to send a second switching message to the second access network device, where the second switching message is used to indicate that a switch has been initiated to a candidate cell in the first list.

[0392] (3) The device 900 may be a terminal in the above embodiment. The processing unit 902 may support the device 900 to execute the actions of the terminal device in the above embodiment 1 or embodiment 3. Alternatively, the processing unit 902 mainly executes the internal actions of the terminal device in the method example, and the communication unit 903 may support the communication between the device 900 and other devices.

[0393] For example, in one embodiment, the communication unit 903 is used to: receive information from a first list, first key information, and second indication information from a first access network device; wherein the first list includes identifiers of multiple candidate cells, and the multiple candidate cells include a first candidate cell; the second indication information is used to indicate that the input parameters of the key derivation correspond to the first candidate cell; receive a first switching message from the first access network device, and the first switching message is used to instruct the terminal device to switch to a candidate cell in the first list; access a candidate cell in the first list; derive a security key corresponding to the first candidate cell based on the first key information and the second indication information; the processing unit 902 is used to: communicate with the second access network device on a candidate cell in the first list based on the security key.

[0394] In one possible design, the processing unit 902 is used to: deduce the security key corresponding to the first candidate cell based on the first key information and the second indication information, and specifically to: deduce the security key corresponding to the first candidate cell based on the second key information corresponding to the first key information, the PCI of the first candidate cell and the downlink frequency of the first candidate cell.

[0395] (4) The device 900 may be a core network device (e.g., AMF) in the above-mentioned embodiment. The processing unit 902 may support the device 900 in executing the actions of the core network device (e.g., AMF) in the above-mentioned embodiment 1 or embodiment 2. Alternatively, the processing unit 902 mainly executes the internal actions of the core network device in the method example, and the communication unit 903 may support the communication between the device 900 and other devices.

[0396] For example, in one embodiment, the communication unit 903 is used to: receive a third request message from a second access network device, wherein the third request message is used to request key information; send first key information and second key information to the second access network device; wherein the first key information is used to identify the second key information, and the second key information is used for security protection of data between the terminal device and the second access network device.

[0397] In one possible design, the third request message also includes information of a third candidate cell corresponding to the first key information, and the information of the third candidate cell is used to obtain the security key corresponding to the first candidate cell; wherein the third candidate cell is the same as or different from the first candidate cell.

[0398] (5) The apparatus 900 may be the first access network device in the above embodiment. The processing unit 902 may support the apparatus 900 to execute the actions of the first access network device in the above embodiment 2 or embodiment 4. Alternatively, the processing unit 902 mainly executes the internal actions of the first access network device in the method example, and the communication unit 903 may support the communication between the apparatus 900 and other devices.

[0399] For example, in one embodiment, the communication unit 903 is used to: send a first request message to a second access network device, wherein the first request message is used to request the configuration of a first candidate cell, and the first request message is also used to indicate key information corresponding to the first candidate cell; and receive the configuration of the first candidate cell from the second access network device.

[0400] In one possible design, the communication unit 903 is also used to: send a second request message to the second access network device, the second request message is used to request the configuration of the second candidate cell; receive the configuration and first indication information of the second candidate cell from the second access network device, the first indication information is used to indicate the key information corresponding to the second candidate cell; wherein the key information corresponding to the second candidate cell is the same as the key information corresponding to the first candidate cell.

[0401] In one possible design, the first request message includes: information about a first security key corresponding to the first candidate cell and a cell corresponding to the first security key; wherein the first security key corresponding to the first candidate cell and information about a cell corresponding to the first security key are used to indicate key information corresponding to the first candidate cell.

[0402] In a possible design, the cell corresponding to the first security key is the first candidate cell, and the processing unit 902 is used to: deduce the first security key according to the second key information corresponding to the first key information, the PCI of the first candidate cell, and the downlink frequency of the first candidate cell; wherein the first key information is used to identify the second key information, and the second key information is used for security protection of data between the terminal device and the second access network device; the first key information and the second key information correspond to the first candidate cell.

[0403] In one possible design, the communication unit 903 is also used to: send a third request message to the core network device, wherein the third request message is used to request the key information corresponding to the first candidate cell; receive the first key information and the second key information from the core network device; or, the processing unit 902 is used to: determine the key information corresponding to the second security key as the first key information; wherein the second security key corresponds to the source cell.

[0404] In one possible design, the first request message also includes: the first key information.

[0405] In a possible design, the communication unit 903 is also used to: send information of a first list, the first key information, and second indication information to the terminal device; wherein the first list includes identifiers of multiple candidate cells, and the multiple candidate cells include the first candidate cell; the first list corresponds to the first key information; the second indication information is used to indicate that the input parameters of key derivation correspond to the first candidate cell; and send a first switching message to the terminal device, and the first switching message is used to indicate that the terminal device switches to a candidate cell in the first list.

[0406] In a possible design, the cell corresponding to the first security key is the first candidate cell, and the processing unit 902 is also used to: deduce the first security key according to the second key information, the PCI of the first candidate cell, and the downlink frequency of the first candidate cell; wherein the second key information is jointly identified by the first key information and the first extended key information, and the second key information is used for security protection of data between the terminal device and the second access network device; the first key information and the second key information correspond to the first candidate cell.

[0407] In one possible design, the communication unit 903 is also used to: send a third request message to the core network device, wherein the third request message is used to request the key information corresponding to the first candidate cell; receive the first key information, the first extended key information, and the second key information from the core network device; or, the processing unit 902 is used to determine the key information corresponding to the second security key as the first key information; wherein the second security key corresponds to the source cell.

[0408] In one possible design, the first request message also includes: the first key information and the first extended key information.

[0409] In a possible design, the communication unit 903 is also used to: send information of a first list, the first key information, the first extended key information, and second indication information to the terminal device; wherein the first list includes identifiers of multiple candidate cells, and the multiple candidate cells include the first candidate cell; the first list corresponds to the first key information and the first extended key information; the second indication information is used to indicate that the input parameters of key derivation correspond to the first candidate cell; and send a first switching message to the terminal device, and the first switching message is used to indicate that the terminal device switches to a candidate cell in the first list.

[0410] In a possible design, the communication unit 903 is further used to: send a second switching message to the second access network device, where the second switching message is used to indicate that a switch has been initiated to a candidate cell in the first list.

[0411] (6) The apparatus 900 may be the second access network device in the above embodiment. The processing unit 902 may support the apparatus 900 to execute the actions of the second access network device in the above embodiment 2 or embodiment 4. Alternatively, the processing unit 902 mainly executes the internal actions of the second access network device in the method example, and the communication unit 903 may support the communication between the apparatus 900 and other devices.

[0412] For example, in one embodiment, the communication unit 903 is used to: receive a first request message from a first access network device, the first request message is used to request the configuration of a first candidate cell, and the first request message is also used to indicate key information corresponding to the first candidate cell; and send the configuration of the first candidate cell to the first access network device.

[0413] In one possible design, the communication unit 903 is also used to: receive a second request message from the first access network device, the second request message is used to request the configuration of a second candidate cell; send the configuration of the second candidate cell and first indication information to the first access network device, the first indication information is used to indicate the key information corresponding to the second candidate cell; wherein the key information corresponding to the second candidate cell is the same as the key information corresponding to the first candidate cell.

[0414] In one possible design, the first request message includes: information about a first security key corresponding to the first candidate cell and a cell corresponding to the first security key; wherein the first security key corresponding to the first candidate cell and information about a cell corresponding to the first security key are used to indicate key information corresponding to the first candidate cell.

[0415] In a possible design, the first request message also includes: first key information; wherein the first key information is used to identify second key information, and the second key information is used for security protection of data between the terminal device and the second access network device.

[0416] In a possible design, the first request message also includes: first key information and first extended key information; wherein, the first key information and the first extended key information are used to jointly identify second key information, and the second key information is used for security protection of data between the terminal device and the second access network device.

[0417] In a possible design, the communication unit 903 is further used to: receive a second switching message from the first access network device, where the second switching message is used to indicate that a switch has been initiated to a candidate cell included in the second access device.

[0418] In a possible design, the communication unit 903 is also used to: send a fourth request message to the core network device; receive third key information and fourth key information from the core network device; wherein the third key information is used to identify the fourth key information, and the fourth key information is used for security protection of data between the terminal device and the third access network device.

[0419] In a possible design, the communication unit 903 is also used to: send a fourth request message to the core network device; receive third key information, second extended key information and fourth key information from the core network device; wherein the third key information and the second extended key information are used to identify the fourth key information, and the fourth key information is used for security protection of data between the terminal device and the third access network device.

[0420] (7) The device 900 may be a terminal in the above embodiment. The processing unit 902 may support the device 900 to execute the actions of the terminal device in the above embodiment 2 or embodiment 4. Alternatively, the processing unit 902 mainly executes the internal actions of the terminal device in the method example, and the communication unit 903 may support the communication between the device 900 and other devices.

[0421] For example, in one embodiment, the communication unit 903 is used to: receive information from a first list, first key information, and second indication information from a first access network device; wherein the first list includes identifiers of multiple candidate cells, and the multiple candidate cells include a first candidate cell; the second indication information is used to indicate that the input parameters of the key derivation correspond to the first candidate cell; receive a first switching message from the first access network device, and the first switching message is used to instruct the terminal device to switch to the candidate cell in the first list; the processing unit 902 is used to: access a candidate cell in the first list; deduce a security key corresponding to the first candidate cell based on the first key information and the second indication information; and communicate with the second access network device on a candidate cell in the first list based on the security key.

[0422] In one possible design, the processing unit 902 is used to deduce the security key corresponding to the first candidate cell based on the first key information and the second indication information, and is specifically used to: deduce the security key corresponding to the first candidate cell based on the second key information corresponding to the first key information, the PCI of the first candidate cell and the downlink frequency of the first candidate cell.

[0423] (8) The device 900 may be a terminal in the above embodiment. The processing unit 902 may support the device 900 to execute the actions of the terminal device in the above embodiment 2 or embodiment 4. Alternatively, the processing unit 902 mainly executes the internal actions of the terminal device in the method example, and the communication unit 903 may support the communication between the device 900 and other devices.

[0424] For example, in one embodiment, the communication unit 903 is used to: receive information from a first list, first key information and first extended key information, and second indication information from a first access network device; wherein the first list includes identifiers of multiple candidate cells, and the multiple candidate cells include a first candidate cell; the second indication information is used to indicate that the input parameters of the key derivation correspond to the first candidate cell; receive a first switching message from the first access network device, and the first switching message is used to indicate that the terminal device switches to a candidate cell in the first list; the processing unit 902 is used to: access a candidate cell in the first list; derive a security key corresponding to the first candidate cell based on the first key information, the first extended key information and the second indication information; and communicate with the second access network device on a candidate cell in the first list based on the security key.

[0425] In one possible design, the processing unit 902 is used to: deduce the security key corresponding to the first candidate cell according to the first key information, the first extended key information and the second indication information, and is specifically used to: deduce the security key corresponding to the first candidate cell according to the second key information, the PCI of the first candidate cell and the downlink frequency of the first candidate cell; wherein the second key information is jointly identified by the first key information and the first extended key information.

[0426] (9) The device 900 may be a terminal in the above embodiment. The processing unit 902 may support the device 900 to execute the actions of the terminal device in the above embodiment 2 or embodiment 4. Alternatively, the processing unit 902 mainly executes the internal actions of the terminal device in the method example, and the communication unit 903 may support the communication between the device 900 and other devices.

[0427] For example, in one embodiment, the communication unit 903 is used to: receive a third request message from a first access network device, wherein the third request message is used to request key information corresponding to the first candidate cell; send first key information and second key information to the first access network device; wherein the first key information is used to identify the second key information, and the second key information is used for security protection of data between the terminal device and the second access network device.

[0428] Alternatively, in another embodiment, the communication unit 903 is used to: receive a third request message from a first access network device, wherein the third request message is used to request key information corresponding to the first candidate cell; send first key information, first extended key information, and second key information to the first access network device; wherein the first key information and the first extended key information are used to jointly identify the second key information, and the second key information is used for security protection of data between the terminal device and the second access network device.

[0429] Alternatively, in one embodiment, the communication unit 903 is used to: receive a fourth request message from a second access network device, wherein the fourth request message is used to request key information; and send third key information and fourth key information to the first access network device; wherein the third key information is used to identify the fourth key information, and the fourth key information is used for security protection of data between the terminal device and the third access network device.

[0430] Alternatively, in another embodiment, the communication unit 903 is used to: receive a fourth request message from a second access network device, wherein the fourth request message is used to request key information; and send third key information, second extended key information and fourth key information to the first access network device; wherein the third key information and the second extended key information are used to jointly identify the fourth key information, and the fourth key information is used for security protection of data between the terminal device and the third access network device.

[0431] It should be understood that the division of the units in the above device is only a division of logical functions. In actual implementation, they can be fully or partially integrated into one physical entity, or they can be physically separated. And the units in the device can all be implemented in the form of software calling through processing elements; they can also be all implemented in the form of hardware; some units can also be implemented in the form of software calling through processing elements, and some units can be implemented in the form of hardware. For example, each unit can be a separately established processing element, or it can be integrated in a certain chip of the device. In addition, it can also be stored in the memory in the form of a program, and called and executed by a certain processing element of the device. The function of the unit. In addition, all or part of these units can be integrated together, or they can be implemented independently. The processing element described here can also be a processor, which can be an integrated circuit with signal processing capabilities. In the implementation process, each operation of the above method or each unit above can be implemented by an integrated logic circuit of hardware in the processor element or in the form of software calling through a processing element.

[0432] In one example, the unit in any of the above devices may be one or more integrated circuits configured to implement the above method, such as one or more application specific integrated circuits (ASIC), or one or more digital singnal processors (DSP), or one or more field programmable gate arrays (FPGA), or a combination of at least two of these integrated circuit forms. For another example, when the unit in the device can be implemented in the form of a processing element scheduler, the processing element can be a processor, such as a general-purpose central processing unit (CPU), or other processors that can call programs. For another example, these units can be integrated together and implemented in the form of a system-on-a-chip (SOC).

[0433] The above unit for receiving is an interface circuit of the device, which is used to receive signals from other devices. For example, when the device is implemented in the form of a chip, the receiving unit is an interface circuit of the chip used to receive signals from other chips or devices. The above unit for sending is an interface circuit of the device, which is used to send signals to other devices. For example, when the device is implemented in the form of a chip, the sending unit is an interface circuit of the chip used to send signals to other chips or devices.

[0434] Based on the above embodiments, the present application also provides a communication device, referring to Fig.10 As shown, the communication device 1000 may include a transceiver 1001 and a processor 1002. Optionally, the communication device 1000 may further include a memory 1003. The memory 1003 may be arranged inside the communication device 1000 or outside the communication device 1000. The processor 1002 may control the transceiver 1001 to receive and send messages, etc.

[0435] Specifically, the processor 1002 may be a central processing unit (CPU), a network processor (NP) or a combination of a CPU and a NP. The processor 1002 may further include a hardware chip. The hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (PLD) or a combination thereof. The PLD may be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL) or any combination thereof.

[0436] The transceiver 1001, the processor 1002 and the memory 1003 are interconnected. Optionally, the transceiver 1001, the processor 1002 and the memory 1003 are interconnected via a bus 1004; the bus 1004 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Fig.10 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0437] In an optional implementation, the memory 1003 is used to store programs, etc. Specifically, the program may include a program code, and the program code includes a computer operation instruction. The memory 1003 may include a RAM, and may also include a non-volatile memory (non-volatile memory), such as one or more disk memories. The processor 1002 executes the application stored in the memory 1003 to implement the above functions, thereby realizing the functions of the communication device 1000.

[0438] Exemplarily, the communication device 1000 may be the first DU in the above embodiment; or may be the second DU in the above embodiment.

[0439] In one embodiment, when the communication device 1000 implements the function of the first DU in the above method embodiment, the transceiver 1001 can implement the transceiver operation performed by the first DU in the above method embodiment; the processor 1002 can implement other operations except the transceiver operation performed by the first DU in the above method embodiment. For specific related descriptions, please refer to the related descriptions in the above embodiments, which will not be described in detail here.

[0440] In another embodiment, when the communication device 1000 implements the function of the second DU in the above method embodiment, the transceiver 1001 can implement the transceiver operation performed by the second DU in the above method embodiment; the processor 1002 can implement other operations except the transceiver operation performed by the second DU in the above method embodiment. For specific related descriptions, please refer to the related descriptions in the above embodiments, which will not be described in detail here.

[0441] The terms "system" and "network" in the embodiments of the present application can be used interchangeably. "At least one" refers to one or more, and "multiple" refers to two or more. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist, for example, A and / or B, which can represent: the existence of A alone, the existence of A and B at the same time, and the existence of B alone, where A and B can be singular or plural. The character " / " generally indicates that the associated objects before and after are in an "or" relationship. "At least one of the following (individuals)" or similar expressions thereof refer to any combination of these items, including any combination of single items (individuals) or plural items (individuals). For example, "at least one of A, B and C" includes A, B, C, AB, AC, BC or ABC. And, unless otherwise specified, the ordinal numbers such as "first" and "second" mentioned in the embodiments of the present application are used to distinguish multiple objects, and are not used to limit the order, timing, priority or importance of multiple objects.

[0442] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0443] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0444] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0445] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0446] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A communication method, characterized in that: Applicable to the second access network equipment, including: receiving a first request message from a first access network device, where the first request message is used to request configuration of a first candidate cell; Acquire, according to the first request message, first key information and second key information from a core network device, where the first key information is used to identify the second key information, and the second key information is used for security protection of data between the terminal device and the second access network device; wherein the first key information and the second key information correspond to the first candidate cell; A first response message is sent to the first access network device, where the first response message includes the configuration of the first candidate cell and the first key information.

2. The method according to claim 1, characterized in that The method further comprises: receiving a second request message from the first access network device, where the second request message is used to request configuration of a second candidate cell; Send the configuration of the second candidate cell and first indication information to the first access network device, where the first indication information is used to indicate the key information corresponding to the second candidate cell; wherein the key information corresponding to the second candidate cell is the same as the key information corresponding to the first candidate cell.

3. The method according to claim 1 or 2, characterized in that: The first request message includes key request information, and the key request information is used to request the second access network device to obtain the security key corresponding to the first candidate cell.

4. The method according to claim 3, characterized in that The key request information includes information of a third candidate cell, and the information of the third candidate cell is used to obtain a security key corresponding to the first candidate cell; wherein the third candidate cell is the same as or different from the first candidate cell.

5. The method according to any one of claims 1 to 3, characterized in that The first response message also includes information of a third candidate cell corresponding to the first key information, where the information of the third candidate cell is used to obtain a security key corresponding to the first candidate cell; wherein the third candidate cell is the same as or different from the first candidate cell.

6. The method according to claim 4 or 5, characterized in that: The method further comprises: Deducing a security key corresponding to the first candidate cell according to the second key information, the PCI of the third candidate cell, and the downlink frequency of the third candidate cell; Receive data from the terminal device, and process the data of the terminal device according to the security key corresponding to the first candidate cell.

7. The method according to any one of claims 1 to 3, characterized in that The acquiring, according to the first request message, the first key information and the second key information from the core network device includes: Sending a third request message to the core network device according to the first request message, where the third request message is used to request key information corresponding to the first candidate cell; Receive the first key information and the second key information from the core network device.

8. A communication method, characterized in that: Applied to a first access network device, the method includes: Sending a first request message to the second access network device, where the first request message is used to request configuration of the first candidate cell; A first response message is received from the second access network device, where the first response message includes the configuration of the first candidate cell and first key information; wherein the first key information corresponds to the first candidate cell.

9. The method according to claim 8, characterized in that The method further comprises: Sending a second request message to the second access network device, where the second request message is used to request configuration of a second candidate cell; Receive the configuration of the second candidate cell and first indication information from the second access network device, where the first indication information is used to indicate the key information corresponding to the second candidate cell; wherein the key information corresponding to the second candidate cell is the same as the key information corresponding to the first candidate cell.

10. The method according to claim 8 or 9, characterized in that: The first request message includes key request information, and the key request information is used to request the second access network device to obtain the security key corresponding to the first candidate cell.

11. The method according to claim 10, characterized in that The key request information includes information of a third candidate cell, and the information of the third candidate cell is used to obtain a security key corresponding to the first candidate cell; wherein the third candidate cell is the same as or different from the first candidate cell.

12. The method according to any one of claims 8 to 10, characterized in that The first response message also includes information of a third candidate cell corresponding to the first key information, where the information of the third candidate cell is used to obtain a security key corresponding to the first candidate cell; wherein the third candidate cell is the same as or different from the first candidate cell.

13. The method according to any one of claims 8 to 12, characterized in that The method further comprises: Sending information of a first list, the first key information, and second indication information to a terminal device; wherein the first list includes identifiers of multiple candidate cells, and the multiple candidate cells include a first candidate cell; the first list corresponds to the first key information; and the second indication information is used to indicate that an input parameter of key derivation corresponds to the first candidate cell; A first switching message is sent to the terminal device, where the first switching message is used to instruct the terminal device to switch to a candidate cell in the first list.

14. The method according to claim 13, characterized in that The method further comprises: A second switching message is sent to the second access network device, where the second switching message is used to indicate that a switching has been initiated to a candidate cell in the first list.

15. A communication method, characterized in that: Applied to terminal equipment, including: Receiving information of a first list, first key information, and second indication information from a first access network device; wherein the first list includes identifiers of multiple candidate cells, and the multiple candidate cells include a first candidate cell; and the second indication information is used to indicate that an input parameter of key derivation corresponds to the first candidate cell; receiving a first switching message from the first access network device, where the first switching message is used to instruct the terminal device to switch to a candidate cell in the first list; Accessing a candidate cell in the first list; deducing a security key corresponding to the first candidate cell according to the first key information and the second indication information; Communicate with the second access network device on a candidate cell in the first list according to the security key.

16. The method according to claim 15, characterized in that The deducing, according to the first key information and the second indication information, a security key corresponding to the first candidate cell includes: A security key corresponding to the first candidate cell is derived based on the second key information corresponding to the first key information, the PCI of the first candidate cell, and the downlink frequency of the first candidate cell.

17. A communication method, characterized in that: Applied to a first access network device, the method includes: Sending a first request message to the second access network device, where the first request message is used to request configuration of a first candidate cell, and the first request message is also used to indicate key information corresponding to the first candidate cell; Receive the configuration of the first candidate cell from the second access network device.

18. The method according to claim 17, characterized in that The first request message includes: information about a first security key corresponding to the first candidate cell and a cell corresponding to the first security key; wherein the first security key corresponding to the first candidate cell and information about a cell corresponding to the first security key are used to indicate key information corresponding to the first candidate cell.

19. The method according to claim 18, characterized in that The cell corresponding to the first security key is the first candidate cell, and the method further includes: The first security key is deduced based on the second key information corresponding to the first key information, the PCI of the first candidate cell, and the downlink frequency of the first candidate cell; wherein the first key information is used to identify the second key information, and the second key information is used for security protection of data between the terminal device and the second access network device; the first key information and the second key information correspond to the first candidate cell.

20. The method according to claim 19, characterized in that The method further comprises: Sending a third request message to a core network device, where the third request message is used to request key information corresponding to the first candidate cell; receiving the first key information and the second key information from the core network device; or, The key information corresponding to the second security key is determined as the first key information; wherein the second security key corresponds to the source cell.

21. The method according to claim 18, characterized in that The cell corresponding to the first security key is the first candidate cell, and the method further includes: The first security key is deduced based on the second key information, the PCI of the first candidate cell, and the downlink frequency of the first candidate cell; wherein the second key information is jointly identified by the first key information and the first extended key information, and the second key information is used for security protection of data between the terminal device and the second access network device; the first key information and the second key information correspond to the first candidate cell.

22. A communication method, characterized in that: Applied to a second access network device, the method comprises: receiving a first request message from a first access network device, where the first request message is used to request configuration of a first candidate cell, and the first request message is also used to indicate key information corresponding to the first candidate cell; Send the configuration of the first candidate cell to the first access network device.

23. The method according to claim 22, characterized in that The method further comprises: Sending a fourth request message to the core network device; receiving third key information and fourth key information from the core network device; wherein the third key information is used to identify the fourth key information, and the fourth key information is used for security protection of data between the terminal device and the third access network device; or, Receive the third key information, the second extended key information and the fourth key information from the core network device; wherein the third key information and the second extended key information are used to jointly identify the fourth key information, and the fourth key information is used for security protection of data between the terminal device and the third access network device.

24. A communication method, characterized in that: Applied to a terminal device, the method comprises: Receiving information of a first list, first key information, and second indication information from a first access network device; wherein the first list includes identifiers of multiple candidate cells, and the multiple candidate cells include a first candidate cell; and the second indication information is used to indicate that an input parameter of key derivation corresponds to the first candidate cell; receiving a first switching message from the first access network device, where the first switching message is used to instruct the terminal device to switch to a candidate cell in the first list; Accessing a candidate cell in the first list; deducing a security key corresponding to the first candidate cell according to the first key information and the second indication information; Communicate with the second access network device on a candidate cell in the first list according to the security key.

25. A communication method, characterized in that: Applied to a terminal device, the method comprises: Receiving information of a first list, first key information, first extended key information, and second indication information from a first access network device; wherein the first list includes identifiers of multiple candidate cells, and the multiple candidate cells include a first candidate cell; and the second indication information is used to indicate that an input parameter of key derivation corresponds to the first candidate cell; receiving a first switching message from the first access network device, where the first switching message is used to instruct the terminal device to switch to a candidate cell in the first list; Accessing a candidate cell in the first list; deducing a security key corresponding to the first candidate cell according to the first key information, the first extended key information and the second indication information; Communicate with the second access network device on a candidate cell in the first list according to the security key.

26. A communication device, characterized in that: Comprising means for executing the method as claimed in any one of claims 1 to 25.

27. A communication device, characterized in that: It includes a processor, which is coupled to a memory, and a computer program is stored in the memory; the processor is used to call the computer program in the memory so that the communication device executes any method as claimed in claims 1 to 25.

28. A communication system, characterized in that: The communication system includes a first communication device, a second communication device and a third communication device; wherein the first communication device is used to execute the method described in any one of claims 1 to 7, the second communication device is used to execute the method described in any one of claims 8 to 14, and the third communication device is used to execute the method described in claim 15 or 16; or, the first communication device is used to execute the method described in any one of claims 17 to 21, the second communication device is used to execute the method described in claim 22 or 23, and the third communication device is used to execute the method described in claim 24 or 25.

29. A computer-readable storage medium, characterized in that: The storage medium stores a computer program or instruction, and when the computer program or instruction is executed by a computer, the method as claimed in any one of claims 1 to 25 is implemented.

30. A computer program product, characterized in that When a computer reads and executes the computer program product, the computer is enabled to execute the method according to any one of claims 1 to 25.

Images