Communication method, device and system

Abstract

The invention discloses a communication method, device and system, and relates to the technical field of communication. The method comprises the following steps: acquiring a second key for communication authentication with a second node, wherein the second key is different from a pre-configured first key; receiving a release request for a first communication connection from the second node, wherein the first key is used for communication authentication of the first communication connection; and sending a connection establishment request to the second node, wherein the connection establishment request is used for requesting to establish a connection based on the second key. According to the method, the technical scheme that after the first node and the second node determine the updated secret key, the connection is released, and the connection is established by adopting the new secret key is provided, so that the authentication process under the fusion of multiple communication scenes is realized.

Description

[0001] This application is a divisional application. The application number of the original application is 202111005514.2, and the original application date is August 30, 2021. The entire content of the original application is incorporated into this application by reference. Technical Field

[0002] The embodiments of the present application relate to the field of communication technologies, and in particular, to a communication method, device, and system. Background Art

[0003] The rapid development of mobile communications has fostered the emergence of diverse application scenarios, inevitably leading to the convergence of communication systems based on diverse technologies. For example, with the maturation of 5G technology and the widespread adoption of wireless short-range communication systems, the integration of wireless short-range communication with 5G cellular networks has become a new trend. At the same time, these new converged scenarios also place higher demands on the security of communication transmission.

[0004] However, under the existing standards, there is no secure and effective communication method for scenarios where different communication systems are integrated. Summary of the Invention

[0005] The embodiments of the present application provide a communication method, device, and system for updating a communication authentication key to improve communication security.

[0006] In a first aspect, an embodiment of the present application provides a communication method that can be applied to a first node. The method includes:

[0007] Obtain a second key for communication authentication with a second node, where the second key is different from a pre-configured first key; receive a release request for a first communication connection from the second node, where the first key is used for communication authentication of the first communication connection; and send a connection establishment request to the second node, where the connection establishment request is used to request establishment of a connection based on the second key.

[0008] Through the above method, the embodiment of the present application provides a technical solution for releasing the connection after the first node and the second node determine the updated key, and establishing a connection using the new key, thereby realizing the switching of different communication connections and the update process of the key used for communication authentication, thereby effectively improving the security of communication.

[0009] In a possible implementation, the connection establishment request is used to request establishment of a connection based on the second key, including the connection establishment request being used to request execution of an authentication and security context negotiation process based on the second key.

[0010] In a possible implementation, the method further includes: receiving authentication information based on the second key from the second node; the authentication information is used to verify the identity of the second node.

[0011] In a possible implementation, the authentication information is used to verify the identity of the second node, including the authentication information being used to verify whether a second communication connection is established with the second node based on the second key.

[0012] In one possible implementation, the first key is a key derived (or negotiated) based on a first communication system, and / or the second key is a key derived (or negotiated) based on a second communication system, and the first communication system is different from the second communication system.

[0013] In a possible implementation, the first communication system may be a single communication system, and the second communication system may be a communication system formed by integrating different communication systems.

[0014] Through the above method, the embodiment of the present application provides a communication method for different communication systems in a converged communication scenario, which effectively improves the security of communication.

[0015] In a possible implementation, an authentication response based on the second key is sent to the second node, where the authentication response is used to verify the identity of the first node.

[0016] In a possible implementation, the authentication response is used to verify the identity of the first node, including the authentication response being used by the second node to verify whether the second communication connection is established with the first node based on the second key.

[0017] Through the above method, the first node sends an authentication response to the second node, so that the second node can further determine whether the authentication based on the second key is successful according to the authentication response.

[0018] In a possible implementation, the release request includes request reason information; the request reason information is used to indicate a key update for communication authentication.

[0019] By carrying the request reason in the release request through the above method, the first node can understand the request reason after receiving the release request from the second node, thereby making a more targeted request response and being more adaptable.

[0020] In a possible implementation, the second key is valid for a first duration, where the first duration is defined by a timer or a timestamp.

[0021] Through the above method, during the communication transmission process between the first node and the second node using the second key, the validity of the second key is further verified, which can ensure the timeliness of the second key and better ensure the security of communication transmission.

[0022] In a possible implementation, the second key is valid for a first duration starting at a first moment, where the first moment is a moment when the first communication connection is released, or a moment when the connection establishment request is sent.

[0023] Through the above method, the present application provides multiple situations at the first moment, thereby providing multiple solutions for judging the validity of the second key, which is more flexible.

[0024] In a possible implementation, the method further includes transmitting information with the third node via a backhaul link between the second node and the third node during the validity period of the second key.

[0025] In a second aspect, an embodiment of the present application provides a communication method that can be applied to a second node. The method includes:

[0026] Obtain a second key for communication authentication with a first node, where the second key is different from a pre-configured first key; send a release request for a first communication connection to the first node, where the first key is used for communication authentication of the first communication connection; receive a connection establishment request sent from the first node, where the connection establishment request is used to request to establish a connection based on the second key.

[0027] Through the above method, the embodiment of the present application provides a technical solution for releasing the connection after the first node and the second node determine the updated key, and establishing a connection using the new key, thereby realizing the switching of different communication connections and the update process of the key used for communication authentication, thereby effectively improving the security of communication.

[0028] In a possible implementation, the connection establishment request is used to request establishment of a connection based on the second key, including: the connection establishment request is used to request execution of authentication and security context negotiation processes based on the second key.

[0029] In a possible implementation, the method further includes: sending authentication information based on the second key to the first node; the authentication information is used to verify the identity of the second node.

[0030] In a possible implementation, the authentication information is used to verify the identity of the second node, including the authentication information being used by the first node to verify whether to establish a second communication connection with the second node based on the second key.

[0031] In one possible implementation, the first key is a key derived (or negotiated) based on a first communication system, and / or the second key is a key derived (or negotiated) based on a second communication system, and the first communication system is different from the second communication system.

[0032] In a possible implementation, the first communication system may be a single communication system, and the second communication system may be a communication system formed by integrating different communication systems.

[0033] Through the above method, the embodiment of the present application provides a communication method for different communication systems in a converged communication scenario, which effectively improves the security of communication.

[0034] In a possible implementation, the method further includes receiving an authentication response based on the second key from the first node; the authentication response is used to verify the identity of the first node.

[0035] In one possible implementation, the authentication response is used to verify the identity of the first node, including the authentication response being used by the second node to verify whether the second communication connection with the first node is established based on the second key. Through the above method, the first node can send the authentication response to the second node, allowing the second node to further determine whether authentication based on the second key is successful based on the authentication response.

[0036] In a possible implementation, the release request includes request reason information; the request reason information is used to indicate a key update for communication authentication.

[0037] By carrying the request reason in the release request through the above method, the first node can understand the request reason after receiving the release request from the second node, thereby making a more targeted request response and being more adaptable.

[0038] In a possible implementation, the second key is valid for a first duration, and the first duration may be defined by a timer or a timestamp.

[0039] Through the above method, during the communication transmission process between the first node and the second node using the second key, the validity of the second key is further verified, which can ensure the timeliness of the second key and better ensure the security of communication transmission.

[0040] In a possible implementation, the second key is valid for a first duration starting at a first moment, where the first moment is a moment when the first communication connection is released, or a moment when the second node receives the connection establishment request.

[0041] Through the above method, the present application provides multiple situations at the first moment, thereby providing multiple solutions for judging the validity of the second key, which is more flexible.

[0042] In a possible implementation, the method further includes sending, during the validity period of the second key, the transmission information from the first node to the third node via a backhaul link between the second node and the third node.

[0043] In a possible implementation, after the first communication connection with the first node is released, the backhaul link is suspended.

[0044] Through the above method, the second node suspends the backhaul link after releasing the first communication connection, which can effectively reduce system overhead and save resources.

[0045] In a possible implementation, the method further includes activating the backhaul link after determining that a second communication connection is successfully established with the first node; the second communication connection is authenticated based on the second key.

[0046] Through the above method, after determining that the second communication connection is successfully established with the first node, the previously suspended backhaul link is activated, and the backhaul link is continued to be used for communication transmission, which can effectively reduce system overhead and save resources.

[0047] In a third aspect, an embodiment of the present application provides a communication method that can be applied to a first node. The method includes:

[0048] Obtain a second key for communication authentication with a second node, where the second key is different from a pre-configured first key; release a first communication connection with the second node, where the first key is used for communication authentication of the first communication connection; and send a connection establishment request to the second node, where the connection establishment request is used to request establishment of a connection based on the second key.

[0049] Through the above method, the embodiment of the present application provides a technical solution for releasing the connection after the first node and the second node determine the updated key, and establishing a connection using the new key, thereby realizing the switching of different communication connections and the update process of the key used for communication authentication, thereby effectively improving the security of communication.

[0050] In a possible implementation, the connection establishment request is used to request establishment of a connection based on the second key, including the connection establishment request being used to request execution of an authentication and security context negotiation process based on the second key.

[0051] In a possible implementation, the method further includes: receiving authentication information based on the second key from the second node; the authentication information is used to verify the identity of the second node.

[0052] In a possible implementation, the authentication information is used to verify the identity of the second node, including the authentication information being used to verify whether a second communication connection is established with the second node based on the second key.

[0053] In one possible implementation, the first key is a key derived (or negotiated) based on a first communication system, and / or the second key is a key derived (or negotiated) based on a second communication system, and the first communication system is different from the second communication system.

[0054] In a possible implementation, the first communication system may be a single communication system, and the second communication system may be a communication system formed by integrating different communication systems.

[0055] Through the above method, the embodiment of the present application provides a communication method for different communication systems in a converged communication scenario, which effectively improves the security of communication.

[0056] In a possible implementation, the method further includes: sending an authentication response based on the second key to the second node, where the authentication response is used to verify the identity of the first node.

[0057] In a possible implementation, the authentication response is used to verify the identity of the first node, including the authentication response being used by the second node to verify whether the second communication connection is established with the first node based on the second key.

[0058] Through the above method, the first node sends an authentication response to the second node, so that the second node can further determine whether the authentication based on the second key is successful according to the authentication response.

[0059] In a possible implementation, the release request includes request reason information; the request reason information is used to indicate a key update for communication authentication.

[0060] By carrying the request reason in the release request through the above method, the first node can understand the request reason after receiving the release request from the second node, thereby making a more targeted request response and being more adaptable.

[0061] In a possible implementation, the second key is valid for a first duration, where the first duration is defined by a timer or a timestamp.

[0062] Through the above method, during the communication transmission process between the first node and the second node using the second key, the validity of the second key is further verified, which can ensure the timeliness of the second key and better ensure the security of communication transmission.

[0063] In a possible implementation, the second key is valid for a first duration starting at a first moment, where the first moment is a moment when the first communication connection is released, or a moment when the connection establishment request is sent.

[0064] Through the above method, the present application provides multiple situations at the first moment, thereby providing multiple solutions for judging the validity of the second key, which is more flexible.

[0065] In a possible implementation, the method further includes: transmitting information with the third node via a backhaul link between the second node and the third node during the validity period of the second key.

[0066] In a fourth aspect, an embodiment of the present application provides a communication method that can be applied to a second node. The method includes:

[0067] Obtain a second key for communication authentication with a first node, where the second key is different from a pre-configured first key; release a first communication connection with the first node, where the first key is used for communication authentication of the first communication connection; and receive a connection establishment request sent from the first node, where the connection establishment request is used to request establishment of a connection based on the second key.

[0068] Through the above method, the embodiment of the present application provides a technical solution for releasing the connection after the first node and the second node determine the updated key, and establishing a connection using the new key, thereby realizing the switching of different communication connections and the update process of the key used for communication authentication, thereby effectively improving the security of communication.

[0069] In a possible implementation, the connection establishment request is used to request establishment of a connection based on the second key, including: the connection establishment request is used to request execution of authentication and security context negotiation processes based on the second key.

[0070] In a possible implementation, the method further includes: sending authentication information based on the second key to the first node; the authentication information is used to verify the identity of the second node.

[0071] In a possible implementation, the authentication information is used to verify the identity of the second node, including the authentication information being used by the first node to verify whether to establish a second communication connection with the second node based on the second key.

[0072] In one possible implementation, the first key is a key derived (or negotiated) based on a first communication system, and / or the second key is a key derived (or negotiated) based on a second communication system, and the first communication system is different from the second communication system.

[0073] In a possible implementation, the first communication system may be a single communication system, and the second communication system may be a communication system formed by integrating different communication systems.

[0074] Through the above method, the embodiment of the present application provides a communication method for different communication systems in a converged communication scenario, which effectively improves the security of communication.

[0075] In a possible implementation, the method further includes receiving an authentication response fed back from the first node; the authentication response is used to verify the identity of the first node.

[0076] In a possible implementation, the authentication response is used to verify the identity of the first node, including the authentication response being used by the second node to verify whether the second communication connection is established with the first node based on the second key.

[0077] Through the above method, the first node sends an authentication response to the second node, so that the second node can further determine whether the authentication based on the second key is successful according to the authentication response.

[0078] In a possible implementation, the release request includes request reason information; the request reason information is used to indicate a key update for communication authentication.

[0079] By carrying the request reason in the release request through the above method, the first node can understand the request reason after receiving the release request from the second node, thereby making a more targeted request response and being more adaptable.

[0080] In a possible implementation, the second key is valid for a first duration, and the first duration may be defined by a timer or a timestamp.

[0081] Through the above method, during the communication transmission process between the first node and the second node using the second key, the validity of the second key is further verified, which can ensure the timeliness of the second key and better ensure the security of communication transmission.

[0082] In a possible implementation, the second key is valid for a first duration starting at a first moment, where the first moment is a moment when the first communication connection is released, or a moment when the second node receives the connection establishment request.

[0083] Through the above method, the present application provides multiple situations at the first moment, thereby providing multiple solutions for judging the validity of the second key, which is more flexible.

[0084] In a possible implementation, the method further includes sending, during the validity period of the second key, the transmission information from the first node to the third node via a backhaul link between the second node and the third node.

[0085] In a possible implementation, after the first communication connection with the first node is released, the backhaul link is suspended.

[0086] Through the above method, the second node suspends the backhaul link after releasing the first communication connection, which can effectively reduce system overhead and save resources.

[0087] In a possible implementation, the method further includes activating the backhaul link after determining that a second communication connection is successfully established with the first node; the second communication connection is authenticated based on the second key.

[0088] Through the above method, after determining that the second communication connection is successfully established with the first node, the previously suspended backhaul link is activated, and the backhaul link is continued to be used for communication transmission, which can effectively reduce system overhead and save resources.

[0089] In a fifth aspect, an embodiment of the present application provides a communication device, which is used to implement the first aspect or any one of the methods in the first aspect, and includes corresponding functional modules or units, which are respectively used to implement the steps in the method in the first aspect. The functions can be implemented by hardware, or by hardware executing corresponding software, and the hardware or software includes one or more modules or units corresponding to the above functions; or

[0090] The apparatus is configured to implement the third aspect or any of the methods described in the third aspect, and includes corresponding functional modules or units, each configured to implement the steps of the method described in the third aspect. The functions may be implemented in hardware or by hardware executing corresponding software, with the hardware or software including one or more modules or units corresponding to the functions described above.

[0091] In a sixth aspect, an embodiment of the present application provides a communication device, which is used to implement the second aspect or any one of the methods in the second aspect, and includes corresponding functional modules or units, which are respectively used to implement the steps in the method in the second aspect. The functions can be implemented by hardware, or by hardware executing corresponding software, and the hardware or software includes one or more modules or units corresponding to the above functions; or

[0092] The apparatus is configured to implement the fourth aspect or any of the methods described in the fourth aspect, and includes corresponding functional modules or units, each configured to implement the steps of the method described in the fourth aspect. The functions may be implemented in hardware or by hardware executing corresponding software, with the hardware or software including one or more modules or units corresponding to the functions described above.

[0093] In a seventh aspect, a communication device is provided, comprising a processor and a memory. The memory is configured to store a computer program or instruction, and the processor is coupled to the memory. When the processor executes the computer program or instruction, the device executes the first aspect or any one of the methods in the first aspect; or the device executes the third aspect or any one of the methods in the third aspect. The communication device may be the first device, or a device capable of supporting the first device in implementing the functions required by the method provided in the first aspect, or a device capable of supporting the first device in implementing the functions required by the method provided in the third aspect, such as a chip system. For example, the communication device may be a terminal device or a component within the terminal device (such as a chip). The terminal device may be, for example, a smart mobile terminal, a smart home appliance, a smart car, a smart wearable device, or the like. Smart mobile terminals include mobile phones, tablet computers, laptops, ultra-mobile personal computers (UMPCs), netbooks, and personal digital assistants (PDAs). Smart home appliances include smart refrigerators, smart washing machines, smart televisions, and speakers. Smart car wearable devices include smart headphones, smart glasses, smart clothing, or shoes.

[0094] In an eighth aspect, a communication device is provided, comprising a processor and a memory. The memory is configured to store a computer program or instruction, and the processor is coupled to the memory. When the processor executes the computer program or instruction, the device executes the second aspect or any one of the methods described in the second aspect; or the device executes the fourth aspect or any one of the methods described in the fourth aspect. The communication device may be a second device or a device capable of supporting the second device in implementing the functions required by the method described in the second aspect, or a device capable of supporting the second device in implementing the functions required by the method described in the fourth aspect, such as a system-on-chip. For example, the communication device may be a terminal device or a component within the terminal device (such as a chip). The terminal device may be, for example, a smart mobile terminal, a smart home appliance, a smart car, a smart wearable device, or the like. Smart mobile terminals include mobile phones, tablet computers, laptops, ultra-mobile personal computers (UMPCs), netbooks, and personal digital assistants (PDAs). Smart home appliances include smart refrigerators, smart washing machines, smart televisions, and speakers. Smart car wearable devices include smart headphones, smart glasses, smart clothing, or shoes.

[0095] In the ninth aspect, a terminal is provided, which may include the apparatus described in the fifth or seventh aspect above, and the apparatus described in the sixth or eighth aspect above. Optionally, the apparatus may be a smart home device, smart manufacturing equipment, smart transportation equipment, etc., such as a vehicle, a drone, an unmanned transport vehicle, a car and a vehicle, or a robot. Alternatively, the apparatus may be a mouse, a keyboard, a wearable device, a TWS headset, etc.

[0096] In a tenth aspect, the present application provides a chip, which is connected to a memory and is used to read and execute computer programs or instructions stored in the memory to implement the method in the above-mentioned first aspect or any possible implementation of the first aspect; or to implement the method in the above-mentioned second aspect or any possible implementation of the second aspect; or to implement the method in the above-mentioned third aspect or any possible implementation of the third aspect; or to implement the method in the above-mentioned fourth aspect or any possible implementation of the fourth aspect.

[0097] In the eleventh aspect, a computer-readable storage medium is provided, in which a computer program or instruction is stored. When the computer program or instruction is executed by a device, the device executes the method of the above-mentioned first aspect or any possible implementation of the first aspect, or the device executes the method of the above-mentioned third aspect or any possible implementation of the third aspect.

[0098] In the twelfth aspect, a computer-readable storage medium is provided, in which a computer program or instruction is stored. When the computer program or instruction is executed by a device, the device executes the method in the above-mentioned second aspect or any possible implementation of the second aspect, or the device executes the above-mentioned fourth aspect or any possible implementation of the fourth aspect.

[0099] In a thirteenth aspect, the present application provides a computer program product, which includes a computer program or instructions. When the computer program or instructions are executed by a device, the device executes the method in the above-mentioned first aspect or any possible implementation of the first aspect, or the device executes the above-mentioned third aspect or any possible implementation of the third aspect.

[0100] In a fourteenth aspect, the present application provides a computer program product, which includes a computer program or instructions. When the computer program or instructions are executed by a device, the device executes the method in the above-mentioned second aspect or any possible implementation of the second aspect, or the device executes the above-mentioned third aspect or any possible implementation of the third aspect.

[0101] It should be understood that the technical solutions provided by this application can be applied to scenarios where different communication systems are integrated, providing a communication method for such scenarios, effectively improving communication security. Furthermore, by setting the validity of the keys used for communication authentication, the timeliness of the keys used for communication authentication can be guaranteed, further ensuring the security of communication transmission. BRIEF DESCRIPTION OF THE DRAWINGS

[0102] Figure 1 A schematic diagram of a first communication system provided in an embodiment of the present application;

[0103] Figure 2 A schematic diagram of a second communication system provided in an embodiment of the present application;

[0104] Figure 3 A schematic diagram of the first communication method flow provided in an embodiment of the present application;

[0105] Figure 4 A schematic diagram of the second communication method flow provided in an embodiment of the present application;

[0106] Figure 5 A schematic diagram of a third communication method flow chart provided in an embodiment of the present application;

[0107] Figure 6 A schematic diagram of a fourth communication method flow chart provided in an embodiment of the present application;

[0108] Figure 7 A schematic diagram of a fifth communication method flow chart provided in an embodiment of the present application;

[0109] Figure 8 A schematic diagram of a sixth communication method flow chart provided in an embodiment of the present application;

[0110] Figure 9 A schematic diagram of a sixth communication method flow chart provided in an embodiment of the present application;

[0111] Figure 10 A schematic diagram of the structure of a first communication device provided in an embodiment of the present application;

[0112] Figure 11 A schematic diagram of the structure of a second communication device provided in an embodiment of the present application;

[0113] Figure 12 A schematic diagram of a terminal structure provided in an embodiment of the present application. DETAILED DESCRIPTION

[0114] The embodiment of the present application provides a communication method and apparatus to realize an authentication process for integrating wireless short-range and 5G cellular networks. In order to make the purpose, technical solution and advantages of the embodiment of the present application clearer, the embodiment of the present application will be further described in detail below with reference to the accompanying drawings.

[0115] The communication method provided in the embodiment of the present application can be applied to the fifth generation (5G) communication system, such as the 5G new radio (NR), and can also be applied to various future communication systems, such as the sixth generation (6G) communication system, without limitation herein.

[0116] like Figure 1 As shown, the embodiment of the present application provides an architecture of a communication system to which the communication method is applicable, and the communication system may include a first node 100, a second node 110, and a third node 120. Optionally, in the communication system, the first node may be connected to the second node, and the second node may be connected to the third node.

[0117] In this application, the communication system may be a communication system formed by the fusion of different communication systems, such as a communication system formed by the fusion of a wireless short-range communication system and a 5G cellular network communication system, and is not limited to this. The fused communication system may also be referred to as a tightly interworking communication system or an interworking communication system.

[0118] For example, this application takes a communication system formed by integrating a wireless short-range communication system and a 5G cellular network communication system as an example to introduce the integrated communication system:

[0119] In this integrated communication system, terminal nodes that support wireless short-range communication can access the 5G network through control nodes or gateway nodes and further use the services provided by the 5G network. In addition, the 5G network can also configure and manage data transmission strategies for terminal nodes based on the terminal node's subscription information and link status information, in order to provide refined services. In other words, in this integrated communication system, the wireless short-range communication system and the 5G cellular network communication system can interact and complement each other's strengths.

[0120] Optionally, the wireless short-range communication system described in the present application may be any possible short-range communication system, such as Bluetooth, WiFi, vehicle-mounted general short-range communication system, Star Flash, and other short-range communication systems that may appear now or in the future.

[0121] Among them, the first node can be a terminal device or a communication device that can support the terminal device to implement the functions required by the method, or the first node can be a network device or a communication device that can support the network device to implement the functions required by the method, and of course it can also be other communication devices, such as a chip system. The second node can be a network device or a communication device that can support the network device to implement the functions required by the method, or the second node can be a terminal device or a communication device that can support the terminal device to implement the functions required by the method, and of course it can also be other communication devices, such as a chip system. The third node can be a network device or a communication device that can support the network device to implement the functions required by the method, or the third node can be a terminal device or a communication device that can support the terminal device to implement the functions required by the method, and of course it can also be other communication devices, such as a chip system.

[0122] Optionally, the terminal device in the embodiment of the present application may be a device for implementing wireless communication functions, such as a terminal or a chip that can be used in a terminal. For example, it may include a handheld device with a wireless connection function, or a processing device connected to a wireless modem. The terminal device can communicate with the core network via a radio access network (RAN) and exchange voice and / or data with the RAN. The terminal device may include user equipment (UE), wireless terminal equipment, mobile terminal equipment, subscriber unit (subscriber unit), subscriber station (subscriber station), mobile station (mobile station), mobile station (mobile), remote station (remotestation), access point (AP), remote terminal equipment (remote terminal), access terminal equipment (access terminal), user terminal equipment (user terminal), user agent (user agent), or user equipment (user device). For example, it may include a mobile phone (or so-called "cellular" phone), a computer with a mobile terminal device, a portable, pocket-sized, handheld, computer-built-in or vehicle-mounted mobile device, a smart wearable device, etc. Examples include personal communication service (PCS) phones, cordless phones, session initiation protocol (SIP) phones, wireless local loop (WLL) stations, personal digital assistants (PDAs), and other devices. Also included are limited devices, such as those with low power consumption, limited storage capacity, or limited computing power. Examples include information sensing devices such as barcode scanners, radio frequency identification (RFID), sensors, global positioning systems (GPS), and laser scanners.

[0123] As an example and not a limitation, in the embodiment of the present application, the terminal device may also be a wearable device. Wearable devices may also be called wearable smart devices, which are a general term for wearable devices that are intelligently designed and developed using wearable technology for daily wear, such as glasses, gloves, watches, clothing, and shoes. A wearable device is a portable device that is worn directly on the body or integrated into the user's clothes or accessories. Wearable devices are not only hardware devices, but also achieve powerful functions through software support, data interaction, and cloud interaction. Broadly speaking, wearable smart devices include full-featured, large-sized, and independent of smartphones to achieve complete or partial functions, such as smart watches or smart glasses, as well as devices that only focus on a certain type of application function and need to be used in conjunction with other devices such as smartphones, such as various smart bracelets, smart helmets, and smart jewelry for vital sign monitoring.

[0124] Optionally, the network devices in the embodiments of the present application may include access network (AN) devices and radio access network (RAN) devices. Access network devices, such as base stations (e.g., access points), may refer to devices in the access network that communicate with wireless terminal devices through one or more cells at the air interface. The base station may be used to convert received air frames into and from Internet Protocol (IP) packets, acting as a router between the terminal device and the rest of the access network, where the rest of the access network may include an IP network. The network-side device may also coordinate attribute management of the air interface. For example, the network device may include an evolved base station (NodeB or eNB or e-NodeB, evolved NodeB) in a long term evolution (LTE) system or long term evolution-advanced (LTE-A), or may also include a next generation node B (gNB) or a next generation evolved node B (ng-eNB), en-gNB (enhanced next generation node B, gNB) in a fifth generation mobile communication technology (5G) new radio (NR) system: an enhanced next generation base station; it may also include a centralized unit (CU) and a distributed unit (DU) in a cloud radio access network (Cloud RAN) system, or may also include a relay device, which is not limited in the embodiments of the present application.

[0125] In addition, this application also provides another communication system, such as Figure 2 As shown, the communication system may also include functional entities such as session management function (SMF), access and mobility management function (AMF), user plane function (UPF) and DN.

[0126] The various functions can be connected through interfaces, and the serial number or name of the interface is not limited in the embodiments of this application. The interface defined in the 3GPP-related standard protocols of the 5G system can be used, or the interface in the future communication system can be used. For example, the terminal device communicates with the AMF through the next generation network (next generation, N) 1 interface (referred to as N1), the network device communicates with the AMF through the N2 interface (referred to as N2), the network device communicates with the local UPF through the N3 interface (referred to as N3), and the UPF communicates with the DN through the N6 interface (referred to as N6). The AMF communicates with the SMF through the N11 interface (referred to as N11), and the SMF communicates with the UPF through the N4 interface (referred to as N4).

[0127] The various functions included in the communication system may also be referred to as functional entities, network elements or other names. For example, SMF may be referred to as an SMF entity. Optionally, the various functions in the embodiments of the present application may be implemented by one device, or may be implemented by multiple devices together, or may be implemented by one or more functional modules within a device, and the embodiments of the present application do not specifically limit this. It is understandable that the various functions involved in the embodiments of the present application may be network elements in hardware devices, software functions running on dedicated hardware, a combination of hardware and software, or a virtualized function instantiated on a platform (e.g., a cloud platform).

[0128] It should be noted that the embodiments of the present application do not limit the distribution form of each function. Optionally, each function may also include other functional entities formed by the integration of any multiple functions mentioned above, for example, a functional entity having two functions of session management and policy control, or a functional entity having three functions of session management, access and mobility management and policy control, or a functional entity having two functions of network openness and application function.

[0129] It should be noted that Figures 1 and 2 The communication system shown does not constitute a limitation on the communication systems to which the embodiments of the present application can be applied. Figure 2The number of terminal devices in the example is just an example. In actual applications, the network device can provide services for multiple terminal devices. The network device, as well as all or part of the multiple terminal devices, can use the method provided in the embodiment of the present application to determine the scheduling restrictions. Figure 1 and / or Figure 2 The communication system architecture shown can be a non-roaming 5G system architecture. Optionally, the method of the embodiment of the present application is also applicable to a roaming 5G system architecture and various future communication networks.

[0130] Each function or device involved in the embodiments of the present application can also be referred to as a communication device, which can be a general device or a dedicated device, and the embodiments of the present application do not specifically limit this.

[0131] The above describes the application architecture involved in the embodiments of the present application. The following describes the technical features of the embodiments of the present application.

[0132] Currently, there is no secure and effective communication method for the fusion scenario of different communication systems. In view of this, the embodiment of the present application provides a technical solution for releasing the connection after the first node and the second node determine the updated key, and establishing the connection using the new key, providing a communication method for the fusion communication scenario of different communication systems, effectively improving the security of communication. Among them, the method and the device are based on the same technical concept. Since the principles of solving the problem by the method and the device are similar, the implementation of the device and the method can refer to each other, and the repeated parts will not be repeated.

[0133] This application embodiment provides a first communication method, see Figure 3 , which is a flowchart of the method.

[0134] S300: The first node obtains a second key for communication authentication with the second node.

[0135] Among them, the second key in the embodiment of the present application is different from the pre-configured first key.

[0136] Optionally, in the embodiment of the present application, the first node is used for communication authentication of the first communication connection, and the second node is used for communication authentication of the second communication connection.

[0137] It should be understood that, in an optional manner in the present application, the first key is a key derived (or negotiated) based on a first communication system, and / or the second key is a key derived (or negotiated) based on a second communication system, and the first communication system is different from the second communication system.

[0138] Among them, the first communication system in this application can be a single communication system, such as a wireless short-range communication system, a 5G cellular network communication system, an ultra-high reliability and low-latency communication system, an enhanced mobile broadband communication system, and a massive machine connection communication system; the second communication system in this application can be a communication system obtained by integrating different communication systems, such as a communication system obtained by integrating a wireless short-range communication system and a 5G cellular network communication system, and a communication system obtained by integrating a 5G cellular network communication system and an ultra-high reliability and low-latency communication system.

[0139] Specifically, the first key may be a key used for authentication during the initial connection between the first node and the second node. The first key may be preconfigured by the first node and the second node before the initial connection; or, the first key may be determined by the second node and indicated to the first node via signaling; or, the first key may be determined by the first node and indicated to the second node via signaling, which is not limited in this application.

[0140] Specifically, the second key may be determined by the first node after the first node establishes a first communication connection with the second node, and indicated to the second node through signaling; or, the second key may be determined by the second node after the first node establishes the first communication connection with the second node, and indicated to the first node through signaling; or, the second key may be jointly negotiated by the first node and the second node after the first node establishes the first communication connection with the second node. This application does not limit this.

[0141] Furthermore, to better ensure the security of the communication system, the second key obtained by the first node for communication authentication with the second node has a certain time limit. It is understood that if the second key is valid, it can be used to authenticate the second communication connection; if the second key is invalid, it cannot be used to authenticate the second communication connection. Furthermore, after the second key expires, a key update can be performed.

[0142] It is understandable that before implementing S300, step 1 may be further included: the first node and the second node are connected in a converged manner (ie, an initial authentication process is implemented in a scenario where different communication systems are converged).

[0143] Among them, the specific implementation process of step 1 can be the authentication of the initial connection between the first node and the second node based on the first key. After the first node and the second node determine that the authentication of the initial connection based on the first key is successful, the first node and the second node establish a first communication connection based on the first key for communication authentication.

[0144] S301: The second node obtains a second key for communication authentication with the first node.

[0145] Specifically, the second key may be determined by the first node after the first node establishes a first communication connection with the second node, and indicated to the second node through signaling; or, the second key may be determined by the second node after the first node establishes the first communication connection with the second node, and indicated to the first node through signaling; or, the second key may be jointly negotiated by the first node and the second node after the first node establishes the first communication connection with the second node. This application does not limit this.

[0146] S302: The second node sends a release request for the first communication connection to the first node.

[0147] The release request may include one or more of the following information 1 to 4:

[0148] Information 1: Request reason information, which is used to indicate the key update for communication authentication.

[0149] Information 2: Request time, which indicates the time when the second node sends the release request. Optionally, the request time can be represented by a timestamp.

[0150] Information 3: release time, which is used to indicate the time when the first node releases the first communication connection.

[0151] Exemplarily, the release time may indicate a specific time, for example, the specific time is the first minute after the first node receives the release request. In this case, after receiving the release request, the first node releases the first communication connection within the first minute after receiving the release request according to the release time included in the release request. Alternatively, the release time may indicate a specific time period. For example, the specific time period is within five minutes after the first node receives the release request. In this case, after receiving the release request, the first node releases the first communication connection within five minutes after receiving the release request according to the release time included in the release request.

[0152] Information 4: information indicating suspension of wireless resources.

[0153] Optionally, the release request may also be used to instruct to suspend the radio resources. For example, the release request may include information for instructing to suspend the radio resources corresponding to the first communication connection.

[0154] After the first node and the second node determine that the first key used for communication authentication is updated to the second key, during the period when the first communication connection is released and the second communication connection is not successfully established, the wireless resources corresponding to the first communication connection are suspended and not released, which can effectively facilitate the rapid recovery of the communication link.

[0155] It should be noted that the contents of information 1 to 4 included in the above release request are merely an enumeration of the information included in the release request, and do not constitute a limitation on the information included in the release request.

[0156] In addition, the release request received by the first node from the second node may include but is not limited to:

[0157] The release request may be an improvement based on the signaling transmitted between the first node and the second node, or the release request may be carried in the signaling transmitted between the first node and the second node. For example, in actual applications, the release request may be carried in the signaling sent from the first node to the second node to indicate the second key; or, the release request may be new signaling between the first node and the second node.

[0158] Further, the second node releases the first communication connection with the first node.

[0159] It should be understood that in an optional manner in the present application, after receiving the second key, the second node can determine that the key has been updated. Therefore, the second node can trigger the release of the first communication connection with the first node and establish a second communication connection based on the second key for communication authentication.

[0160] Furthermore, based on the situation that the second node sends a release request for the first communication connection to the first node, the second node may also receive a release request response from the first node to notify the first node of the release of the first communication connection.

[0161] Optionally, the second node may release the first communication connection with the first node before executing S302, that is, the second node releases the first communication connection with the first node after obtaining the second key; or, the second node may release the first communication connection with the first node after executing S302, that is, the second node releases the first communication connection with the first node after sending a release request for the first communication connection to the first node; or, the second node may also release the first communication connection with the first node after receiving a release request response from the first node and determining that the first node has completed the release of the first communication connection.

[0162] S303: The first node receives a release request for the first communication connection from the second node.

[0163] Further, the first node releases the first communication connection with the second node.

[0164] It should be understood that, in an optional manner in the present application, after receiving a release request for the first communication connection from the second node, the first node may trigger the release of the first communication connection with the second node.

[0165] Furthermore, the first node may also send a response based on the release request to the second node, so as to notify the second node of the release status of the first communication connection.

[0166] S304: The first node sends a connection establishment request to the second node, where the connection establishment request is used to request to establish a connection based on the second key.

[0167] Optionally, the connection establishment request sent by the first node to the second node may include but is not limited to:

[0168] The connection establishment request may be an improvement based on the signaling transmitted between the first node and the second node, or the connection establishment request may be carried in the signaling transmitted between the first node and the second node; or, the connection establishment request may be new signaling between the first node and the second node.

[0169] The connection establishment request may include one or more of the following information 1 to information 4:

[0170] Information 1: Request reason information, which is used to indicate the key update for communication authentication.

[0171] Information 2: Request time, which indicates the time when the first node sends the connection establishment request. Optionally, the request time can be represented by a timestamp.

[0172] Information 3: connection establishment time, which is used to indicate the time when the first node establishes the second communication connection with the second node.

[0173] Exemplarily, the connection establishment time may indicate a specific time, for example, the specific time is the first minute after the second node receives the connection establishment request. In this case, after receiving the connection establishment request, the second node establishes a second communication connection with the first node within the first minute after receiving the connection establishment request according to the connection establishment time included in the connection establishment request. Alternatively, the connection establishment time may indicate a specific time period. For example, the specific time period is within five minutes after the second node receives the connection establishment request. In this case, after receiving the connection establishment request, the second node establishes a second communication connection with the first node within five minutes after receiving the connection establishment request according to the connection establishment time included in the connection establishment request.

[0174] Information 4: Information indicating that the connection has been restored.

[0175] It is understandable that the connection establishment request may be a connection restoration request between the first node and the second node. That is, after the first communication connection between the first node and the second node is released, the first node and the second node need to establish a second communication connection for communication authentication based on the second key. In this case, the first node may send a connection restoration request to the second node, and after receiving the connection restoration request, the second node establishes a communication connection with the first node.

[0176] It should be noted that the contents of information 1 to 4 included in the above connection establishment request are merely an enumeration of the information included in the connection establishment request, and do not constitute a limitation on the information included in the connection establishment request.

[0177] S305: The second node receives the connection establishment request sent by the first node.

[0178] Furthermore, the connection establishment request is used to request to establish a connection based on the second key, and may include: the connection establishment request is used to request to perform authentication and security context negotiation processes based on the second key.

[0179] Optionally, the authentication and security context negotiation process may include an identity authentication process of the first and second nodes (eg, interaction of authentication information and authentication response).

[0180] The content of the identity authentication process of the first and second nodes may be as follows:

[0181] First, after the second node receives the connection establishment request sent by the first node, the second node sends authentication information based on the second key to the first node. The authentication information is used to verify the identity of the second node. The authentication information is used to verify the identity of the second node. This means that the first node can use the authentication information to verify whether the second communication connection with the second node can be established based on the second key.

[0182] Optionally, the authentication information may include an authentication vector calculated by the second node using the second key.

[0183] The first node then receives authentication information based on the second key from the second node. After determining that the second node has passed authentication, the first node sends an authentication response to the authentication information to the second node, where the authentication response is used to verify the identity of the first node. The authentication response is used to verify the identity of the first node, which can be understood as the second node being able to verify, through the authentication response, whether a second communication connection can be established with the first node based on the second key.

[0184] Optionally, the first node may determine whether the second node passes the authentication based on the authentication vector calculated by the second node using the second key and included in the received authentication information.

[0185] Exemplarily, after receiving the authentication information, the first node obtains the first authentication vector calculated by the second node based on the second key in the authentication information. The first node calculates a second authentication vector based on the second key, and then compares the first authentication vector with the second authentication vector. If the first authentication vector and the second authentication vector meet authentication requirements (for example, the authentication requirements may be that the first authentication vector and the second authentication vector are identical, or that the sum of the first authentication vector and the second authentication vector is zero), the first node determines that the second node has passed authentication. If the first authentication vector and the second authentication vector do not meet the authentication requirements, the first node determines that the second node has failed authentication.

[0186] Finally, the second node receives the authentication response sent by the first node, and performs identity authentication on the first node based on the authentication response.

[0187] Through the above method, after the first node and the second node determine the updated key, they release the connection and then use the new key to establish a connection, realizing the switching of different communication connections and the update process of the key used for communication authentication, which effectively improves the security of communication.

[0188] In order to better introduce the communication method provided by this application, based on Figure 3 The content shown is further introduced in detail in combination with the following two scenarios. Some steps in the scenarios involved below may be optional, and the order of steps does not represent the actual execution order. Therefore, this application is not limited to execution in full accordance with the steps and order below.

[0189] Scenario 1: After obtaining the second key, the first node actively releases the first communication connection.

[0190] See Figure 4 As shown, the method corresponding to this scenario can perform the following steps.

[0191] S400: A first node and a second node establish a first communication connection based on a first key.

[0192] S401: A first node obtains a second key for communication authentication with a second node.

[0193] S402: The second node obtains a second key for communication authentication with the first node.

[0194] S403: The second node releases the first communication connection with the first node.

[0195] S404: The first node releases the first communication connection with the second node.

[0196] S405: The first node sends a connection establishment request to the second node, where the connection establishment request is used to request to establish a connection based on the second key.

[0197] S406: The second node receives the connection establishment request sent by the first node.

[0198] S407: The second node sends authentication information based on the second key to the first node, where the authentication information is used to verify the identity of the second node.

[0199] S408: The first node receives authentication information based on the second key from the second node.

[0200] S409: The first node determines whether the second node passes the authentication. If so, execute S410; if not, execute S411.

[0201] S410: The first node sends an authentication response to the authentication information to the second node. The authentication response is used to verify the identity of the first node, and the process proceeds to S412.

[0202] Optionally, the authentication response includes authentication information generated based on the second key.

[0203] The authentication information may include one or more of the following information:

[0204] Information 1: an authentication vector obtained by the first node based on the second key, for example, the second authentication vector in the example content of step S305 above.

[0205] Information 2: Authentication result of the first node on the second node.

[0206] It should be noted that the contents of information 1 to 2 included in the above authentication information are merely an enumeration of the information included in the authentication information, and do not constitute a limitation on the information included in the authentication information.

[0207] S411 : After determining that the second node fails to authenticate the second communication connection based on the second key, the first node terminates the communication transmission.

[0208] Among them, an optional method of the present application is that after the first node determines that the second node authentication fails, the second node can also initiate communication authentication based on the second key again, and terminate the communication transmission when the number of authentication failures reaches a threshold number of failures.

[0209] For example, assuming the threshold number of failures is 2, after the first node determines that the communication authentication of the second node based on the second key has failed for the first time, the first node may send an authentication failure message to the second node. After receiving the authentication failure message, the second node may again send authentication information based on the second key to the first node for re-authentication.

[0210] The first node again receives authentication information based on the second key from the second node and performs communication authentication. If the first node determines that communication with the second node based on the second key still fails during the second authentication, the first node determines that the number of authentication failures has reached a threshold number of failures (two), and terminates the communication transmission.

[0211] Similarly, it can be understood that if the second node receives the message of failed communication authentication based on the second key twice in a row, the second node can terminate the communication transmission; or, after determining to terminate the communication transmission, the first node can send a message to terminate the communication transmission to the second node, and the second node terminates the communication transmission after receiving the message to terminate the communication transmission from the first node.

[0212] S412: The second node receives the authentication response sent from the first node.

[0213] Optionally, the second node that receives the authentication response can determine whether the first node has passed the authentication based on the authentication information generated based on the second key contained in the authentication response. The specific judgment method can refer to the judgment method of the first node mentioned above. For the sake of brevity, it will not be repeated here.

[0214] S413: The second node determines whether the first node passes the authentication. If so, execute S414; if not, execute S415.

[0215] S414: After determining that the second node has passed the authentication, the second node establishes a second communication connection with the first node, and then proceeds to S416.

[0216] S415: After determining that the first node fails to authenticate the second communication connection based on the second key, the second node terminates the communication transmission.

[0217] In an optional manner in the present application, the second node may send a message to the first node to terminate the communication transmission after determining to terminate the communication transmission. After receiving the message from the second node to terminate the communication transmission, the first node terminates the communication transmission.

[0218] S416: After completing the establishment of the second communication connection with the second node, the first node notifies the second node that the establishment of the second communication connection is complete.

[0219] S417: The first node transmits information with the third node through the backhaul link between the second node and the third node.

[0220] It should be understood that in Figure 4 In the method flow shown, the step numbers do not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiment of the present application. For example, S402 can take precedence over S401. In addition, in the example Figure 4 The method flow shown is not limited to the above steps, and any additions, deletions, and modifications to the above steps fall within the scope of protection of this application.

[0221] Scenario 2: After receiving the release request for the first communication connection sent by the second node, the first node releases the first communication connection.

[0222] See Figure 5 As shown, the method corresponding to scenario 2 can perform the following steps.

[0223] S500: A first node and a second node establish a first communication connection based on a first key.

[0224] S501: A first node obtains a second key for communication authentication with a second node.

[0225] S502: The second node obtains a second key for communication authentication with the first node.

[0226] S503: The second node releases the first communication connection with the first node.

[0227] S504: The second node sends a release request for the first communication connection to the first node.

[0228] S505: The first node receives a release request for the first communication connection from the second node.

[0229] S506: The first node releases the first communication connection with the second node.

[0230] S507: The first node sends a connection establishment request to the second node, where the connection establishment request is used to request to establish a connection based on the second key.

[0231] S508: The second node receives the connection establishment request sent by the first node.

[0232] S509: The second node sends authentication information based on the second key to the first node, where the authentication information is used to verify the identity of the second node.

[0233] S510: The first node receives authentication information based on the second key from the second node.

[0234] S511: The first node determines whether the second node passes authentication. If so, execute S412; if not, execute S413.

[0235] S512: After determining that the second node has passed the authentication, the first node sends an authentication response for the authentication information to the second node. The authentication response is used to verify the identity of the first node, and the process continues with S514.

[0236] S513: After determining that the second node fails to authenticate the second communication connection based on the second key, the first node terminates the communication transmission.

[0237] S514: The second node receives the authentication response sent from the first node.

[0238] In the present application, optionally, the second node that receives the authentication response can determine whether the first node has passed the authentication based on the authentication information generated based on the second key contained in the authentication response. The specific judgment method can refer to the judgment method of the first node mentioned above. For the sake of brevity, it will not be repeated here.

[0239] S515: The second node determines whether the first node passes the authentication. If so, execute S516; if not, execute S517.

[0240] S516: After determining that the second node has passed the authentication, the second node establishes a second communication connection with the first node, and then proceeds to S518.

[0241] S517: After determining that the first node fails to authenticate the second communication connection based on the second key, the second node terminates the communication transmission.

[0242] S518: After completing the establishment of the second communication connection with the second node, the first node notifies the second node that the establishment of the second communication connection is complete.

[0243] S519: The first node transmits information with the third node through the backhaul link between the second node and the third node.

[0244] It should be understood that in Figure 5 In the method flow shown, the step numbers do not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiment of the present application. For example, S502 can take precedence over S501. In addition, in the example Figure 5 The method flow shown is not limited to the above steps, and any additions, deletions, and modifications to the above steps fall within the scope of protection of this application.

[0245] Furthermore, in order to effectively save system overhead, the second node may suspend the backhaul link after releasing the first communication connection with the first node. Then, after the second node determines that the second communication connection with the first node is successfully established, the backhaul link may be activated.

[0246] The following describes the operations of suspending and activating the backhaul link during communication, based on the above scenario 2. Figure 6 As shown, the corresponding method flow is as follows:

[0247] S600: A first node and a second node establish a first communication connection based on a first key.

[0248] S601: A first node obtains a second key for communication authentication with a second node.

[0249] S602: The second node obtains a second key for communication authentication with the first node.

[0250] S603: The second node releases the first communication connection with the first node.

[0251] S604: The second node suspends the backhaul link with the third node.

[0252] S605: The second node sends a release request for the first communication connection to the first node.

[0253] S606: The first node receives a release request for the first communication connection from the second node.

[0254] S607: The first node releases the first communication connection with the second node.

[0255] S608: The first node sends a connection establishment request to the second node, where the connection establishment request is used to request to establish a connection based on the second key.

[0256] S609: The second node receives a connection establishment request sent by the first node.

[0257] S610: The second node sends authentication information based on the second key to the first node, where the authentication information is used to verify the identity of the second node.

[0258] S611: The first node receives authentication information based on the second key from the second node.

[0259] S612: After determining that the second node has passed the authentication, the first node sends an authentication response for the authentication information to the second node, where the authentication response is used to verify the identity of the first node.

[0260] S613: The second node receives the authentication response sent from the first node.

[0261] S614: After determining that the second node passes the authentication, the second node establishes a second communication connection with the first node.

[0262] S615: After completing the establishment of the second communication connection with the second node, the first node notifies the second node that the establishment of the second communication connection is complete.

[0263] S616: After determining that the second communication connection with the first node is successfully established, the second node activates the backhaul link.

[0264] S617: The first node transmits information with the third node through the backhaul link between the second node and the third node.

[0265] It should be understood that in Figure 6 In the method flow shown, the step numbers do not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiment of the present application. For example, S605 can take precedence over S604. In addition, in the example Figure 6 The method flow shown is not limited to the above steps, and any additions, deletions, and modifications to the above steps fall within the scope of protection of this application.

[0266] This application can effectively reduce system power consumption and save resources by suspending the backhaul link after the connection is released and activating the backhaul link after the connection is established.

[0267] Among them, combined with the situation of the above scenario 1, the content of suspending and activating the return link during the communication process is the same as the above Figure 6 The content is similar, for a concise description, please refer to the above Figure 6 , and the situation of scene 1, delete the above Figure 6 In steps S605 and S606, the content of suspending and activating the backhaul link during the communication process is obtained in combination with the above scenario 1, which will not be described in detail here.

[0268] Furthermore, in order to better ensure the timeliness of the second key and improve the security of communication transmission, the present application can also verify whether the second key is valid during the communication transmission process between the first node and the second node using the second key.

[0269] It can be understood that in the present application, the first node can determine whether the second key is valid, and then notify the second node of the determination result of the second key; or, the second node can determine whether the second key is valid, and then notify the first node of the determination result of the second key; or, both the first node and the second node can determine the validity of the second key.

[0270] In an optional manner in the present application, the second key is valid for a first duration, which can be defined by a timer or a timestamp. The first duration can be counted from a first moment, which can be the moment the first communication connection is released, the moment the second node receives the connection establishment request, and / or the moment the first node sends the connection establishment request, without specific limitation.

[0271] The following describes the situation in the second scenario above, and the situation where both the first node and the second node are selected to determine the validity of the second key. The present application provides multiple verification methods, which are not limited to the following:

[0272] Method 1: The first node and the second node each determine whether the second key is valid based on their respective corresponding timers.

[0273] See Figure 7 As shown, the method flow corresponding to method 1 is as follows:

[0274] S700: A first node and a second node establish a first communication connection based on a first key.

[0275] S701: A first node obtains a second key for communication authentication with a second node.

[0276] S702: The second node obtains a second key for communication authentication with the first node.

[0277] S703: The second node releases the first communication connection with the first node.

[0278] S704: The second node starts a corresponding second timer for determining the validity of the second key.

[0279] The normal operation duration of the second timer is the first duration.

[0280] S705: The second node sends a release request for the first communication connection to the first node.

[0281] S706: The first node receives a release request for the first communication connection from the second node.

[0282] S707: The first node releases the first communication connection with the second node.

[0283] S708: The first node starts a corresponding first timer for determining the validity of the second key.

[0284] The normal operation duration of the first timer is the first duration.

[0285] S709: The first node sends a connection establishment request to the second node, where the connection establishment request is used to request to establish a connection based on the second key.

[0286] S710: The second node receives a connection establishment request sent by the first node.

[0287] S711. The second node sends authentication information based on the second key to the first node, where the authentication information is used to verify the identity of the second node.

[0288] S712: The first node receives authentication information based on the second key from the second node.

[0289] S713: After determining that the second node has passed the authentication, the first node sends an authentication response for the authentication information to the second node, where the authentication response is used to verify the identity of the first node.

[0290] S714: The second node receives the authentication response sent from the first node.

[0291] S715: After determining that the second node passes the authentication, the second node establishes a second communication connection with the first node.

[0292] S716: After completing the establishment of the second communication connection with the second node, the first node notifies the second node that the establishment of the second communication connection is complete.

[0293] S717: The first node turns off the corresponding first timer.

[0294] S718. The first node determines whether the first timer has timed out. If so, execute S719; if not, execute S720.

[0295] S719: The first node determines that the second key is invalid and terminates the communication transmission.

[0296] S720: The first node transmits information with the third node through a backhaul link between the second node and the third node.

[0297] S721: After receiving the notification from the first node that the second communication connection is established, the second node stops the corresponding second timer.

[0298] S722: The second node determines whether the second timer has timed out. If so, execute S723; if not, execute S724.

[0299] S723: The second node determines that the second key is invalid and terminates the communication transmission.

[0300] S724: The second node sends the transmission information from the first node to the third node through the backhaul link between the second node and the third node.

[0301] In this application, optionally, Figure 7 In the method flow shown, the moment when the first node starts the corresponding first timer is not limited to after executing step S707. For example, the moment when the first node starts the corresponding first timer can also be after executing S709. Similarly, the moment when the second node starts the corresponding second timer is not limited to after executing step S704. For example, the moment when the second node starts the corresponding second timer can also be after executing S710.

[0302] It should be understood that in Figure 7 In the method flow shown, the step numbers do not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiment of the present application. For example, S702 can take precedence over S701. In addition, in the example Figure 7 The method flow shown is not limited to the above steps, and any additions, deletions, and modifications to the above steps fall within the scope of protection of this application.

[0303] Among them, combined with the situation of the above scenario 1, the content of the second key validity judgment using method 1 is the same as the above Figure 7 The content is similar, for a concise description, please refer to the above Figure 7 , and the situation of scene 1, delete the above Figure 7 In steps S705 and S706, the content of judging the validity of the second key using method 1 is obtained in combination with the above scenario 1, which will not be repeated here.

[0304] Method 2: The first node and the second node jointly maintain the same timer to determine whether the second key is valid.

[0305] See Figure 8 As shown, the method flow corresponding to method 2 is as follows:

[0306] S800: A first node and a second node establish a first communication connection based on a first key.

[0307] S801: A first node obtains a second key for communication authentication with a second node.

[0308] S802: The second node obtains a second key for communication authentication with the first node.

[0309] S803: The second node releases the first communication connection with the first node.

[0310] S804: The second node starts a timer for determining the validity of the second key.

[0311] S805: The second node sends a release request for the first communication connection to the first node.

[0312] S806: The first node receives a release request for the first communication connection from the second node.

[0313] S807: The first node releases the first communication connection with the second node.

[0314] S808: The first node sends a connection establishment request to the second node, where the connection establishment request is used to request to establish a connection based on the second key.

[0315] S809: The second node receives the connection establishment request sent by the first node.

[0316] S810: The second node sends authentication information based on the second key to the first node, where the authentication information is used to verify the identity of the second node.

[0317] S811. The first node receives authentication information based on the second key from the second node.

[0318] S812: After determining that the second node has passed authentication, the first node sends an authentication response for the authentication information to the second node, where the authentication response is used to verify the identity of the first node.

[0319] S813: The second node receives the authentication response sent from the first node.

[0320] S814: After determining that the second node passes the authentication, the second node establishes a second communication connection with the first node.

[0321] S815: After completing the establishment of the second communication connection with the second node, the first node notifies the second node that the establishment of the second communication connection is complete.

[0322] S816: The first node turns off the timer.

[0323] S817: The first node determines whether the timer has timed out. If so, execute S718; if not, execute S719.

[0324] S818: The first node determines that the second key is invalid and terminates the communication transmission.

[0325] In the present application, optionally, the first node may also notify the second node of the result of the expiration of the second key.

[0326] S819: The first node transmits information with the third node through the backhaul link between the second node and the third node.

[0327] Understandably, the above Figure 8 In the method flow shown, the timer can also be started by the first node and closed by the second node. For example, the first node starts the timer after executing S807, and the second node closes the timer after receiving the notification of completion of the establishment of the second communication connection sent by the first node in S815; similarly, the second node can determine whether the timer has timed out, thereby determining whether the second key is valid.

[0328] It should be understood that in Figure 8 In the method flow shown, the step numbers do not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiment of the present application. For example, S802 can take precedence over S801. In addition, in the example Figure 8 The method flow shown is not limited to the above steps, and any additions, deletions, and modifications to the above steps fall within the scope of protection of this application.

[0329] Among them, combined with the situation of the above scenario 1, the content of the second key validity judgment using method 2 is the same as the above Figure 8 The content is similar, for a concise description, please refer to the above Figure 8 , and the situation of scene 1, delete the above Figure 8 In steps S805 and S806, the content of judging the validity of the second key using method 2 is obtained in combination with the above scenario 1, which will not be repeated here.

[0330] Mode 3: The first node and the second node determine whether the second key is valid based on the timestamp carried in the signaling.

[0331] See Figure 9 As shown, the method flow corresponding to method 3 is as follows:

[0332] S900: A first node and a second node establish a first communication connection based on a first key.

[0333] S901: A first node obtains a second key for communication authentication with a second node.

[0334] S902: The second node obtains a second key for communication authentication with the first node.

[0335] S903: The second node releases the first communication connection with the first node.

[0336] S904: The second node sends a release request for the first communication connection to the first node, where the release request carries a first timestamp.

[0337] The first timestamp may be the time when the second node sends the release request to the first node.

[0338] In the present application, optionally, after the second node sends the release request to the first node, it records the first timestamp.

[0339] S905: The first node receives a release request for the first communication connection from the second node, and obtains the first timestamp.

[0340] S906: The first node releases the first communication connection with the second node.

[0341] S907: The first node sends a connection establishment request to the second node, where the connection establishment request is used to request to establish a connection based on the second key.

[0342] S908: The second node receives the connection establishment request sent by the first node.

[0343] S909: The second node sends authentication information based on the second key to the first node, where the authentication information is used to verify the identity of the second node.

[0344] S910: The first node receives authentication information based on the second key from the second node.

[0345] S911. After determining that the second node has passed authentication, the first node sends an authentication response for the authentication information to the second node. The authentication response is used to verify the identity of the first node.

[0346] S912: The second node receives the authentication response sent from the first node.

[0347] S913: After determining that the second node passes the authentication, the second node establishes a second communication connection with the first node.

[0348] S914. After completing the establishment of the second communication connection with the second node, the first node sends an establishment completion message to the second node, where the establishment completion message carries a second timestamp.

[0349] The establishment completion message is used to notify the second node that the first node has completed the establishment of the second communication connection.

[0350] The second timestamp may be the time when the first node sends the establishment completion message to the second node; or, the second timestamp may be the time when the first node completes the establishment of the second communication connection.

[0351] In the present application, optionally, the first node records the second timestamp.

[0352] S915. The first node determines whether the time difference between the second timestamp and the first timestamp is not greater than the first time difference. If so, execute S916; if not, execute S917.

[0353] S916. The first node transmits information with the third node through the backhaul link between the second node and the third node.

[0354] S917: The first node determines that the second key is invalid and terminates the communication transmission.

[0355] S918. After receiving the establishment completion message, the second node obtains the second timestamp.

[0356] S919: The second node determines whether the time difference between the second timestamp and the first timestamp is not greater than the first time difference. If so, execute S920; if not, execute S921.

[0357] S920: The second node sends the transmission information from the first node to the third node through the backhaul link between the second node and the third node.

[0358] S921: The second node determines that the second key is invalid and terminates the communication transmission.

[0359] It should be understood that Figure 9 The method flow shown is only an example of the first node and the second node determining whether the second key is valid through a timestamp. It does not constitute a method limitation for determining whether the second key is valid through a timestamp, nor is it limited to the above steps. Any additions, deletions, and modifications to the above steps fall within the scope of protection of this application.

[0360] Among them, combined with the situation of the above scenario 1, the content of the second key validity judgment using method 3 is the same as the above Figure 9 The content is similar, for a concise description, please refer to the above Figure 9 , and the situation of scene 1, delete the above Figure 9 In steps S904 and S905, the content of judging the validity of the second key using method 3 is obtained in combination with the above scenario 1, which will not be repeated here.

[0361] This application further verifies whether the second key is valid during the communication transmission between the first node and the second node using the second key, thereby ensuring the timeliness of the second key and better ensuring the security of communication transmission.

[0362] So far, it has been combined Figures 3 to 9 The communication system of the present application and the communication method implemented in the present application are introduced in detail. In the communication scheme, the present application provides a communication method in the scenario of integrated communication of different communication systems, which effectively improves the security of communication.

[0363] In addition, the above Figures 3 to 9 The content does not constitute a limitation on the communication method provided in this application. Figures 3 to 9 The variations of the contents of the present application are all within the scope of protection of this application. For example, the above Figure 4 , Figure 6 as well as Figure 7 By combining the contents of , we can obtain a communication solution in which, in scenario one, the present application suspends and activates the return link and verifies the validity of the second key, which can better reduce system overhead and improve communication security.

[0364] The methods and devices are based on the same or similar technical concepts. Since the methods and devices solve similar problems, their implementation can refer to each other, and any repetitions will not be repeated. The terms "system" and "network" in the embodiments of this application are used interchangeably. In the description of the embodiments of this application, "and / or" describes the association relationship between associated objects, indicating that three relationships can exist. For example, "A and / or B" can represent: A exists alone, A and B exist simultaneously, or B exists alone. The character " / " generally indicates that the associated objects are in an "or" relationship. In this application, "at least one" refers to one or more; "a plurality" refers to two or more. Furthermore, it should be understood that in the description of this application, terms such as "first," "second," and "third" are used solely for descriptive purposes and should not be construed to indicate or imply relative importance or order. References to "one embodiment" or "some embodiments" in this specification mean that one or more embodiments of this application include specific features, structures, or characteristics described in conjunction with that embodiment. Thus, phrases such as "in one embodiment," "in some embodiments," "in other embodiments," and "in yet other embodiments" appearing in various places in this specification do not necessarily all refer to the same embodiment, but rather mean "one or more but not all embodiments," unless otherwise specifically emphasized. The terms "including," "comprising," "having," and variations thereof all mean "including but not limited to," unless otherwise specifically emphasized.

[0365] The following combination Figure 10 and Figure 11 The apparatus provided in the embodiments of the present application will be described in detail. It should be understood that the description of the apparatus embodiment corresponds to the description of the method embodiment. Therefore, the contents not described in detail can be referred to in the other.

[0366] Figure 10 1 is a schematic block diagram of an apparatus 1000 provided in an embodiment of the present application, which is used to implement the functions of the first apparatus or the second apparatus in the method embodiment above. For example, the apparatus may be a software module or a chip system. The chip may be composed of a chip or may include a chip and other discrete devices. The apparatus 1000 includes a processing unit 1001 and a communication unit 1002. The communication unit 1002 is used to communicate with other devices and may also be referred to as a communication interface, a transceiver unit, or an input / output interface.

[0367] In some embodiments, the apparatus 1000 described above may be used to implement the functions of the first apparatus in the above method. The apparatus 1000 may be the first apparatus, or a chip or circuit configured in the first apparatus. The processing unit 1001 may be used to execute the processing-related operations of the first apparatus in the above method embodiment, and the communication unit 1002 may be used to instruct the first apparatus in the above method embodiment to perform the transmission and reception-related operations.

[0368] For example, the processing unit 1001 is used to obtain a second key for communication authentication with the second node, where the second key is different from the pre-configured first key; the communication unit 1002 is used to receive a release request for a first communication connection from the second node, where the first key is used for communication authentication of the first communication connection; the communication unit 1002 is also used to send a connection establishment request to the second node, where the connection establishment request is used to request to establish a connection based on the second key.

[0369] Optionally, the connection establishment request is used to request establishment of a connection based on the second key, including the connection establishment request being used to request execution of authentication and security context negotiation processes based on the second key.

[0370] Optionally, the communication unit 1002 is further used to receive authentication information based on the second key from the second node; the authentication information is used to verify the identity of the second node.

[0371] Optionally, the authentication information is used to verify the identity of the second node, including the authentication information being used to verify whether a second communication connection is established with the second node based on the second key.

[0372] Optionally, the communication unit 1002 is further configured to send an authentication response based on the second key to the second node, where the authentication response is used to verify the identity of the first node.

[0373] Optionally, the authentication response is used to verify the identity of the first node, including being used by the second node to verify whether the second communication connection is established with the first node based on the second key.

[0374] Optionally, the release request includes request reason information; the request reason information is used to indicate the key update for communication authentication.

[0375] Optionally, the second key is valid for a first duration, and the first duration is defined by a timer or a timestamp.

[0376] Optionally, the second key is valid for a first duration starting from a first moment, where the first moment is a moment when the first communication connection is released, or a moment when the connection establishment request is sent.

[0377] Optionally, the processing unit 1001 is further configured to transmit information with the third node via a backhaul link between the second node and the third node during the validity period of the second key.

[0378] Optionally, the first key is a key derived (or negotiated) based on a first communication system, and / or the second key is a key derived (or negotiated) based on a second communication system, and the first communication system is different from the second communication system.

[0379] In other embodiments, the apparatus 1000 described above may be used to implement the functions of the second apparatus in the above method embodiments. The apparatus 1000 may be the second apparatus, or a chip or circuit configured in the second apparatus. The processing unit 1001 may be used to perform processing-related operations of the second apparatus in the above method embodiments, and the communication unit 1002 may be used to perform transceiver-related operations of the second apparatus in the above method embodiments.

[0380] For example, the processing unit 1001 is used to obtain a second key for communication authentication with the first node, where the second key is different from the pre-configured first key; the communication unit 1002 is used to send a release request for a first communication connection to the first node, where the first key is used for communication authentication of the first communication connection; the communication unit 1002 is also used to receive a connection establishment request sent from the first node, where the connection establishment request is used to request to establish a connection based on the second key.

[0381] Optionally, the connection establishment request is used to request establishment of a connection based on the second key, including the connection establishment request being used to request execution of authentication and security context negotiation processes based on the second key.

[0382] Optionally, the communication unit 1002 is further used to send authentication information based on the second key to the first node; the authentication information is used to verify the identity of the second node.

[0383] Optionally, the authentication information is used to verify the identity of the second node, including the authentication information being used by the first node to verify whether a second communication connection is established with the second node based on the second key.

[0384] Optionally, the first key is a key derived (or negotiated) based on a first communication system, and / or the second key is a key derived (or negotiated) based on a second communication system, and the first communication system is different from the second communication system.

[0385] Optionally, the communication unit 1002 is further used to receive an authentication response based on the second key from the first node; the authentication response is used to verify the identity of the first node.

[0386] Optionally, the authentication response is used to verify the identity of the first node, including the authentication response being used by the second node to verify whether the second communication connection is established with the first node based on the second key.

[0387] Optionally, the release request includes request reason information; the request reason information is used to indicate the key update for communication authentication.

[0388] Optionally, the second key is valid for a first duration, and the first duration can be defined by a timer or a timestamp.

[0389] Optionally, the second key is valid for a first duration starting from a first moment, where the first moment is a moment when the first communication connection is released, or a moment when the second node receives the connection establishment request.

[0390] Optionally, the processing unit 1001 is further configured to send, within the validity period of the second key, the transmission information from the first node to the third node via a backhaul link between the second node and the third node.

[0391] Optionally, after releasing the first communication connection with the first node, the processing unit 1001 is further configured to suspend the backhaul link.

[0392] Optionally, the processing unit 1001 is further configured to activate the backhaul link after determining that a second communication connection is successfully established with the first node; the second communication connection is authenticated based on the second key.

[0393] The division of units in the embodiments of the present application is illustrative and is merely a logical functional division. In actual implementation, other division methods may be used. Furthermore, in the embodiments of the present application, each functional unit may be integrated into a single processor, or may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0394] See Figure 11 , Figure 11 This is a schematic diagram of an apparatus 1100 provided in an embodiment of the present application. The apparatus 1100 may be a node, or a component of a node, such as a chip or integrated circuit. The apparatus 1100 may include at least one processor 1102 and a communication interface 1104. Furthermore, the apparatus may optionally include at least one memory 1101. Furthermore, it may optionally include a bus 1103. The memory 1101, processor 1102, and communication interface 1104 are connected via bus 1103.

[0395] Among them, the memory 1101 is used to provide a storage space in which data such as an operating system and a computer program can be stored. The memory 1101 mentioned in the embodiment of the present application can be a volatile memory or a non-volatile memory, or can include both volatile and non-volatile memories. Among them, the non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory can be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link DRAM (SLDRAM), and direct RAM bus random access memory (DR RAM).

[0396] It should be noted that the memory described herein is intended to include, but is not limited to, these and any other suitable types of memory. The processor 1102 is a module that performs arithmetic operations and / or logical operations, and can specifically be a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MPU), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA), a complex programmable logic device (CPLD), a coprocessor (to assist the central processing unit in completing corresponding processing and applications), a microcontroller unit (MCU), and other processing modules, or a combination of multiple thereof.

[0397] It should be noted that when the processor is a general-purpose processor, ASIC, FPGA or other programmable logic device, discrete gate or transistor logic device, or discrete hardware component, the memory (storage module) can be integrated into the processor.

[0398] The communication interface 1104 can be used to provide information input or output for the at least one processor. And / or the communication interface can be used to receive data sent externally and / or send data externally. It can be a wired link interface such as an Ethernet cable, or a wireless link interface (Wi-Fi, Bluetooth, general wireless transmission, vehicle-mounted short-range communication technology, etc.). Optionally, the communication interface 1104 can also include a transmitter (such as a radio frequency transmitter, antenna, etc.) or a receiver coupled to the interface.

[0399] In some embodiments, the apparatus 1100 may be the first apparatus or a component of the first apparatus in the above method embodiment, such as a chip or an integrated circuit. The processor 1102 in the apparatus 1100 is configured to read the computer program stored in the memory 1101 and control the first apparatus to perform the following operations:

[0400] Obtain a second key for communication authentication with a second node, where the second key is different from a pre-configured first key; receive a release request for a first communication connection from the second node, where the first key is used for communication authentication of the first communication connection; and send a connection establishment request to the second node, where the connection establishment request is used to request establishment of a connection based on the second key.

[0401] Optionally, the processor 1102 in the first device may also be configured to read the program in the memory 1101 and execute the following program: Figure 3 The method flow executed by the first node in S300 to S305 shown in FIG. 1 ; or Figure 4 The method flow executed by the first node in S400 to S417 shown in FIG. 1 ; or executing the method flow as shown in FIG. Figure 5 The method flow executed by the first node in S500 to S519 shown in FIG. 1 ; or executing the method flow as shown in FIG. Figure 6 The method flow executed by the first node in S600 to S617 shown in FIG. 1 ; or executing the method flow as shown in FIG. Figure 7 The method flow executed by the first node in S700 to S724 shown in FIG. 1 ; or executing the method flow as shown in FIG. Figure 8 The method flow executed by the first node in S800 to S819 shown in FIG. 1 ; or executing the method flow as shown in FIG. Figure 9 The method flow executed by the first node in S900 to S921 is shown.

[0402] For specific details, please refer to the description in the above method embodiment, which will not be repeated here.

[0403] In other embodiments, the apparatus 1100 may be the second apparatus or a component of the second apparatus in the above method embodiment, such as a chip or an integrated circuit. The processor 1102 in the apparatus 1100 is configured to read the computer program stored in the memory 1101 and control the second apparatus to perform the following operations:

[0404] Obtain a second key for communication authentication with a first node, where the second key is different from a pre-configured first key; send a release request for a first communication connection to the first node, where the first key is used for communication authentication of the first communication connection; receive a connection establishment request sent from the first node, where the connection establishment request is used to request to establish a connection based on the second key.

[0405] Optionally, the processor 1102 in the second device can also be used to read the program in the memory 1101 and execute the following program: Figure 3 The method flow executed by the second node in S300 to S305 shown in FIG. 1 ; or Figure 4 The method flow executed by the second node in S400 to S417 shown in FIG. 1 ; or executing the method flow as shown in FIG. Figure 5 The method flow executed by the second node in S500 to S519 shown in FIG. 10 ; or executing the method flow as shown in FIG. Figure 6 The method flow executed by the second node in S600 to S617 shown in FIG. 1 ; or executing the method flow as shown in FIG. Figure 7 The method flow executed by the second node in S700 to S724 shown in FIG. 1 ; or executing the method flow as shown in FIG. Figure 8 The method flow executed by the second node in S800 to S819 shown in FIG. 10 ; or executing the method flow as shown in FIG. Figure 9 The method flow executed by the second node in S900 to S921 is shown.

[0406] For specific details, please refer to the description in the above method embodiment, which will not be repeated here.

[0407] The embodiment of the present application also provides a terminal, which can be a smart phone, notebook, tablet computer or other intelligent terminal with short-range communication function, mouse, keyboard, earphone, audio or car playback equipment. The terminal includes a first device and / or a second device, and the first device and the second device can be the above-mentioned Figure 3 The first node and the second node in the embodiment shown are shown in FIG. The first device and the second device may be of the same or different types.

[0408] in, Figure 12 The following is a simplified schematic diagram of the terminal device. Figure 12In this article, the terminal device is a mobile phone. Figure 12 As shown, the terminal device includes a processor, a memory, a radio frequency circuit, an antenna, and input and output devices. The processor is mainly used to process communication protocols and communication data, as well as to control the terminal device, execute software programs, process software program data, etc. The memory is mainly used to store software programs and data. The radio frequency circuit is mainly used to convert baseband signals into radio frequency signals and process radio frequency signals. The antenna is mainly used to transmit and receive radio frequency signals in the form of electromagnetic waves. Input and output devices, such as touch screens, displays, keyboards, etc., are mainly used to receive data input by users and output data to users. It should be noted that some types of terminal devices may not have input and output devices.

[0409] When data needs to be sent, the processor performs baseband processing on the data to be sent and outputs the baseband signal to the RF circuit. The RF circuit performs RF processing on the baseband signal and then transmits the RF signal to the outside in the form of electromagnetic waves through the antenna. When data is sent to the terminal device, the RF circuit receives the RF signal through the antenna, converts the RF signal into a baseband signal, and outputs the baseband signal to the processor. The processor converts the baseband signal into data and processes the data. For the sake of explanation, Figure 12 Only one memory and processor are shown. In actual terminal device products, one or more processors and one or more memories may exist. Memory may also be referred to as a storage medium or storage device. The memory may be provided independently of the processor or integrated with the processor, and this is not limited in the embodiments of the present application.

[0410] In the embodiment of the present application, the antenna and radio frequency circuit with transceiver functions can be regarded as the transceiver unit of the terminal device, and the processor with processing function can be regarded as the processing unit of the terminal device. Figure 12 As shown, the terminal device includes a transceiver unit 1210 and a processing unit 1220. The transceiver unit may also be referred to as a transceiver, transceiver, or transceiver device. The processing unit may also be referred to as a processor, processing board, processing module, or processing device. Optionally, the device in the transceiver unit 1210 that implements the receiving function may be considered a receiving unit, and the device in the transceiver unit 1210 that implements the transmitting function may be considered a transmitting unit, i.e., the transceiver unit 1210 includes a receiving unit and a transmitting unit. The transceiver unit may also be referred to as a transceiver, transceiver, or transceiver circuit. The receiving unit may also be referred to as a receiver, receiver, or receiving circuit. The transmitting unit may also be referred to as a transmitter, transmitter, or transmitting circuit.

[0411] It should be understood that the transceiver unit 1210 is used to perform the above Figure 3 In the method embodiment shown in FIG. 1 , the first node side sends and receives the operation, and the processing unit 1220 is used to perform the above Figure 3 In the illustrated method embodiment, the first node side performs other operations besides the sending and receiving operations.

[0412] For example, in one implementation, the transceiver unit 1210 is configured to execute Figure 3 The sending and receiving steps on the terminal device side in the embodiment shown, such as S303 and S305, and / or other processes used to support the technology described herein. The processing unit 1220 is used to execute Figure 3 The terminal device side in the illustrated embodiment may perform other operations besides the sending and receiving operations, such as S300 , and / or other processes for supporting the technology described herein.

[0413] Alternatively, the transceiver unit 1210 is used to perform the above Figure 4 In the method embodiment shown in FIG. 1 , the sending operation and the receiving operation on the terminal device side are performed by the processing unit 1220. Figure 4 The method embodiment shown includes other operations on the terminal device side in addition to the sending and receiving operations.

[0414] For example, in one implementation, the transceiver unit 1210 is configured to execute Figure 4 The sending and receiving steps on the terminal device side in the embodiment shown, such as S406, and / or other processes used to support the technology described herein. The processing unit 1220 is used to execute Figure 4 The terminal device side in the illustrated embodiment may perform other operations besides the sending and receiving operations, such as S409 , and / or other processes for supporting the technology described herein.

[0415] Alternatively, the transceiver unit 1210 is used to perform the above Figure 5 In the method embodiment shown in FIG. 1 , the sending operation and the receiving operation on the terminal device side are performed by the processing unit 1220. Figure 5 The method embodiment shown includes other operations on the terminal device side in addition to the sending and receiving operations.

[0416] For example, in one implementation, the transceiver unit 1210 is configured to execute Figure 5 The sending and receiving steps on the terminal device side in the embodiment shown, such as S508, and / or other processes used to support the technology described herein. The processing unit 1220 is used to execute Figure 5 The terminal device side in the illustrated embodiment may perform other operations besides the sending and receiving operations, such as S511, and / or other processes for supporting the technology described herein.

[0417] Alternatively, the transceiver unit 1210 is used to perform the above Figure 6 In the method embodiment shown in FIG. 1 , the sending operation and the receiving operation on the terminal device side are performed by the processing unit 1220. Figure 6The method embodiment shown includes other operations on the terminal device side in addition to the sending and receiving operations.

[0418] For example, in one implementation, the transceiver unit 1210 is configured to execute Figure 6 The sending and receiving steps on the terminal device side in the embodiment shown, such as S606, and / or other processes used to support the technology described herein. The processing unit 1220 is used to execute Figure 6 The terminal device side in the illustrated embodiment may perform other operations besides the sending and receiving operations, such as S604, and / or other processes for supporting the technology described herein.

[0419] Alternatively, the transceiver unit 1210 is used to perform the above Figure 7 In the method embodiment shown in FIG. 1 , the sending operation and the receiving operation on the terminal device side are performed by the processing unit 1220. Figure 7 The method embodiment shown includes other operations on the terminal device side in addition to the sending and receiving operations.

[0420] For example, in one implementation, the transceiver unit 1210 is configured to execute Figure 7 The sending and receiving steps on the terminal device side in the embodiment shown, such as S706, and / or other processes used to support the technology described herein. The processing unit 1220 is used to execute Figure 7 The terminal device side in the illustrated embodiment may perform other operations besides the sending and receiving operations, such as S704, and / or other processes for supporting the technology described herein.

[0421] Alternatively, the transceiver unit 1210 is used to perform the above Figure 8 In the method embodiment shown in FIG. 1 , the sending operation and the receiving operation on the terminal device side are performed by the processing unit 1220. Figure 8 The method embodiment shown includes other operations on the terminal device side in addition to the sending and receiving operations.

[0422] For example, in one implementation, the transceiver unit 1210 is configured to execute Figure 8 The sending and receiving steps on the terminal device side in the embodiment shown, such as S806, and / or other processes used to support the technology described herein. The processing unit 1220 is used to execute Figure 8 The terminal device side in the illustrated embodiment may perform other operations besides the sending and receiving operations, such as S804, and / or other processes for supporting the technology described herein.

[0423] Alternatively, the transceiver unit 1210 is used to perform the above Figure 9 In the method embodiment shown in FIG. 1 , the sending operation and the receiving operation on the terminal device side are performed by the processing unit 1220. Figure 9The method embodiment shown includes other operations on the terminal device side in addition to the sending and receiving operations.

[0424] For example, in one implementation, the transceiver unit 1210 is configured to execute Figure 9 The sending and receiving steps on the terminal device side in the embodiment shown, such as S905, and / or other processes used to support the technology described herein. The processing unit 1220 is used to execute Figure 9 The terminal device side in the illustrated embodiment may perform other operations besides the sending and receiving operations, such as S915, and / or other processes for supporting the technology described herein.

[0425] When the communication device is a chip, the chip includes a transceiver unit and a processing unit, wherein the transceiver unit may be an input / output circuit or a communication interface; and the processing unit may be a processor, microprocessor, or integrated circuit integrated on the chip.

[0426] An embodiment of the present application further provides a computer-readable storage medium comprising instructions, which, when executed on a computer, enables the computer to execute the method described in the above embodiment.

[0427] The present application also provides a chip system, which includes at least one processor and an interface circuit. Optionally, the chip system may also include a memory or an external memory. The processor is configured to execute instructions and / or data interactions through the interface circuit to implement the method in the above method embodiment. The chip system may be composed of a chip, or may include a chip and other discrete devices.

[0428] An embodiment of the present application further provides a computer program product, comprising instructions, which, when executed on a computer, enables the computer to execute the method described in the above embodiment.

[0429] In the embodiments of the present application, the processor may be a general-purpose processor, a digital signal processor, an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component, a coprocessor, etc., and may implement or execute the various methods, steps, and logic block diagrams disclosed in the embodiments of the present application. The general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of the methods disclosed in the embodiments of the present application may be directly implemented as being executed by a hardware processor, or may be executed by a combination of hardware and software modules in the processor.

[0430] In an embodiment of the present application, the memory may be a non-volatile memory, such as a hard disk drive (HDD) or a solid-state drive (SSD), etc., or a volatile memory (volatile memory), such as a random-access memory (RAM). The memory is any other medium that can be used to carry or store desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory in an embodiment of the present application may also be a circuit or any other device that can implement a storage function, for storing program instructions and / or data.

[0431] The methods provided in the embodiments of the present application can be implemented in whole or in part by software, hardware, firmware, or any combination thereof. When implemented using software, they can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the processes or functions described in the embodiments of the present application are generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, a network device, a user device, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via a wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) method. The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server or data center that includes one or more available media integrated therein. The available medium may be a magnetic medium (eg, a floppy disk, a hard disk, a magnetic tape), an optical medium (eg, a digital video disc (DVD)), or a semiconductor medium (eg, an SSD).

[0432] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0433] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0434] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0435] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0436] Obviously, those skilled in the art may make various changes and modifications to the present application without departing from the scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is intended to include these modifications and variations.

Claims

1. A communication method, characterized in that: The method comprises: Acquire a second key for communication authentication with a second node, where the second key is different from a pre-configured first key; receiving a release request for a first communication connection from the second node, the first key being used for communication authentication of the first communication connection; A connection establishment request is sent to the second node, where the connection establishment request is used to request to establish a connection based on the second key.

2. The method according to claim 1, characterized in that: The connection establishment request is used to request to establish a connection based on the second key, including: The connection establishment request is used to request to perform an authentication and security context negotiation process based on the second key.

3. The method according to claim 1 or 2, characterized in that The method further comprises: Receive authentication information based on the second key from the second node; the authentication information is used to verify the identity of the second node.

4. The method according to claim 3, characterized in that The method further comprises: An authentication response based on the second key is sent to the second node, where the authentication response is used to verify the identity of the first node.

5. The method according to claim 3 or 4, characterized in that The method further comprises: When it is determined based on the authentication information that the number of identity authentication failures of the second node is not greater than a threshold number of failures, re-authenticating the identity of the second node; or, When it is determined based on the authentication information that the number of identity authentication failures of the second node is greater than a threshold number of failures, communication transmission with the second node is terminated.

6. The method according to any one of claims 1 to 5, characterized in that: The release request includes request reason information; The request reason information is used to indicate the key update for communication authentication.

7. The method according to claim 6, characterized in that The release request also includes some or all of the following information: used to indicate a request time for the second node to send the release request; A release time used to instruct the first node to release the first communication connection; Information used to instruct to suspend the wireless resources corresponding to the first communication connection.

8. The method according to any one of claims 1 to 7, characterized in that: The second key is valid for a first duration, where the first duration is defined by a timer or a timestamp.

9. The method according to claim 8, characterized in that: The second key is valid for a first duration starting from a first moment, where the first moment is a moment when the first communication connection is released, or a moment when the connection establishment request is sent.

10. The method according to any one of claims 1 to 9, characterized in that: The method further comprises: During the validity period of the second key, information is transmitted with the third node via a backhaul link between the second node and the third node.

11. The method according to any one of claims 1 to 10, characterized in that: The method further comprises: The communication system that performs communication transmission with the second node includes a fusion system based on fusion of different communication systems.

12. The method according to any one of claims 1 to 11, characterized in that: The first key is a key derived based on a first communication system, and / or the second key is a key derived based on a second communication system, and the first communication system is different from the second communication system.

13. A communication device, characterized in that: The method comprises a processing module and a communication module, and is used to execute the method according to any one of claims 1 to 12.

14. A communication device, characterized in that: It comprises at least one processor and an interface circuit; the interface circuit provides a program or instruction for the at least one processor, and the at least one processor implements the device where the communication device is located to execute any one of claims 1 to 12 through a logic circuit or by executing the program or instruction.

15. A computer-readable storage medium, characterized in that: The method comprises program instructions, and when the program instructions are executed on a computer, the computer is caused to execute the method according to any one of claims 1 to 12.

16. A terminal, characterized in that: The method comprises a first node that executes the method as claimed in any one of claims 1 to 12.

Images