Central unit switching method and related device

Abstract

Provided are a central unit switching method and a related device, the method being applied to a source CU, the method comprising: sending a first switching request to a first CU, the first switching request comprising a first reuse key indication, a source key and a source packet data convergence protocol PDCP count value, the first switching request being used for requesting to switch user equipment (UE) from the source CU to the first CU, and the first switching request being used for requesting to switch the UE from the source CU to the first CU; the first reuse key indication is used for indicating that the first CU reuses a source key and a source PDCP of the source CU after establishing a connection with the UE, and the source key is used for generating a key for communicating with the UE; the source PDCP count value is used for identifying current PDCP data of the UE; if a switching request response sent by the first CU is received, a first switching instruction is sent to the DU, and the first switching instruction is used for triggering the first CU to establish connection with the DU. According to the embodiment of the invention, the method can achieve the safe and non-perception switching of the UE.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a central unit switching method and related devices. Background Art

[0002] During the communication process, the switching of the central unit (CU) by the user equipment (UE) is equivalent to switching the gNB, which is equivalent to the UE undergoing Xn switching. The key replacement process can refer to the key replacement process of the gNB in ​​TS 33.501, such as Figure 1 As shown:

[0003] 0. Generate a new KgNB*.

[0004] 1. The source gNB sends an XnAP Handover Req to the target gNB, where the Handover Req includes {new KgNB, new next hop chaining counter parameter (next hop chaining count, NCC), UE security capability (securityCapability), encryption / security algorithm ID of the source gNB}. Optionally, the operations performed by the source gNB in ​​the method flow can be specifically performed by the CU in the source gNB.

[0005] 2. The target gNB sends an application layer signaling protocol (Protocol for NG Interface, NGAP) path switch request message (PATHSWITCH REQUEST message) to the mobility management network element (Access and Mobility Management Function, AMF) to inform the AMF of the switch, wherein the PATH SWITCH REQUEST message includes {UE security Capability}. Optionally, the operations performed by the source gNB in ​​the method flow can be specifically performed by the CU in the source gNB.

[0006] 3a.AMF verifies whether the received UE security capability is consistent with the locally stored one. If they are inconsistent, the AMF sends the locally stored UE security capability in the ACK.

[0007] 3b.[Optional] If the AMF judges that the information in 3a is inconsistent, it can record the event and issue an alarm.

[0008] 4.AMF sends a NGAP path switch response message (PATH SWITCH ACK message) to the target gNB. Optionally, if the judgment in 3a is inconsistent, the PATH SWITCH ACK message includes the UE securityCapability stored locally by the AMF.

[0009] 5a. If the PATH SWITCH ACK message received by the target gNB includes UE securityCapability, the target gNB updates the local UE security Capability through the UE security Capability in the PATH SWITCH ACK message.

[0010] 5b. The target gNB selects an algorithm based on its priority and the updated UE security capability, and compares it with the encryption / security algorithm of the source gNB. If the two are inconsistent, the ID of the new encryption / security algorithm is determined.

[0011] 6. Send a handover response and / or a Radio Resource Control (RRC) reconfiguration message, wherein the message sent includes the NCC. If the two are inconsistent in 5b, the message sent also includes a new encryption / security algorithm ID.

[0012] 7. The UE receives a handover response and / or RRC reconfiguration message. First, if the count value is greater than or equal to the local value, the count value is synchronized first; secondly, the factor NH in the local key list is found according to the NCC, and a new KgNB is generated according to the new encryption / security algorithm.

[0013] The problem with the above process is that Xn switching requires replacing the key KgNB, which causes the UE to regenerate the user plane and / or signaling plane keys. Summary of the invention

[0014] The embodiments of the present application disclose a central unit CU switching method and related devices, which can realize safe and imperceptible switching of UE, that is, switching CU does not require changing the key.

[0015] In a first aspect, an embodiment of the present application provides a central unit switching method, which is applied to a source central unit CU, and the method includes:

[0016] A first switching request is sent to the first CU, wherein the first switching request includes a first reuse key indication, a source key KgNB and a source packet data convergence protocol PDCP count value, the first switching request is used to request to switch the user equipment UE from the source CU to the first CU, the first reuse key indication is used to instruct the first CU to reuse the source key KgNB and the source PDCP of the source CU after establishing a connection with the UE, the source key KgNB includes the access layer key of the UE used by the source CU; the source key KgNB is used to generate a key for communicating with the UE; the source PDCP count value is used to identify the current PDCP data of the UE; in the embodiment of the present application, the source key is represented by KgNB for example only, and it can actually be represented by other symbols as needed.

[0017] If a switching request response sent by the first CU is received, a first switching indication is sent to the DU, where the first switching indication is used to trigger the first CU to establish a connection with the DU.

[0018] Using the above method, in the process of UE switching from the source CU to the first CU, the first switching request sent by the source CU to the first CU includes the first reuse key indication, the source key KgNB, the source packet data convergence protocol PDCP count value (count) and other information, so that the first CU can generate a key for communicating with the UE based on the source key KgNB in ​​the first switching request, and keep the current PDCP data of the UE unchanged through the source PDCP count value, so that the CU switching process can be realized without the UE's security perception, that is, the UE does not need to regenerate the key. This can avoid bringing a large computing overhead to the UE and save computing resources.

[0019] In combination with the first aspect, in a possible implementation manner of the first aspect, the present invention further includes:

[0020] If a handover failure response sent by the first CU is received, a second handover request is sent to the second CU, wherein the second handover request includes a second reuse key indication, the source key KgNB and a source packet data convergence protocol PDCP count value, and the second handover request is used to request to switch the UE from the source CU to the second CU, and the second reuse key indication is used to instruct the second CU to reuse the source key KgNB and the source PDCP of the source CU after establishing a connection with the UE, and the source key KgNB includes the access layer key of the UE used by the source CU; the source key KgNB is used to generate a key for communicating with the UE; the source PDCP count value is used to identify the current PDCP data of the UE;

[0021] If a switching request response sent by the second CU is received, a second switching indication is sent to the DU, where the second switching indication is used to trigger the second CU to establish a connection with the DU.

[0022] In this implementation, when the UE is switched from the source CU to the first CU, if the switching is unsuccessful, the source CU can be switched to the second CU again according to the same switching process as the first CU to successfully complete the switching. In this way, the UE can be finally switched from the source CU to another CU, thereby supporting the corresponding service needs.

[0023] In combination with the first aspect, in a possible implementation manner of the first aspect, the present invention further includes:

[0024] If a handover failure response sent by the first CU is received, a new source key KgNB* is generated;

[0025] A third switching request is sent to the first CU, wherein the third switching request includes the new source key KgNB*, the new next hop chain counter parameter NCC and the UE security capability, and the third switching request is used to switch the UE from the source CU to the first CU, and the new source key KgNB*, the new NCC and the UE security capability are used to generate a key for communicating with the UE.

[0026] In this implementation, when the UE is switched from the source CU to the first CU, if the switching is unsuccessful, the source CU continues to try to switch with the first CU, but the switching method is changed to the existing conventional switching method, that is, the switching method that requires the UE to regenerate the key. In this way, the UE can finally be switched from the source CU to another CU, thereby supporting the corresponding service needs.

[0027] In combination with the first aspect or any one of the above possible implementations of the first aspect, in another possible implementation of the first aspect, the first reuse key indication includes a switching reason, and the switching reason includes a switching not caused by the UE, or the UE requires UE security unaware switching.

[0028] It can be understood that the switching reason is sent to the first CU via the first reuse key indication, so that the first CU can judge whether to accept the security-imperceptible switching of the UE, making the switching mode more targeted and better meeting the business needs of specific scenarios.

[0029] In combination with the first aspect or any one of the above-mentioned possible implementation methods of the first aspect, in another possible implementation method of the first aspect, the non-UE-induced switching includes switching caused by the device life cycle, or switching caused by merging multiple devices, or switching caused by device energy saving.

[0030] In combination with the first aspect or any of the foregoing possible implementations of the first aspect, in another possible implementation of the first aspect, the first handover request further includes UE security capabilities. Optionally, the first handover request is further used to indicate that the UE security capabilities are ignored.

[0031] In combination with the first aspect or any of the foregoing possible implementations of the first aspect, in another possible implementation of the first aspect, before sending the first switching request to the first CU, further comprising:

[0032] receiving a security context request sent by the first CU;

[0033] It is determined that the service data has been migrated to the first CU.

[0034] It should be noted that this implementation method can be applied to the RRC inactive scenario, in which the source CU decides whether to perform a security context transfer without changing the UE key, and the source UE triggers the corresponding switching process.

[0035] In a second aspect, an embodiment of the present application provides a central unit CU switching method, which is applied to a first central unit CU, and the method includes:

[0036] Receive a first handover request sent by a source CU, wherein the first handover request includes a first reuse key indication, a source key KgNB, and a source packet data convergence protocol PDCP count value, the first handover request is used to request to switch a user equipment UE from a source CU to the first CU, the first reuse key indication is used to indicate that the first CU reuses the source key KgNB and the source PDCP of the source CU after establishing a connection with the UE, the source key KgNB includes an access layer key of the UE used by the source CU; the source PDCP count value is used to identify the current PDCP data of the UE;

[0037] If the condition for reusing the source key KgNB of the source CU is met, sending a handover request response to the source CU;

[0038] The NB generates a key for communicating with the UE according to the source key KgNB, and the key for communicating with the UE is used for data transmission encryption on the user plane and / or signaling plane.

[0039] Using the above method, in the process of UE switching from the source CU to the first CU, the first switching request sent by the source CU to the first CU includes the first reuse key indication, the source key KgNB, the source packet data convergence protocol PDCP count value (count) and other information, so that the first CU can generate a key for communicating with the UE based on the source key KgNB in ​​the first switching request, and keep the current PDCP data of the UE unchanged through the source PDCP count value, so that the CU switching process can be realized without the UE's security perception, that is, the UE does not need to regenerate the key. This can avoid bringing a large computing overhead to the UE and save computing resources.

[0040] In combination with the second aspect, in a possible implementation manner of the second aspect, after the NB generates a key for communicating with the UE according to the source alg indication information and the source key KgNB, it also includes:

[0041] A connection is established with the DU.

[0042] In combination with the second aspect or any possible implementation manner of the second aspect, in another possible implementation manner of the second aspect, after establishing a connection with the DU, further comprising:

[0043] Send a Path Switch message to AMF.

[0044] In combination with the second aspect or any possible implementation method of the second aspect, in another possible implementation method of the second aspect, it also includes: if the condition for reusing the KgNB of the source CU is not met, sending a switching failure response to the source CU.

[0045] It can be understood that if the first CU does not accept the switch, the result is fed back to the source CU so that the source CU decides whether to change the switching method or change a target CU for switching, thereby finally completing the CU switching or not performing the switching.

[0046] In combination with the second aspect or any possible implementation manner of the second aspect, in another possible implementation manner of the second aspect, the following further includes:

[0047] Receive a third switching request sent by the source CU, wherein the third switching request includes a new source key KgNB*, a new next hop chain counter parameter NCC, and a UE security capability, and the third switching request is used to switch the UE from the source CU to the first CU;

[0048] Generate a key for communicating with the UE based on the new source key KgNB*, the new NCC and the UE security capability.

[0049] In this implementation, when the UE is switched from the source CU to the first CU, if the switching is unsuccessful, the source CU continues to try to switch with the first CU, but the switching method is changed to the existing conventional switching method, that is, the switching method that requires the UE to regenerate the key. In this way, the UE can finally be switched from the source CU to another CU, thereby supporting the corresponding service needs.

[0050] In combination with the second aspect or any possible implementation of the second aspect, in another possible implementation of the second aspect, the first reuse key indication includes a switching reason, and the switching reason includes a switching not caused by the UE, or the UE requires a secure and unaware switching of the UE. It can be understood that the switching reason is sent to the first CU via the first reuse key indication, so that the first CU can determine whether to accept the secure and unaware switching of the UE. This makes the switching method more targeted and better able to meet the business needs of specific scenarios.

[0051] In combination with the second aspect or any possible implementation of the second aspect, in another possible implementation of the second aspect, the non-UE-induced switching includes switching caused by the device life cycle, or switching caused by merging multiple devices, or switching caused by device energy saving.

[0052] In combination with the second aspect or any possible implementation of the second aspect, in another possible implementation of the second aspect, the first switching request also includes an encryption and / or integrity algorithm identifier alg-ID of the source CU, and the condition for reusing the KgNB of the source CU also includes that the first CU supports the algorithm indicated by the alg-ID of the source CU.

[0053] In combination with the second aspect or any possible implementation of the second aspect, in another possible implementation of the second aspect, the first switching request also includes UE security capabilities, and the UE security capabilities are ignored in the process of generating a key for communicating with the UE.

[0054] In combination with the second aspect or any possible implementation manner of the second aspect, in another possible implementation manner of the second aspect, before receiving the first switching request sent by the source CU, the method further includes:

[0055] receiving an RRC connection recovery request from the UE;

[0056] Determining that the security context of the UE is not migrated;

[0057] Send a security context request of the UE to the source CU.

[0058] It should be noted that this implementation method can be applied to the RRC inactive scenario, in which the source CU decides whether to perform a security context transfer without changing the UE key, and the source UE triggers the corresponding switching process.

[0059] In combination with the second aspect or any possible implementation manner of the second aspect, in another possible implementation manner of the second aspect, the RRC connection recovery request includes the address of the source CU.

[0060] In combination with the second aspect or any possible implementation manner of the second aspect, in another possible implementation manner of the second aspect, after establishing a connection with the DU, further comprising:

[0061] A connection message is sent to the UE through the DU.

[0062] In a third aspect, an embodiment of the present application provides a central unit switching method, which is applied to a communication system, the communication system including a source CU and a first CU, and the method including:

[0063] The source CU sends a first switching request to the first CU, wherein the first switching request includes a first reuse key indication, a source key KgNB, and a source packet data convergence protocol PDCP count value, the first switching request is used to request to switch the user equipment UE from the source CU to the first CU, the first reuse key indication is used to instruct the first CU to reuse the source key KgNB and the source PDCP of the source CU after establishing a connection with the UE, the source key KgNB includes an access layer key of the UE used by the source CU; the source key KgNB is used to generate a key for communicating with the UE; the source PDCP count value is used to identify the current PDCP data of the UE;

[0064] The first CU receives the first switching request sent by the source CU;

[0065] If the condition for reusing the source key KgNB of the source CU is met, the first CU sends a switching request response to the source CU;

[0066] The first CU generates a key for communicating with the UE according to the source key KgNB, and the key for communicating with the UE is used for data transmission encryption on the user plane and / or signaling plane.

[0067] Using the above method, in the process of UE switching from the source CU to the first CU, the first switching request sent by the source CU to the first CU includes the first reuse key indication, the source key KgNB, the source packet data convergence protocol PDCP count value (count) and other information, so that the first CU can generate a key for communicating with the UE based on the source key KgNB in ​​the first switching request, and keep the current PDCP data of the UE unchanged through the source PDCP count value, so that the CU switching process can be realized without the UE's security perception, that is, the UE does not need to regenerate the key. This can avoid bringing a large computing overhead to the UE and save computing resources.

[0068] In combination with the third aspect, in a possible implementation manner of the third aspect, the communication system further includes a second CU, and the method further includes:

[0069] If a switching failure response sent by the first CU is received, the source CU sends a second switching request to the second CU, wherein the second switching request includes a second reuse key indication, the source key KgNB and a source packet data convergence protocol PDCP count value, and the second switching request is used to request to switch the UE from the source CU to the second CU, and the second reuse key indication is used to instruct the second CU to reuse the source key KgNB and the source PDCP of the source CU after establishing a connection with the UE, and the source key KgNB includes the access layer key of the UE used by the source CU; the source key KgNB is used to generate a key for communicating with the UE; the source PDCP count value is used to identify the current PDCP data of the UE;

[0070] The second CU receives the second switching request sent by the source CU;

[0071] If the condition for reusing the source key KgNB of the source CU is met, the second CU sends a switching request response to the source CU;

[0072] If a handover request response sent by the second CU is received, the source CU sends a second handover indication to the DU, where the second handover indication is used to trigger the DU to establish a connection with the second CU;

[0073] The second CU generates a key for communicating with the UE based on the source key KgNB, and the key for communicating with the UE is used for data transmission encryption on the user plane and / or signaling plane.

[0074] In this implementation, when the UE is switched from the source CU to the first CU, if the switching is unsuccessful, the source CU can be switched to the second CU again according to the same switching process as the first CU to successfully complete the switching. In this way, the UE can be finally switched from the source CU to another CU, thereby supporting the corresponding service needs.

[0075] In conjunction with the third aspect, in a possible implementation of the third aspect, the following further includes:

[0076] If a handover failure response sent by the first CU is received, the source CU generates a new source key KgNB*;

[0077] The source CU sends a third switching request to the first CU, wherein the third switching request includes the new source key KgNB*, the new NCC and the UE security capability, and the third switching request is used to switch the UE from the source CU to the first CU;

[0078] The first CU receives a third switching request sent by the source CU;

[0079] The first CU generates a key for communicating with the UE based on the new source key KgNB*, the new NCC and the UE security capability.

[0080] In this implementation, when the UE is switched from the source CU to the first CU, if the switching is unsuccessful, the source CU continues to try to switch with the first CU, but the switching method is changed to the existing conventional switching method, that is, the switching method that requires the UE to regenerate the key. In this way, the UE can finally be switched from the source CU to another CU, thereby supporting the corresponding service needs.

[0081] In combination with the third aspect or any of the foregoing possible implementations of the third aspect, in yet another possible implementation of the third aspect, the following further includes:

[0082] The first CU receives an RRC connection recovery request from the UE;

[0083] The first CU determines that the security context of the UE is not migrated;

[0084] The first CU sends a security context request of the UE to the source CU;

[0085] The source CU receives a security context request sent by the first CU;

[0086] The source CU determines that the service data has been migrated to the first CU.

[0087] It should be noted that this implementation method can be applied to the RRC inactive scenario, in which the source CU decides whether to perform a security context transfer without changing the UE key, and the source UE triggers the corresponding switching process.

[0088] In a fourth aspect, an embodiment of the present application provides a communication device, wherein the communication device includes a module for executing the method described in the first aspect or any possible implementation of the first aspect; or, the communication device includes a processor, and the processor is used to execute the method described in the first aspect or any possible implementation of the first aspect.

[0089] In a fifth aspect, an embodiment of the present application provides a communication device, wherein the communication device includes a module for executing the method described in the second aspect or any possible implementation of the second aspect; or, the communication device includes a processor, wherein the processor is used to execute the method described in the first aspect or any possible implementation of the first aspect.

[0090] In a sixth aspect, an embodiment of the present application provides a communication device, which includes a logic circuit and an interface, and the logic circuit and the interface are coupled; the interface is used to input and / or output information, and the logic circuit is used to execute the method described in the first aspect or any possible implementation method of the first aspect.

[0091] In the seventh aspect, an embodiment of the present application provides a communication device, characterized in that it includes a logic circuit and an interface, and the logic circuit and the interface are coupled; the interface is used to input and / or output information, and the logic circuit is used to execute the method described in the second aspect or any possible implementation method of the second aspect.

[0092] In an eighth aspect, an embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium is used to store a computer program. When the computer program is executed, the method described in the first aspect or any possible implementation of the first aspect or the second aspect or any possible implementation of the second aspect is executed.

[0093] In the ninth aspect, an embodiment of the present application provides a communication system, which includes a source CU and a first CU, the source CU is used to execute the method described in the first aspect or any possible implementation of the first aspect, and the first CU is used to execute the method described in the second aspect or any possible implementation of the second aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0094] The following is an introduction to the drawings used in the embodiments of the present application.

[0095] Figure 1It is a schematic diagram of the Xn switching process of the prior art provided by the embodiment of the present application;

[0096] Figure 2 This is a schematic diagram of a 5G system architecture provided by an embodiment of the present application;

[0097] Figure 3 It is a schematic diagram of a RAN architecture provided in an embodiment of the present application;

[0098] Figure 4 It is a schematic diagram of another Xn switching process provided in an embodiment of the present application;

[0099] Figure 5 It is a schematic diagram of another Xn switching process provided in an embodiment of the present application;

[0100] Figure 6 It is a schematic diagram of a CU switching process provided by an embodiment of the present application;

[0101] Figure 7 This is a schematic diagram of a key generation provided in an embodiment of the present application;

[0102] Figure 8 It is a schematic diagram of a CU switching process provided by an embodiment of the present application;

[0103] Fig. 9 It is a schematic diagram of a CU switching process provided by an embodiment of the present application;

[0104] Fig.10 is a structural diagram of a communication device provided in an embodiment of the present application;

[0105] Fig.11 is a structural diagram of another communication device provided in an embodiment of the present application;

[0106] Fig.12 It is a structural diagram of another communication device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0107] The embodiments of the present application are described below in conjunction with the drawings in the embodiments of the present application.

[0108] See also Figure 2 , Figure 2This is a schematic diagram of the fifth generation mobile communication technology (5th Generation Mobile Communication Technology, 5G) system architecture provided in an embodiment of the present application. The architecture includes two parts: an access network and a core network. The access network is used to implement functions related to wireless access. The core network mainly includes the following key logical network elements: Radio Access Network (Radio Access Network, RAN), Access and Mobility Management Function (Access and Mobility Management Function, AMF), Session Management Function (Session Management Function, SMF), User Plane Function (User Plane Function, UPF), Policy Control Function (Policy Control Function, PCF), Unified Data Management Network Element (Unified Data Management, UDM), Network Slice Specific Authentication and Authorization Function (The Network Slice Specific Authentication and Authorization Function, NSSAAF).

[0109] RAN is a device that provides wireless access for terminal devices, including but not limited to eNodeB, gNB, WiFi AP, WiMAX BS, etc.

[0110] AMF is mainly responsible for mobility management in mobile networks, such as user location update, user network registration, user switching, etc.

[0111] SMF is mainly responsible for session management in mobile networks, such as session establishment, modification, and release. Specific functions include allocating IP addresses to users and selecting UPFs that provide message forwarding functions.

[0112] PCF is responsible for providing policies to AMF and SMF, such as QoS policies and slice selection policies.

[0113] UDM is used to store user data, such as contract information and authentication / authorization information.

[0114] NSSAAF is mainly responsible for the authentication and authorization of network slices, and can interact with the "authentication, authorization, and accounting server (authentication, authorization, and accounting server, AAA-S)" through the "authentication, authorization, and accounting proxy (authentication, authorization, and accounting proxy, AAA-P)".

[0115] UPF is mainly responsible for processing user messages, such as forwarding and billing.

[0116] UE accesses the data network (DN) by establishing a session (PDU session) from UE to RAN to UPF to DN. UE refers to network terminal devices such as mobile phones, Internet of Things terminal devices, etc.

[0117] See also Figure 3 , Figure 3 This is a schematic diagram of the RAN architecture. The main functions of the RAN (such as base stations) architecture are divided into two functional units, which are responsible for processing the distributed unit (DU) with higher real-time requirements, and the central unit (CU) responsible for processing non-real-time, RRC, Packet Data Convergence Protocol (PDCP) and other high-level protocols. In a deployment architecture 5G Centralized-RAN (C-RAN), CU / DU can be deployed separately, and the DU's server and related software can be hosted at the site itself or in the edge cloud (data center or central office), depending on the availability of transmission and the fronthaul interface. The CU's server and related software can be placed in the same location as the DU or hosted in a regional cloud data center. The actual division between DU and RU may vary depending on the specific use case and implementation. According to the functional split, it can be divided into the following items:

[0118] RU: A radio unit that handles DFE and some PHY layer functions. The key factors in its design are size, weight and power consumption.

[0119] DU: A distributed unit close to the RU that mainly handles radio link control (RLC), media access control (MAC) and some physical layer (PHY) layer functions. This logical node includes a subset of eNB / gNB functions, depending on the functional split option, and its operation is controlled by the CU.

[0120] CU: Central unit responsible for processing high-level protocols such as RRC and PDCP. The gNB consists of a CU and a DU, which are connected to the CU through the control plane interface and the user plane interface, respectively. A CU with multiple DUs will support multiple gNBs. The split architecture enables 5G networks to utilize different protocol stack distributions between CU and DU depending on mid-haul availability and network design. The CU can centrally manage multiple DUs through the mid-haul interface. Centralized CU deployment allows load balancing between different RUs, which is why in most cases, the DU will be paired with the RU to perform all intensive processing tasks. Edge-centric baseband processing provides low latency, seamless mobility with real-time interference management, and optimal resource optimization.

[0121] A gNB can consist of a gNB-CU and one or more gNB-DUs. A gNB-DU supports one or more cells. A cell supports only one gNB-DU. A gNB-DU is connected to only one gNB-CU. In the case of network sharing with multiple cell ID broadcasts, each cell identity associated with a public land mobile network (PLMN) subset corresponds to a gNB-DU, and the gNB-CU it is connected to, i.e., the corresponding gNB-DUs share the same physical layer cell resources. For resilience, a gNB-DU can be connected to multiple gNB-CUs through appropriate implementation.

[0122] The terminal equipment participating in RAN communication can be user equipment (UE) or user terminal or other equipment. The UE here includes mobile phones, smart terminals, vehicle terminals, vehicle-mounted devices, wearable devices, multimedia devices, streaming media devices, etc.; the terminal device can also be an access network device, because it also involves the security protection activation process of decoupling the control plane and the user plane. The access network device can be a base station, a relay station, an access point, a vehicle-mounted device, and a network-side device. The subsequent flow chart takes the terminal device as an example for explanation.

[0123] Based on the above 5G system architecture, Xn switching can be completed between gNBs. To avoid complicated procedures, gNB-DU, gNB-CUCP and gNB-CUCP can be regarded as a whole. Like gNB, it does not contain internal DU, CU-CP and CU-UP signaling. The switching process is as follows:

[0124] Step #0: The source gNB and the target gNB have an active Xn connection, the terminal is in RRC_CONNECTED state, sending and receiving uplink and downlink data at the source gNB, and moving towards the target gNB.

[0125] Step #1 - Measurement reporting: The UE sends a MeasurementReport message to the source gNB #1, including the signal strength and PCI information of the serving cell and neighboring cells.

[0126] Step #1.1: The source gNB decides to handover the UE based on the measurement report and other information (e.g., cell load and terminal mobility restrictions and radio capabilities) and selects the target gNB for handover.

[0127] Step #2 - XnAP Handover Request: The source gNB sends an XnAP Handover Request message to the target gNB via the Xn interface. This message carries the RRC message (in transparent mode) containing the handover preparation information and the target cell ID, PDU session list and other information.

[0128] Step #2-1: The target gNB allocates resources to the UE taking into account the RRC information received in the previous step.

[0129] Step #3 - XnAP Handover Confirm: If the target gNB decides to accept the handover, it sends a Handover Request Confirm message to the source gNB, which includes the transparent container that will be sent as an RRC message to the UE to perform the handover, as well as the list of authorized and unauthorized PDU sessions. This completes the handover preparation phase.

[0130] Step #4 - RRC Reconfiguration: The source gNB triggers the handover by sending an RRC Reconfiguration message to the UE, which contains the information required to access the target cell received in step #3, e.g., at least the target cell ID, the new C-RNTI, and the target gNB security algorithm identifier for the selected security algorithm.

[0131] Step #5 - SN Status Transfer: The source gNB sends an SN Status Transfer message to the target gNB to transfer the uplink and downlink PDCP SN and HFN (Hyper Frame Number) status. The source gNB starts buffering the DL data from the UPF and forwards it to the target gNB.

[0132] Step #6 - Initiate RACH on target cell: Initiate random access procedure on target gNB with the information received in step 4 as part of rach-ConfigDedicated.

[0133] Step #7-RRC Reconfiguration Completed: After the terminal successfully connects to the target cell, it completes the handover process by sending an RRCReconfigurationComplete message to the target gNB, and the terminal starts sending uplink data to the target gNB.

[0134] Step #8-NGAP Path Switch Request: The target gNB sends an NGAP Path Switch Request message to the AMF through the NG interface, triggering the 5GC to switch the downlink data path to the target gNB and establish an NG-C interface instance pointing to the target gNB. The message also carries a list of PDU sessions that need to be switched and a list of PDU sessions that failed to be established at the target gNB. The UPF sends an End Marker to the source gNB, indicating the end of the data flow to the source gNB, and the source gNB sends the End Marker to the target gNB.

[0135] Step #9-NGAP Path Switch Request Confirmation: 5GC switches the downlink data path to the target gNB. AMF confirms the Path Switch Request message with a Path Switch Request Confirmation NGAP message. This message carries a list of PDU sessions that have been switched and a list of PDU sessions to be released.

[0136] Step #10-XnAP UE context release: After the target gNB receives the NGAP path switch request confirmation message sent by AMF, it sends an XnAP UE context release message to the source gNB, and the source gNB releases the resources associated with the UE.

[0137] In the above 5G NR, the Xn handover corresponding to the gNB handover is similar to the X2 handover in the 4th generation mobile communication technology (4G) and Long Term Evolution (LTE); the premise of Xn handover is that an Xn interface must have been established between the source gNB and the target gNB; this type of handover is only applicable to mobility within the same AMF, that is, if the source and target gNBs are connected to different AMFs, Xn handover cannot be used; Xn handover can be either intra-frequency handover or inter-frequency handover; the source gNB and the target gNB can be connected to two different UPFs; if the source gNB and the target gNB belong to different tracking area codes (TACs), re-registration needs to be initiated after a successful handover; since the signaling path is shorter and the 5G core network only participates in the handover of the PDU session path, the Xn handover speed is faster than the N2 / NGAP handover.

[0138] In the above 5G NR, there are many ways to implement the Xn switching corresponding to the CU switching in the gNB, such as the above Figure 1 In addition, the embodiment of the present application also combines Figure 4 An Xn switching process corresponding to CU switching is provided, which is as follows:

[0139] 0. The UE is in the inactive state and switches to another target gNB (Target gNB).

[0140] 1. The UE sends an RRC connection resume request (I-RNTI) to the Target gNB.

[0141] 2. The Target gNB sends a UE security context request (I-RNTI) to the Source gNB.

[0142] 3. The Source gNB sends {the new key KgNB*, the associated NCC, the UE security capabilities, and the confidentiality and integrity algorithm (Alg-ID) used by the UE and the source cell} to the Target gNB.

[0143] 4. Target gNB interacts with AMF through Figure 1 The UE security capability is determined in the manner described above and combined with its own priority to select the algorithm Alg-ID.

[0144] 5. The Target gNB checks whether it supports the confidentiality and integrity algorithms used by the UE with the last source cell. If the following conditions are met (① the Alg-ID is supported; ② the gNB prefers the Alg-ID), the Target gNB uses the Alg-ID of the UE and the source cell and the new KgNB to derive a new AS key.

[0145] 6. The Target gNB resets all PDCP COUNTs to 0 and activates the new keys in the PDCP layer.

[0146] 7. The Target gNB sends an RRC connection resume message to the UE.

[0147] Whether Figure 1 still Figure 4 In the method shown, a new KgNB needs to be generated for Xn switching, but in some communication scenarios, even if Xn switching occurs, it is hoped that the KgNB remains unchanged, such as Figure 5 As shown, an Xn switching process without changing the key KgNB is provided, as follows:

[0148] (1) The source cell (same-source gNB) decides to switch, which actually means to start the handover process.

[0149] (2). The source cell decides to retain the cell key (retain-key-cell).

[0150] (3) The source cell prepares a new key KgNB*, (3.1) If there is an indication message retain-key-cell, then kgNB*=kgNB, (3.2) Otherwise, a new kgNB* is derived.

[0151] (4) The source cell sends a NG handover request Handover Request {retain-key-cell indication, other information} to the target cell (same target gNB).

[0152] (5) The target cell sends an NG Handover Request ack {retain-key-cell indication, other information} to the source cell.

[0153] (6) The source cell sends the NG RRC Reconfiguration Complete (RRC Connection Reconfiguration Reconfiguration complete {retain-key-cell indication, other information}) to the UE.

[0154] (7).UE decides to keep the key.

[0155] (8.1) The UE sends a UE NG RRC Connection Reconfiguration message to the Target Cell to complete RRC Re-establishment.

[0156] (8.2).NG performs RRC connection re-establishment (abnormal case).

[0157] Figure 5 The Xn switching process shown in the figure provides a rough solution without changing the key. Figure 6 , Figure 8 , Fig. 9 The method flow shown describes the specific implementation details of not changing the key in Xn switching. Figure 6 , Figure 8 , Fig. 9 The Xn switching shown mainly refers to the switching from the source CU to the target CU.

[0158] This application Figure 6 , Figure 8 , Fig. 9The embodiment shown can be applied to a core network architecture composed of a network function virtualization infrastructure (NFVI) and virtualized network function (VNF) network elements deployed in the NFVI. In terms of the core network form, for example, Figure 2 The architecture shown (only as an example) is also applicable to Long Term Evolution (LTE) networks equipped with NFVI infrastructure or other long-term evolution (LTE) networks with virtual network functions, MulteFire networks or home base station networks, or non-3GPP mobile networks such as wireless fidelity (WIFI) access, or wideband code division multiple access (WCDMA) networks, or future sixth-generation mobile communication technology (6G) networks, cloud access network Cloud RAN network architecture, or fixed-mobile converged networks (fixed access networks access mobile networks), etc., and the embodiments of the present application are not specifically limited. Figure 6 , Figure 8 , Fig. 9 The core network architecture used includes a communication system, which can be Figure 3 The communication system (such as a base station) or other forms of communication systems shown, the communication system includes multiple CUs, such as the CU currently accessed by the UE can be called the source CU, the unaccessed CU can have a first CU, and optionally a second CU or other CUs, the unaccessed CU here can also have other names, which are not limited here; in the embodiment of the present application, when the source CU interacts with the first CU, the first CU is equivalent to the target CU (i.e., target CU), and when the source CU interacts with the second CU, the second CU is equivalent to the target CU (i.e., target CU). In the embodiment of the present application, the CU can be the base station gNB itself. In this case, the subsequent change of the CU to the base station gNB can also ensure the implementation of the solution. Of course, the CU can also be a part of the base station gNB, such as the base station gNB includes a CU and a DU, where the CU is only a device or module in the gNB responsible for a specific functional task; of course, the CU can also exist in other forms, which will not be repeated here.

[0159] See also Figure 6 , Figure 6 : is a flowchart of a CU switching method provided in an embodiment of the present application, including but not limited to the following steps:

[0160] Step S600: The UE establishes a connection with the DU.

[0161] Specifically, when the UE establishes a connection with the DU, a corresponding CU will establish a connection with the UE, and the CU is called the source CU. The source CU has a source key KgNB, which is used to generate a key for communicating with the UE. In the embodiment of the present application, the source key is represented by KgNB for example only, and other symbols can be used as needed.

[0162] In the embodiment of the present application, the source CU and the first CU are both connected to the AMF. The process of establishing a connection between the UE and the DU can refer to the random access process (completed by exchanging information such as Msg1-Msg5) and the process of establishing a service between the UE and the core network. It is not limited here, and it can be understood that the UE accesses the network through step S600. There are at least two possible situations regarding the AMF network element:

[0163] 1) If the AMF network element is a core network element, step S600 also needs to complete the access of the UE to the core network and the access network.

[0164] 2) If the AMF network element is an access network element (refer to the intelligent controller RIC), step S606 needs to complete the access of the UE to the access network.

[0165] Step S601: The source CU configures a local switching strategy.

[0166] Specifically, the switching strategy defines the following rules: If the source key Kgnb is not changed when a CU switching occurs, a first switching request is sent to the first CU. The specific circumstances under which the CU switching does not require the source key Kgnb to be changed can be determined by the source CU. For example, the source CU can analyze the switching reason to determine whether to change the source key Kgnb. Optionally, if the switching reason includes a switching caused by a non-UE, or the UE requires an unaware switching, it is determined not to change the source key Kgnb.

[0167] For ease of understanding, the following is an example of a handover not caused by the UE:

[0168] In an optional solution, switching caused by non-UE includes switching caused by device life cycle. For example, the life cycle of equipment other than UE (such as CU) expires (such as Cloud RAN scenario), and it cannot be used anymore or there are corresponding risks in continuing to use it. Therefore, the device needs to be shut down, and shutting down the device will cause CU switching. Taking the scenario of device cloud virtualization as an example, some CUs may be composed of containers (docker) or virtual machines. These containers or virtual machines need to be replaced periodically according to the deployment of the cloud platform. For example, CU is composed of virtual machines VM1, VM2 and VM3, but because the platform where VM1 is located needs to be redeployed, virtual machine VM1 needs to be replaced, and the UE's security context happens to be stored in this virtual machine VM1, so the UE's data needs to be migrated from VM1 to other virtual machines or containers.

[0169] Another example is the switching caused by merging multiple devices. Multiple devices are merged due to business needs or resource integration needs, such as merging multiple virtual machines, and the merger will cause CU switching.

[0170] Another example is the switching caused by equipment energy saving. From the perspective of energy saving, when some CUs can meet business needs, other CUs can be shut down for a short period of time or permanently, which will cause CU switching.

[0171] Of course, there may be other handover situations not caused by the UE, which will not be listed one by one here.

[0172] For ease of understanding, here is a brief introduction to the UE's need for imperceptible switching. For example, UE is a high-power device and it costs a lot to generate keys. In order to avoid the large overhead, the UE is not allowed to participate in the switching process, that is, imperceptible switching is performed.

[0173] Step S602: The source CU sends a first switching request to the first CU.

[0174] Among them, the first handover request can also be Inter-CU Handover Req or other names. The first handover request includes a first reuse key indication, a source key KgNB and a source packet data convergence protocol PDCP count value (count). Optionally, the first handover request also includes the encryption and / or security algorithm identifier alg-ID of the source CU.

[0175] The first switching request is used to request to switch the user equipment UE from the source CU to the first CU, and the first reuse key indication is used to instruct the first CU to reuse the source key KgNB and the source PDCP of the source CU after establishing a connection with the UE, and the source key KgNB includes the access layer key of the UE used by the source CU; the source key KgNB is used to generate a key for communicating with the UE; the source PDCP count value is used to identify the current PDCP data of the UE (for example, used for the first CU to identify (or recognize) the current PDCP data of the UE), the encryption and / or security algorithm identifier alg-ID of the source CU can be the encryption and / or security algorithm identifier alg-ID of the source cell (cell), and the encryption and / or security algorithm can be an Advanced Encryption Standard (AES) algorithm, Zuc stream cipher (zuc) algorithm, and the like.

[0176] In an optional implementation, the first reuse key indication includes a switching reason, and the switching reason includes a switching not caused by the UE, or the UE requires a UE security unaware switching (ie, the UE does not change the key when performing a CU switching).

[0177] In an optional implementation, the first switching request does not include UE security capability (UE security capability). In this case, the first CU does not need to consider UE security capability when generating a key in response to the first switching request. Optionally, the UE security capability in the embodiment of the present application may specifically be a 5G UE security capability.

[0178] In yet another optional implementation manner, the first handover request further includes UE security capability (UE security capability). In the case where the first handover request includes the UE security capability, there are the following two implementation manners:

[0179] In implementation mode 1, the first switching request is also used to indicate that the UE security capability is ignored. In this case, the first CU that receives the first switching request will ignore the UE security capability according to the indication when generating a key in response to the first switching request, that is, will not use the UE security capability.

[0180] Implementation method 2: The first switching request does not indicate to ignore the UE security capability. In this case, the first CU that receives the first switching request can ignore the UE security capability according to the provisions of the protocol when generating a key in response to the first switching request, that is, not use the UE security capability.

[0181] Step S603: The first CU receives a first switching request sent by the source CU.

[0182] Specifically, the first CU parses the first switching request and can obtain the information contained in the first switching request, such as the first reuse key indication, the source key KgNB and the source packet data convergence protocol PDCP count value.

[0183] Step S604: If the condition for reusing the source key KgNB of the source CU is met, the first CU sends a switching request response to the source CU.

[0184] Specifically, the first CU can determine whether the conditions for reusing the source key KgNB of the source CU are met based on the first reuse key indication and other information that can be obtained, such as judging based on the first reuse key indication. There are also multiple implementation methods for the judgment here. The following examples are given. Case 1: If the first reuse key indicates that the first CU reuses the source key KgNB and the source PDCP of the source CU after establishing a connection with the UE, then the conditions for reusing the source key KgNB of the source CU (all conditions or part of the conditions) are met; Case 2: If the first reuse key indication includes a switching reason, and the switching reason includes a switching caused by non-UE, or the UE requires an unaware switching, then the first CU can determine that the conditions for reusing the source key KgNB of the source CU (all conditions or part of the conditions) are met. Case 2 actually uses the switching reason to indicate that the first CU reuses the source key KgNB and the source PDCP of the source CU after establishing a connection with the UE.

[0185] When the conditions in the previous cases 1 and 2 are partial conditions, the remaining conditions must also be met. For example, optionally, the following remaining conditions must also be met to meet the conditions for reusing the source key KgNB of the source CU: The first CU determines, based on the alg-ID of the source CU, that the algorithm indicated by the alg-ID of the source CU is an algorithm supported by itself.

[0186] The first handover response here may also be other names, such as Inter-CU Handover response.

[0187] Step S605: If a switching request response sent by the first CU is received, the source CU sends a first switching indication to the DU.

[0188] Specifically, the first switching indication is used to trigger the DU to establish a connection with the first CU.

[0189] Step S606: The first CU generates a key for communicating with the UE based on the source key KgNB.

[0190] Specifically, alg-ID may also be used to generate the key, such as Figure 7 The process of generating lower-level keys based on the source key KgNB and the corresponding algorithm is roughly illustrated. For example, the algorithm ID, source key KgNB and other parameters corresponding to the RRC encryption algorithm are input into the key derivation function (KDF) to obtain the RRC encryption key (KRRC enc); the algorithm ID, source key KgNB and other parameters corresponding to the RRC integrity algorithm are input into KDF to obtain the RRC integrity key (KRRC int); the algorithm ID, source key KgNB and other parameters corresponding to the UP encryption algorithm are input into KDF to obtain the UP encryption key (KUP enc); the algorithm ID, source key KgNB and other parameters corresponding to the UP integrity algorithm are input into KDF to obtain the UP integrity key (KUP int).

[0191] The key for communicating with the UE (i.e., the lower key) is used for data transmission encryption on the user plane and / or signaling plane (e.g., RRC signaling plane). In addition, the first CU will also reuse the source PDCP count value, i.e., communicate based on the current PDCP of the UE identified by the source PDCP count value (e.g., carry the source PDCP count value in the downlink data communicating with the UE), and use the newly generated key to communicate with the UE during the communication process.

[0192] Optionally, step S606 can be executed when the conditions for reusing the source key KgNB of the source CU are met, or it can be executed after step S605, or it can be executed synchronously with step S605, which is not limited here.

[0193] Optionally, the embodiment of the present application may further include one or more of steps S607 - S610 .

[0194] Step S607: The first CU and the DU transmit data related to the UE.

[0195] For example, the data related to the UE is a command for triggering the execution of step S608, or a switching completion indication, or other information. Optionally, the connection between the first CU and the DU may be, for example, F1 establishment. Optionally, the DU may have established an F1 connection before the switching, but data transmission is not started until the first switching indication is passed. The embodiment of the present application does not limit when the first CU and the DU establish the F1 connection.

[0196] Step S608: The DU sends a handover completion message to the UE.

[0197] For example, the handover completion message can also be called a Handover command Message. The handover completion message may include a key retention indication, which is used to instruct the UE to maintain the current source key KgNB and maintain the key for communication between the UE and the CU, such as the user plane key and / or the signaling plane key.

[0198] Correspondingly, after receiving the handover completion indication, the UE can perform corresponding recording operations on the above handover according to the pre-configured strategy, and keep the current source key KgNB and other access layer keys. Of course, step S608 may not be performed to achieve UE's unawareness of the handover.

[0199] Step S609: The first CU sends a path switch message to the AMF.

[0200] Specifically, the Path Switch message is used to indicate that the switching is completed.

[0201] Step S610: The first CU sends a connection message to the UE through the DU.

[0202] Specifically, the connection message may be an RRC connection recovery signaling. In the subsequent communication process between the first CU and the UE, communication may be performed using the key generated in step S606.

[0203] exist Figure 6 In the method shown, during the process of UE switching from the source CU to the first CU, the first switching request sent by the source CU to the first CU includes information such as the first reuse key indication, the source key KgNB, and the source packet data convergence protocol PDCP count value (count), so that the first CU can generate a key for communicating with the UE based on the source key KgNB in ​​the first switching request, and keep the current PDCP data of the UE unchanged through the source PDCP count value, so that the CU switching process can be realized without the UE's security perception, that is, the UE does not need to regenerate the key. This can avoid bringing a large computing overhead to the UE and save computing resources.

[0204] See also Figure 8 , Figure 8 : is a flowchart of a CU switching method provided in an embodiment of the present application, including but not limited to the following steps:

[0205] Step S800: The UE establishes a connection with the DU.

[0206] Step S800 is the same as step S600 and will not be described again here.

[0207] Step S801: The source CU configures a local switching strategy.

[0208] Step S801 is the same as step S601 and will not be described again here.

[0209] Step S802: The source CU sends a first switching request to the first CU.

[0210] Step S802 is the same as step S602 and will not be described again here.

[0211] Step S803: The first CU receives a first switching request sent by the source CU.

[0212] Step S803 is the same as step S603 and will not be described again here.

[0213] Step S804: If the condition for reusing the source key KgNB of the source CU is not met, the first CU sends a switching failure response to the source CU.

[0214] Specifically, the first CU can determine whether the conditions for reusing the source key KgNB of the source CU are met based on the first reuse key indication and / or other information that can be obtained, such as judging based on the first reuse key indication. There are also multiple implementation methods for the judgment here, such as meeting some of the conditions indicated in Case 1 or Case 2 in step S604, but not meeting the remaining conditions, that is, the first CU determines based on the source alg indication information that the algorithm indicated by the source alg indication information is not an algorithm supported by itself, then the conditions for reusing the source key KgNB of the source CU are not met. What specifically counts as not meeting the conditions for reusing the source key KgNB of the source CU can be pre-configured as needed.

[0215] Next, the source CU receives the switching failure response sent by the first CU. After the source CU determines that the switching has failed through the switching failure response, it can continue to initiate a new switching process, such as replacing a CU (which can be called the second CU) and sending the above-mentioned first switching request again to request switching. The switching process principle remains unchanged. For example, continue to initiate a new switching to the first CU, but the new switching no longer indicates the reuse of the source key KgNB.

[0216] For ease of understanding, an example is given below. Solution 1: Steps S805-S813 are a solution for changing a CU and requesting switching again. Solution 2: Steps S814-S817 are a solution for continuing to initiate a new switching to the first CU.

[0217] Scenario 1:

[0218] Step S805: If a switching failure response sent by the first CU is received, the source CU sends a second switching request to the second CU.

[0219] Among them, the second switching request includes a second reuse key indication, the source key KgNB and a source packet data convergence protocol PDCP count value, and optionally, may also include an encryption and / or security algorithm identifier alg-ID of the source CU. The second switching request is used to request to switch the UE from the source CU to the second CU. The second reuse key indication is used to instruct the second CU to reuse the source key KgNB and the source PDCP of the source CU after establishing a connection with the UE. The source key KgNB includes the access layer key of the UE used by the source CU; the source key KgNB is used to generate a key for communicating with the UE; and the source PDCP count value is used to identify the current PDCP data of the UE.

[0220] It should be noted that the principle of the source CU sending the second switching request to the second CU in step S805 is the same as the principle of sending the first switching request to the first CU in step S602, which will not be repeated here.

[0221] Step S806: The second CU receives the second switching request sent by the source CU.

[0222] It should be noted that the principle of step S806 is the same as that of step S603 and will not be repeated here.

[0223] Step S807: If the condition for reusing the source key KgNB of the source CU is met, the second CU sends a switching request response to the source CU.

[0224] It should be noted that the principle of step S807 is the same as that of step S604, which will not be repeated here.

[0225] Step S808: If a switching request response sent by the second CU is received, the source CU sends a second switching indication to the DU.

[0226] The second switching indication is used to trigger the DU to establish a connection with the second CU. It should be noted that the principle of step S808 is the same as that of step S605, which will not be repeated here.

[0227] Step S809: The second CU generates a key for communicating with the UE based on the source key KgNB.

[0228] The key for communicating with the UE is used for data transmission encryption on the user plane and / or signaling plane. Optionally, the alg-ID of the source CU may also be used to generate the key for communicating with the UE.

[0229] It should be noted that the principle of step S809 is the same as that of step S606, which will not be repeated here.

[0230] Optionally, the embodiment of the present application may further include one or more of steps S810-S813.

[0231] Step S810: The second CU and the DU transmit data related to the UE.

[0232] It should be noted that the principle of step S810 is the same as that of step S607, which will not be repeated here.

[0233] Step S811: The DU sends a handover completion message to the UE.

[0234] It should be noted that the principle of step S811 is the same as that of step S608 and will not be repeated here.

[0235] Step S812: The second CU sends a path switch message to the AMF.

[0236] It should be noted that the principle of step S812 is the same as that of step S609 and will not be repeated here.

[0237] Step S813: The second CU sends a connection message to the UE through the DU.

[0238] It should be noted that the principle of step S813 is the same as that of step S610, which will not be repeated here.

[0239] Scenario 2:

[0240] Step S814: If a switching failure response is received from the first CU, the source CU generates a new source key KgNB*.

[0241] Step S815: The source CU sends a third switching request to the first CU.

[0242] Among them, the third switching request includes the new source key KgNB*, the new NCC and UE security capabilities, and optionally, may also include the encryption and / or security algorithm identifier alg-ID of the source CU, and the third switching request is used to switch the UE from the source CU to the first CU.

[0243] Step S816: The first CU receives the third switching request sent by the source CU.

[0244] Step S817: The first CU generates a key for communicating with the UE based on the new source key KgNB*, the new next hop chaining counter parameter (NextHop Chaining Counter, NCC) and the UE security capability.

[0245] Optionally, the alg-ID of the source CU may also be used to generate a key for communicating with the UE.

[0246] It should be noted that after the first CU obtains the new source key KgNB*, the new NCC and the UE security capability and other information, how to use this information can refer to Figure 1 As shown in the process, for example, the source CU in this step is regarded as Figure 1 The source gNB in ​​the embodiment shown regards the first CU in this step as Figure 1 In the target gNB of the embodiment shown, when the first CU uses this information, it may involve interaction with corresponding network elements, such as interaction with AMF, interaction with UE, etc. For details, please refer to Figure 1 The embodiment shown.

[0247] exist Figure 8 In the described method, when the UE is switched from the source CU to the first CU, if the switching is unsuccessful, the source CU can be switched to the second CU again according to the same switching process as the first CU to successfully complete the switching. Alternatively, the source CU continues to try to switch with the first CU, but the switching method is changed to the existing conventional switching method, that is, the switching method that requires the UE to regenerate the key. In this way, the UE can finally be switched from the source CU to another CU, thereby supporting the corresponding business needs.

[0248] See also Fig. 9 , Fig. 9 : is a flowchart of a CU switching method provided in an embodiment of the present application, including but not limited to the following steps:

[0249] Step S901: The UE determines that it is in the Inactive state and the radio data bearer DRB is migrated to the first CU.

[0250] Step S902: The UE sends an RRC connection resumption request Connection ResumeRequest to the first CU via the DU.

[0251] The RRC connection recovery request may include an inactive radio network temporary identifier (I-RNTI) and, optionally, a source CU address.

[0252] Step S903: The first CU receives an RRC connection recovery request from the UE.

[0253] Step S904: The first CU determines that the security context of the UE is not migrated.

[0254] It should be noted that, if it is determined that the security context of the UE has not been migrated, steps S905-S913 are executed, and if it is determined that the security context of the UE has been migrated, step S913 is executed.

[0255] Step S905: The first CU sends a security context request of the UE to the source CU.

[0256] It can be understood that a configuration may be performed in advance to stipulate that the security context request is sent without migrating the security context of the UE.

[0257] If the RRC connection recovery request carries the address of the source CU, the first CU may send the security context request according to the source CU address;

[0258] If the above-mentioned RRC connection recovery request does not carry the address of the source CU, the address of the source CU is obtained by pre-configuration, for example: the first CU pre-configures the addresses of all CUs in the cell and makes a broadcast request; or the first CU can obtain the address of the source CU of the specified UE through an additional discovery network element based on the discovery network element, and then send the security context request based on the address of the source CU.

[0259] Step S906: The source CU receives the security context request sent by the first CU.

[0260] Specifically, after receiving the request from the first CU, the source CU determines through local records whether the UE was previously transferred to the first CU due to equipment reasons. If so, a reuse key state transfer (carrying a reuse key indication) is triggered.

[0261] Step S907: The source CU determines that the conditions for reusing the source key KgNB are met.

[0262] Among them, the conditions for reusing the source key KgNB on the source CU include one or more of the following: a. When the source CU determines that the UE is in the Inactive state, the service data (i.e., the wireless data bearer DRB) is migrated to the first CU; b. The UE needs to reuse the source key KgNB when switching from the source CU to the first CU; c. Other conditions, which can be configured according to the specific scenario and are not limited here.

[0263] The reasons why the UE needs to reuse the source key KgNB include but are not limited to: (1) CU switching caused by reasons other than the UE; (2) UE needs unaware switching. For specific details, please refer to the previous related content and will not be repeated here.

[0264] Step S908: The source CU sends a first switching request to the first CU.

[0265] Specifically, the principle of step S908 is the same as that of step S602, which will not be repeated here.

[0266] Step S909: The first CU receives a first switching request sent by the source CU.

[0267] Specifically, the principle of step S909 is the same as that of step S603, which will not be repeated here.

[0268] Step S910: If the conditions for reusing the source key KgNB of the source CU are met, the first CU sends a switching request response to the source CU.

[0269] Specifically, the principle of step S910 is the same as that of step S604, which will not be described again here.

[0270] Step S911: If a switching request response sent by the first CU is received, the source CU sends a first switching indication to the DU.

[0271] Specifically, the principle of step S911 is the same as that of step S605, which will not be repeated here.

[0272] Step S912: The first CU generates a key for communicating with the UE based on the source key KgNB.

[0273] Specifically, the principle of step S912 is the same as that of step S606, which will not be repeated here.

[0274] Step S913: The first CU sends an RRC connection resume Connection Resume to the UE via the DU.

[0275] It should be noted that it is optional. Fig. 9 The illustrated embodiment may also include Figure 6Some steps in the illustrated embodiment include, for example, one or more of steps S600, S601, S607-S10, etc.

[0276] exist Fig. 9 In the method shown, during the process of UE switching from the source CU to the first CU, the first switching request sent by the source CU to the first CU includes information such as the first reuse key indication, the source key KgNB, and the source packet data convergence protocol PDCP count value (count), so that the first CU can generate a key for communicating with the UE based on the source key KgNB in ​​the first switching request, and keep the current PDCP data of the UE unchanged through the source PDCP count value, so that the CU switching process can be realized without the UE's security perception, that is, the UE does not need to regenerate the key. This can avoid bringing a large computing overhead to the UE and save computing resources.

[0277] It should be noted that in this application Figure 6 The embodiment shown and Figure 8 The illustrated embodiments may be combined with, Fig. 9 The core principle of the embodiment shown is Figure 6 The core principles of the embodiments shown are the same, so Fig. 9 The embodiment shown and Figure 8 The embodiments shown can also be combined. It is understood that when Figure 6 The embodiment shown and Figure 8 When the embodiment shown is combined, S600-S603 is executed first. If the condition of reusing the source key KgNB of the source CU is met, Figure 6 In the embodiment shown, steps S604-S610 are executed. If the condition of reusing the source key KgNB of the source CU is not met, Figure 8 In the embodiment shown (step S804+Scheme 1), the Figure 8 In the embodiment shown (step S804 + scheme 2) is executed.

[0278] The following is an introduction to the communication device provided in the embodiments of the present application.

[0279] The present application divides the functional modules of the communication device according to the above method embodiment. For example, each functional module can be divided according to each function, or two or more functions can be integrated into one processing module. The above integrated modules can be implemented in the form of hardware or software functional modules. It should be noted that the division of modules in the present application is schematic and is only a logical function division. There may be other division methods in actual implementation. Figures 10 to 12 The communication device according to the embodiment of the present application is described in detail.

[0280] Fig.10is a schematic diagram of the structure of a communication device provided in an embodiment of the present application, such as Fig.10 As shown, the communication device includes a processing module 1001 and a transceiver module 1002. The transceiver module 1002 can implement corresponding communication functions, and the processing module 1001 is used for data processing. For example, the transceiver module 1002 can also be called an interface, a communication interface or a communication module.

[0281] In some embodiments of the present application, the communication device can be used to execute the actions performed by the sender in the above method embodiment, such as the sender can be the device itself or a chip or functional module that can be configured in the device, etc. The transceiver module 1002 is used to perform the operations related to the sending and receiving of the sender in the above method embodiment, and the processing module 1001 is used to perform the operations related to the processing of the sender in the above method embodiment. The processing module 1001 can perform the corresponding operation by calling a computer program, or by a corresponding hardware circuit. The transceiver module 1002 can perform the transceiver operation independently, or it can perform the corresponding transceiver operation under the control of the processing module 1001.

[0282] For example, Fig.10 The communication device shown may be a source CU or a device in the source CU. The processing module 1001 and the transceiver module 1002 in the communication device may respectively perform the following operations:

[0283] The transceiver module 1002 is used to send a first switching request to the first CU, wherein the first switching request includes a first reuse key indication, a source key KgNB and a source packet data convergence protocol PDCP count value, the first switching request is used to request to switch the user equipment UE from the source CU to the first CU, the first reuse key indication is used to indicate that the first CU reuses the source key KgNB and the source PDCP of the source CU after establishing a connection with the UE, the source key KgNB includes the access layer key of the UE used by the source CU; the source key KgNB is used to generate a key for communicating with the UE; the source PDCP count value is used to identify the current PDCP data of the UE;

[0284] If the transceiver module 1002 receives a switching request response sent by the first CU, the transceiver module 1002 sends a first switching indication to the DU, where the first switching indication is used to trigger the first CU to establish a connection with the DU.

[0285] Using the above method, in the process of UE switching from the source CU to the first CU, the first switching request sent by the source CU to the first CU includes the first reuse key indication, the source key KgNB, the source packet data convergence protocol PDCP count value (count) and other information, so that the first CU can generate a key for communicating with the UE based on the source key KgNB in ​​the first switching request, and keep the current PDCP data of the UE unchanged through the source PDCP count value, so that the CU switching process can be realized without the UE's security perception, that is, the UE does not need to regenerate the key. This can avoid bringing a large computing overhead to the UE and save computing resources.

[0286] In one possible implementation:

[0287] If the transceiver module 1002 receives a switching failure response sent by the first CU, the transceiver module 1002 sends a second switching request to the second CU, wherein the second switching request includes a second reuse key indication, the source key KgNB and a source packet data convergence protocol PDCP count value, and the second switching request is used to request to switch the UE from the source CU to the second CU, and the second reuse key indication is used to indicate that the second CU reuses the source key KgNB and the source PDCP of the source CU after establishing a connection with the UE, and the source key KgNB includes the access layer key of the UE used by the source CU; the source key KgNB is used to generate a key for communicating with the UE; the source PDCP count value is used to identify the current PDCP data of the UE;

[0288] If the transceiver module 1002 receives a switching request response sent by the second CU, the transceiver module 1002 sends a second switching indication to the DU, where the second switching indication is used to trigger the second CU to establish a connection with the DU.

[0289] In this implementation, when the UE is switched from the source CU to the first CU, if the switching is unsuccessful, the source CU can be switched to the second CU again according to the same switching process as the first CU to successfully complete the switching. In this way, the UE can be finally switched from the source CU to another CU, thereby supporting the corresponding service needs.

[0290] In one possible implementation:

[0291] If the transceiver module 1002 receives a handover failure response sent by the first CU, the processing module 1001 generates a new source key KgNB*;

[0292] The transceiver module 1002 sends a third switching request to the first CU, wherein the third switching request includes the new source key KgNB*, the new next hop chain counter parameter NCC and the UE security capability, and the third switching request is used to switch the UE from the source CU to the first CU, and the new source key KgNB*, the new NCC and the UE security capability are used to generate a key for communicating with the UE.

[0293] In this implementation, when the UE is switched from the source CU to the first CU, if the switching is unsuccessful, the source CU continues to try to switch with the first CU, but the switching method is changed to the existing conventional switching method, that is, the switching method that requires the UE to regenerate the key. In this way, the UE can finally be switched from the source CU to another CU, thereby supporting the corresponding service needs.

[0294] In another possible implementation, the first reuse key indication includes a switching reason, where the switching reason includes a switching not caused by the UE, or the UE requires a UE security unaware switching.

[0295] It can be understood that the switching reason is sent to the first CU via the first reuse key indication, so that the first CU can judge whether to accept the security-imperceptible switching of the UE, making the switching mode more targeted and better meeting the business needs of specific scenarios.

[0296] In another possible implementation, the non-UE-induced switching includes switching caused by a device life cycle, or switching caused by merging multiple devices, or switching caused by device energy saving.

[0297] In yet another possible implementation, the first handover request further includes UE security capabilities. Optionally, the first handover request is further used to indicate that the UE security capabilities are to be ignored.

[0298] In another possible implementation, the first switching request also includes an encryption and / or security algorithm identifier alg-ID of the source CU, and the alg-ID and the source key KgNB are used to generate a key for communicating with the UE.

[0299] In another possible implementation, before sending the first switching request to the first CU, the transceiver module 1002 is further configured to receive a security context request sent by the first CU;

[0300] The processing module 1001 is used to determine that the service data has been migrated to the first CU.

[0301] It should be noted that this implementation method can be applied to the RRC inactive scenario, in which the source CU decides whether to perform a security context transfer without changing the UE key, and the source UE triggers the corresponding switching process.

[0302] Reuse Fig.10 , in some other embodiments of the present application, exemplarily, Fig.10 The communication device shown may be a first CU or a device in the first CU, and the processing module 1001 and the transceiver module 1002 in the communication device may respectively perform the following operations:

[0303] The transceiver module 1002 receives a first switching request sent by a source CU, wherein the first switching request includes a first reuse key indication, a source key KgNB, and a source packet data convergence protocol PDCP count value, the first switching request is used to request to switch a user equipment UE from a source CU to the first CU, the first reuse key indication is used to indicate that the first CU reuses the source key KgNB and the source PDCP of the source CU after establishing a connection with the UE, the source key KgNB includes an access layer key of the UE used by the source CU; the source PDCP count value is used to identify the current PDCP data of the UE;

[0304] If the processing module 1001 determines that the condition for reusing the source key KgNB of the source CU is met, the transceiver module 1002 sends a switching request response to the source CU;

[0305] The processing module 1001 generates a key for communicating with the UE based on the source key KgNB, and the key for communicating with the UE is used for data transmission encryption on the user plane and / or signaling plane.

[0306] Using the above method, in the process of UE switching from the source CU to the first CU, the first switching request sent by the source CU to the first CU includes the first reuse key indication, the source key KgNB, the source packet data convergence protocol PDCP count value (count) and other information, so that the first CU can generate a key for communicating with the UE based on the source key KgNB in ​​the first switching request, and keep the current PDCP data of the UE unchanged through the source PDCP count value, so that the CU switching process can be realized without the UE's security perception, that is, the UE does not need to regenerate the key. This can avoid bringing a large computing overhead to the UE and save computing resources.

[0307] In a possible implementation, after the processing module 1001 generates a key for communicating with the UE according to the source base station key KgNB, the transceiver module 1002 is also used to establish a connection with the DU.

[0308] In combination with or any possible implementation, in another possible implementation, after the transceiver module 1002 establishes a connection with the DU, it is also used to send a path switching message Path Switch message to the AMF.

[0309] In another possible implementation, if the processing module 1001 determines that the conditions for reusing the KgNB of the source CU are not met, the transceiver module 1002 is used to send a switching failure response to the source CU.

[0310] It can be understood that if the first CU does not accept the switch, the result is fed back to the source CU so that the source CU decides whether to change the switching method or change a target CU for switching, thereby finally completing the CU switching or not performing the switching.

[0311] In yet another possible implementation:

[0312] The transceiver module 1002 is used to receive a third switching request sent by the source CU, wherein the third switching request includes a new source key KgNB*, a new next hop chain counter parameter NCC, and a UE security capability, and the third switching request is used to switch the UE from the source CU to the first CU;

[0313] The processing module 1001 is used to generate a key for communicating with the UE based on the new source key KgNB*, the new NCC and the UE security capability.

[0314] In this implementation, when the UE is switched from the source CU to the first CU, if the switching is unsuccessful, the source CU continues to try to switch with the first CU, but the switching method is changed to the existing conventional switching method, that is, the switching method that requires the UE to regenerate the key. In this way, the UE can finally be switched from the source CU to another CU, thereby supporting the corresponding service needs.

[0315] In another possible implementation, the first reuse key indication includes a switching reason, and the switching reason includes a switching not caused by the UE, or the UE requires a secure unaware switching of the UE. It can be understood that the switching reason is sent to the first CU via the first reuse key indication, so that the first CU can determine whether to accept the secure unaware switching of the UE. This makes the switching method more targeted and can better meet the business needs of specific scenarios.

[0316] In another possible implementation, the non-UE-induced switching includes switching caused by a device life cycle, or switching caused by merging multiple devices, or switching caused by device energy saving.

[0317] In another possible implementation, the first switching request also includes an encryption and / or integrity algorithm identifier alg-ID of the source CU, and the condition for reusing the KgNB of the source CU also includes that the first CU supports the algorithm indicated by the alg-ID of the source CU.

[0318] In yet another possible implementation, the first switching request further includes UE security capabilities, and the UE security capabilities are ignored in the process of generating a key for communicating with the UE.

[0319] In another possible implementation, before the transceiver module 1002 receives the first handover request sent by the source CU, it is further configured to receive an RRC connection recovery request from the UE;

[0320] The processing module 1001 is used to determine that the security context of the UE is not migrated;

[0321] The transceiver module 1002 is used to send a security context request of the UE to the source CU.

[0322] It should be noted that this implementation method can be applied to the RRC inactive scenario, in which the source CU decides whether to perform a security context transfer without changing the UE key, and the source UE triggers the corresponding switching process.

[0323] In yet another possible implementation, the RRC connection recovery request includes the address of the source CU.

[0324] In another possible implementation, after the transceiver module 1002 establishes a connection with the DU, it is further configured to send a connection message to the UE through the DU.

[0325] The specific descriptions of the transceiver module and the processing module shown in the above embodiments are only examples. For the specific functions or execution steps of the transceiver module and the processing module, reference may be made to the above method embodiments and will not be described in detail here.

[0326] The above describes the communication device of the embodiment of the present application, and the following describes possible product forms of the communication device. Fig.10 Any form of product that has the functions of the communication device falls within the protection scope of the embodiments of the present application.

[0327] The following description is for illustrative purposes only and does not limit the product form of the communication device of the embodiment of the present application to this.

[0328] In one possible implementation, Fig.10In the communication device shown, the processing module 1001 may be one or more processors, the transceiver module 1002 may be a transceiver, or the transceiver module 1002 may also be a sending module and a receiving module, the sending module may be a transmitter, the receiving module may be a receiver, and the sending module and the receiving module are integrated into one device, such as a transceiver. In the embodiment of the present application, the processor and the transceiver may be coupled, etc., and the embodiment of the present application does not limit the connection mode of the processor and the transceiver. In the process of executing the above method, the process of sending information in the above method may be a process in which the processor outputs the above information. When outputting the above information, the processor outputs the above information to the transceiver so that it is transmitted by the transceiver. After the above information is output by the processor, it may also need to be processed in other ways before it reaches the transceiver. Similarly, the process of receiving information in the above method may be a process in which the processor receives the input information. When the processor receives the input information, the transceiver receives the above information and inputs it into the processor. Furthermore, after the transceiver receives the above information, the above information may need to be processed in other ways before it is input into the processor.

[0329] like Fig.11 As shown, the communication device 110 includes one or more processors 1120 and a transceiver 1110. Exemplarily, the transceiver 1110 is configured to execute the following Fig.10 The functions or steps implemented by the transceiver module 1002 shown in FIG. 1 are as follows: Fig.10 The functions or steps implemented by the processing module 1001 shown in FIG. 10A and 10B can be referred to for details about the processor 1120 and the transceiver 1110. Fig.10 Or the method embodiments shown above will not be described in detail here.

[0330] In each of the above embodiments, the description of the relevant steps and information can refer to the introduction in the above method embodiment, and will not be described in detail here.

[0331] exist Fig.11 In various implementations of the communication device shown, the transceiver may include a receiver and a transmitter, wherein the receiver is used to perform a receiving function (or operation) and the transmitter is used to perform a transmitting function (or operation). The transceiver is used to communicate with other devices / devices through a transmission medium.

[0332] Optionally, the communication device 110 may also include one or more memories 1130 for storing program instructions and / or data. The memory 1130 is coupled to the processor 1120. The coupling in the embodiment of the present application is an indirect coupling or communication connection between devices, units or modules, which may be electrical, mechanical or other forms, and is used for information exchange between devices, units or modules. The processor 1120 may operate in conjunction with the memory 1130. The processor 1120 may execute program instructions stored in the memory 1130. Optionally, at least one of the one or more memories may be included in the processor.

[0333] The specific connection medium between the transceiver 1110, the processor 1120 and the memory 1130 is not limited in the embodiment of the present application. Fig.11 The memory 1130, the processor 1120 and the transceiver 1110 are connected via a bus 1140. Fig.11 The connections between the other components are shown in bold lines, which are only for illustration and are not intended to be limiting. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Fig.11 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0334] In the embodiments of the present application, the processor may be a general-purpose processor, a digital signal processor, an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component, etc., and may implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of the present application. The general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of the method disclosed in the embodiments of the present application may be directly embodied as being executed by a hardware processor, or may be executed by a combination of hardware and software modules in the processor, etc.

[0335] In the embodiment of the present application, the memory may include, but is not limited to, non-volatile memory such as a hard disk drive (HDD) or a solid-state drive (SSD), a random access memory (RAM), an erasable programmable read-only memory (EPROM), a read-only memory (ROM) or a portable read-only memory (CD-ROM), etc. The memory is any storage medium that can be used to carry or store program codes in the form of instructions or data structures and can be read and / or written by a computer (such as a communication device shown in the present application), but is not limited thereto. The memory in the embodiment of the present application can also be a circuit or any other device that can realize a storage function, for storing program instructions and / or data.

[0336] The processor 1120 is mainly used to process the communication protocol and communication data, and to control the entire communication device, execute the software program, and process the data of the software program. The memory 1130 is mainly used to store the software program and data. The transceiver 1110 may include a control circuit and an antenna. The control circuit is mainly used to convert the baseband signal and the radio frequency signal and process the radio frequency signal. The antenna is mainly used to send and receive radio frequency signals in the form of electromagnetic waves. The input and output devices, such as a touch screen, a display screen, a keyboard, etc., are mainly used to receive data input by the user and output data to the user.

[0337] When the communication device is turned on, the processor 1120 can read the software program in the memory 1130, interpret and execute the instructions of the software program, and process the data of the software program. When data needs to be sent wirelessly, the processor 1120 performs baseband processing on the data to be sent, and outputs the baseband signal to the RF circuit. The RF circuit performs RF processing on the baseband signal and then sends the RF signal outward in the form of electromagnetic waves through the antenna. When data is sent to the communication device, the RF circuit receives the RF signal through the antenna, converts the RF signal into a baseband signal, and outputs the baseband signal to the processor 1120. The processor 1120 converts the baseband signal into data and processes the data.

[0338] In another implementation, the RF circuit and antenna may be arranged independently of the processor performing baseband processing. For example, in a distributed scenario, the RF circuit and antenna may be arranged remotely from the communication device.

[0339] The communication device shown in the embodiment of the present application may also have Fig.11The embodiments of the present application do not limit the number of components and the like. The methods executed by the processor and the transceiver shown above are only examples, and the specific steps executed by the processor and the transceiver can refer to the methods described above.

[0340] In another possible implementation, Fig.10 In the communication device shown, the processing module 1001 may be one or more logic circuits, and the transceiver module 1002 may be an input / output interface, or a communication interface, or an interface circuit, or an interface, etc. Alternatively, the transceiver module 1002 may be a sending module and a receiving module, the sending module may be an output interface, and the receiving module may be an input interface, and the sending module and the receiving module may be integrated into one module, such as an input / output interface. Fig.12 As shown, Fig.12 The communication device shown includes a logic circuit 1201 and an interface 1202. That is, the processing module 1001 can be implemented by the logic circuit 1201, and the transceiver module 1002 can be implemented by the interface 1202. The logic circuit 1201 can be a chip, a processing circuit, an integrated circuit or a system on chip (SoC) chip, etc., and the interface 1202 can be a communication interface, an input / output interface, a pin, etc. For example, Fig.12 The above communication device is taken as an example as a chip, and the chip includes a logic circuit 1201 and an interface 1202 .

[0341] In the embodiment of the present application, the logic circuit and the interface may also be coupled to each other. The embodiment of the present application does not limit the specific connection method between the logic circuit and the interface. For example, the logic circuit 1201 may be used to perform the following Fig.10 The functions or steps implemented by the processing module 1001 shown in FIG. 1001, the interface 1202 can be used to perform the following steps: Fig.10 The functions or steps implemented by the transceiver module 1002 shown in FIG. 1002 are shown in FIG. 1002 . For a detailed description of the logic circuit 1201 and the interface 1202, please refer to FIG. Fig.10 Or the method embodiments shown above will not be described in detail here.

[0342] The above description of the communication device is only an example. Fig.12 The specific description of the communication device shown can also refer to the above method embodiment or Fig.10 or Fig.11 , which will not be described in detail here.

[0343] The communication device shown in the embodiment of the present application can implement the method provided in the embodiment of the present application in the form of hardware, or can implement the method provided in the embodiment of the present application in the form of software, etc., and the embodiment of the present application is not limited to this.

[0344] For the description of the relevant steps and information in the above embodiments, please refer to the description in the above method embodiments, and will not be described in detail here. Fig.12 The specific implementation methods of the various embodiments shown can also refer to the above embodiments, which will not be described in detail here.

[0345] An embodiment of the present application also provides a communication system, which includes a source CU and a first CU, wherein the source CU and the first CU interact to execute all or part of the steps in any of the aforementioned method embodiments.

[0346] In addition, the present application also provides a computer program, which is used to implement the operations and / or processing performed by each communication device in the method provided by the present application.

[0347] The present application also provides a computer-readable storage medium, in which computer codes are stored. When the computer codes are executed on a computer, the computer executes the operations and / or processes performed by each communication device in the method provided by the present application.

[0348] The present application also provides a computer program product, which includes a computer code or a computer program. When the computer code or the computer program runs on a computer, the operations and / or processes performed by each method provided by the present application are executed.

[0349] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the modules is only a logical function division. There may be other division methods in actual implementation, such as multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, or it can be an electrical, mechanical or other form of connection.

[0350] The modules described as separate components may or may not be physically separated, and the components displayed as modules may or may not be physical modules, that is, they may be located in one place or distributed on multiple network modules. Some or all of the modules may be selected according to actual needs to achieve the technical effects of the solutions provided in the embodiments of the present application.

[0351] In addition, each functional module in each embodiment of the present application can be integrated into one processing module, or each module can exist physically separately, or two or more modules can be integrated into one module. The above integrated modules can be implemented in the form of hardware or software functional modules.

[0352] If the integrated module is implemented in the form of a software function module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or partly contributed to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a readable storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned readable storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk and other media that can store program code.

[0353] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A central unit switching method, characterized in that: Applied to a source central unit CU, the method comprises: Sending a first handover request to a first CU, wherein the first handover request includes a first reuse key indication, a source key, and a source packet data convergence protocol PDCP count value, the first handover request is used to request to switch a user equipment UE from a source CU to the first CU, the first reuse key indication is used to instruct the first CU to reuse the source key and the source PDCP of the source CU after establishing a connection with the UE, the source key includes an access layer key of the UE used by the source CU; the source key is used to generate a key for communicating with the UE; the source PDCP count value is used to identify the current PDCP data of the UE; If a switching request response sent by the first CU is received, a first switching indication is sent to the DU, where the first switching indication is used to trigger the first CU to establish a connection with the DU.

2. The method according to claim 1, characterized in that Also includes: If a handover failure response sent by the first CU is received, a second handover request is sent to the second CU, wherein the second handover request includes a second reuse key indication, the source key and a source packet data convergence protocol PDCP count value, the second handover request is used to request to switch the UE from the source CU to the second CU, the second reuse key indication is used to instruct the second CU to reuse the source key and the source PDCP of the source CU after establishing a connection with the UE, the source key includes the access layer key of the UE used by the source CU; the source key is used to generate a key for communicating with the UE; the source PDCP count value is used to identify the current PDCP data of the UE; If a switching request response sent by the second CU is received, a second switching indication is sent to the DU, where the second switching indication is used to trigger the second CU to establish a connection with the DU.

3. The method according to claim 1, characterized in that Also includes: If a switching failure response sent by the first CU is received, generating a new source key; A third switching request is sent to the first CU, wherein the third switching request includes the new source key, a new next hop chain counter parameter NCC, and UE security capabilities, the third switching request is used to switch the UE from the source CU to the first CU, and the new source key, new NCC, and UE security capabilities are used to generate a key for communicating with the UE.

4. The method according to any one of claims 1 to 3, characterized in that: The first reuse key indication includes a switching reason, where the switching reason includes a switching not caused by the UE, or the UE requires a UE security unaware switching.

5. The method according to claim 4, characterized in that The non-UE-induced switching includes switching caused by device life cycle, switching caused by merging multiple devices, or switching caused by device energy saving.

6. The method according to any one of claims 1 to 5, characterized in that: The first handover request also includes UE security capabilities, and the first handover request is further used to indicate that the UE security capabilities should be ignored.

7. The method according to claim 6, characterized in that The first switching request also includes an encryption and / or integrity algorithm identifier alg-ID of the source CU, and the alg-ID and the source key are used to generate a key for communicating with the UE.

8. The method according to any one of claims 1 to 7, characterized in that: Before sending the first switching request to the first CU, the method further includes: receiving a security context request sent by the first CU; It is determined that the service data has been migrated to the first CU.

9. A central unit switching method, characterized in that: Applied to a first central unit CU, the method comprises: Receive a first handover request sent by a source CU, wherein the first handover request includes a first reuse key indication, a source key, and a source packet data convergence protocol PDCP count value, the first handover request is used to request to switch a user equipment UE from a source CU to the first CU, the first reuse key indication is used to indicate that the first CU reuses the source key and the source PDCP of the source CU after establishing a connection with the UE, the source key includes an access layer key of the UE used by the source CU; the source PDCP count value is used to identify the current PDCP data of the UE; If the condition for reusing the source key of the source CU is met, sending a switching request response to the source CU; A key for communicating with the UE is generated according to the source key, and the key for communicating with the UE is used for data transmission encryption on the user plane and / or the signaling plane.

10. The method according to claim 9, characterized in that After the key for communicating with the UE is generated according to the source key, the method further includes: A connection is established with the DU.

11. The method according to claim 10, characterized in that After the connection with the DU is established, the following steps are also included: Send a Path Switch message to AMF.

12. The method according to any one of claims 9 to 11, characterized in that: Also includes: If the condition for reusing the source key of the source CU is not met, a switching failure response is sent to the source CU.

13. The method according to any one of claims 9 to 12, characterized in that: Also includes: Receive a third switching request sent by a source CU, wherein the third switching request includes a new source key, a new next hop chain counter parameter NCC, and UE security capabilities, and the third switching request is used to switch the UE from the source CU to the first CU; A key for communicating with the UE is generated according to the new source key, the new NCC and the UE security capability.

14. The method according to any one of claims 9 to 13, characterized in that: The first reuse key indication includes a switching reason, where the switching reason includes a switching not caused by the UE, or the UE requires a UE security unaware switching.

15. The method according to claim 14, characterized in that The non-UE-induced switching includes switching caused by device life cycle, switching caused by merging multiple devices, or switching caused by device energy saving.

16. The method according to any one of claims 9 to 15, characterized in that: The first switching request also includes an encryption and / or integrity algorithm identifier alg-ID of the source CU, and the condition for reusing the source key of the source CU also includes that the first CU supports the algorithm indicated by the alg-ID of the source CU.

17. The method according to claims 9-16, characterized in that The first switching request also includes UE security capabilities, and the UE security capabilities are ignored in the process of generating a key for communicating with the UE.

18. The method according to any one of claims 9 to 17, characterized in that: Before receiving the first switching request sent by the source CU, the method further includes: receiving an RRC connection recovery request from the UE; Determining that the security context of the UE is not migrated; Send a security context request of the UE to the source CU.

19. The method according to claim 18, characterized in that The RRC connection resumption request includes the address of the source CU.

20. The method according to claim 10 or 11, characterized in that After the connection with the DU is established, the following steps are also included: A connection message is sent to the UE through the DU.

21. A central unit switching method, characterized in that: Applied to a communication system, the communication system includes a source CU and a first CU, the method includes: The source CU sends a first switching request to the first CU, wherein the first switching request includes a first reuse key indication, a source key, and a source packet data convergence protocol PDCP count value, the first switching request is used to request to switch a user equipment UE from the source CU to the first CU, the first reuse key indication is used to instruct the first CU to reuse the source key and the source PDCP of the source CU after establishing a connection with the UE, the source key includes an access layer key of the UE used by the source CU; the source key is used to generate a key for communicating with the UE; the source PDCP count value is used to identify the current PDCP data of the UE; The first CU receives the first switching request sent by the source CU; If a condition for reusing the source key of the source CU is met, the first CU sends a switching request response to the source CU; The first CU generates a key for communicating with the UE according to the source key, and the key for communicating with the UE is used for data transmission encryption on a user plane and / or a signaling plane.

22. The method according to claim 21, characterized in that The communication system further includes a second CU, and the method further includes: If a switching failure response sent by the first CU is received, the source CU sends a second switching request to the second CU, wherein the second switching request includes a second reuse key indication, the source key and a source packet data convergence protocol PDCP count value, and the second switching request is used to request to switch the UE from the source CU to the second CU, and the second reuse key indication is used to instruct the second CU to reuse the source key and the source PDCP of the source CU after establishing a connection with the UE, and the source key includes the access layer key of the UE used by the source CU; the source key is used to generate a key for communicating with the UE; the source PDCP count value is used to identify the current PDCP data of the UE; The second CU receives the second switching request sent by the source CU; If a condition for reusing the source key of the source CU is met, the second CU sends a switching request response to the source CU; If a handover request response sent by the second CU is received, the source CU sends a second handover indication to the DU, where the second handover indication is used to trigger the DU to establish a connection with the second CU; The second CU generates a key for communicating with the UE according to the source key, and the key for communicating with the UE is used for data transmission encryption on a user plane and / or a signaling plane.

23. The method according to claim 21, characterized in that Also includes: If a switching failure response sent by the first CU is received, the source CU generates a new source key; The source CU sends a third switching request to the first CU, wherein the third switching request includes the new source key, the new NCC and the UE security capability, and the third switching request is used to switch the UE from the source CU to the first CU; The first CU receives a third switching request sent by the source CU; The first CU generates a key for communicating with the UE according to the new source key, the new NCC and the UE security capability.

24. The method according to any one of claims 21 to 23, characterized in that: Also includes: The first CU receives an RRC connection recovery request from the UE; The first CU determines that the security context of the UE is not migrated; The first CU sends a security context request of the UE to the source CU; The source CU receives a security context request sent by the first CU; The source CU determines that the service data has been migrated to the first CU.

25. A communication device, characterized in that: The communication device comprises a module for executing the method according to any one of claims 1 to 8; or, the communication device comprises a processor, and the processor is used to execute the method according to any one of claims 1 to 8.

26. A communication device, characterized in that: The communication device comprises a module for executing the method according to any one of claims 9 to 20; or, the communication device comprises a processor, and the processor is used to execute the method according to any one of claims 9 to 20.

27. A communication device, characterized in that: comprising a logic circuit and an interface, wherein the logic circuit and the interface are coupled; The interface is used to input and / or output information, and the logic circuit is used to execute the method according to any one of claims 1-8.

28. A communication device, characterized in that: comprising a logic circuit and an interface, wherein the logic circuit and the interface are coupled; The interface is used to input and / or output information, and the logic circuit is used to execute the method according to any one of claims 9-20.

29. A computer-readable storage medium, characterized in that: The computer-readable storage medium is used to store a computer program. When the computer program is executed, the method according to any one of claims 1 to 20 is executed.

30. A communication system, characterized in that: The method comprises a source CU and a first CU, wherein the source CU is used to execute the method according to any one of claims 1 to 8, and the first CU is used to execute the method according to any one of claims 9 to 20.

Images