Security capability negotiation method, device, equipment, network element and system

Abstract

Disclosed are a security capability negotiation method, apparatus, device, network element and system, which belong to the field of communications, the security capability negotiation method of the embodiment of the present application comprising: an A-IoT device receiving first information from a first network element, the first information being used for configuring or activating a first security parameter set; in response to the first information, the A-IoT device sends first response information to the first network element; wherein the first security parameter set satisfies any one of the following items: the first security parameter set is determined based on security capability parameters of the A-IoT device; the security capability parameter is determined based on the security capability parameter of the A-IoT device and the security capability parameter of the first network element; the security capability parameter is determined based on the security capability parameter of the A-IoT device, the security capability parameter of the first network element and the security capability parameter of the second network element; wherein the second network element communicates with the A-IoT device through the first network element. The safety communication function can be started as required, and the low-power-consumption requirement of the A-IoT device is met.

Description

Technical Field

[0001] The present application relates to the field of communications, and more specifically, to a security capability negotiation method, apparatus, device, network element and system. Background Art

[0002] Ambient Internet of Things (A-IoT) devices are low in complexity and cost, maintenance-free and battery-free, can support energy harvesting and / or backscatter communication, and can be deployed at high density and scale at low cost. However, the current secure communication of A-IoT devices cannot meet the low power consumption requirements of A-IoT devices. How to design the secure communication function of A-IoT devices to meet the low power consumption requirements of A-IoT devices is a problem that needs to be solved. Summary of the invention

[0003] The embodiments of the present application provide a security capability negotiation method, apparatus, device, network element and system. The first network element or the second network element can at least determine the security parameter set to be configured or activated based on the security capability parameters of the A-IoT device, and negotiate with the A-IoT device to determine whether to activate the security parameter set, so that the secure communication function can be enabled as needed, and some security parameters can be enabled or activated as needed, thereby meeting the low power consumption requirements of the A-IoT device and solving the problem of low power consumption secure communication of the A-IoT device.

[0004] In a first aspect, a security capability negotiation method is provided, the method comprising:

[0005] The A-IoT device receives first information from the first network element, wherein the first information is used to configure or activate a first security parameter set;

[0006] In response to the first information, the A-IoT device sends a first response message to the first network element;

[0007] The first security parameter set satisfies any of the following:

[0008] Determined based on the security capability parameters of the A-IoT device;

[0009] Determined based on the security capability parameter of the A-IoT device and the security capability parameter of the first network element;

[0010] Determined based on the security capability parameters of the A-IoT device, the security capability parameters of the first network element, and the security capability parameters of the second network element;

[0011] The second network element communicates with the A-IoT device through the first network element.

[0012] In a second aspect, a security capability negotiation method is provided, the method comprising:

[0013] The first network element sends first information to the A-IoT device, wherein the first information is used to configure or activate a first security parameter set;

[0014] The first network element receives first response information from the A-IoT device, wherein the first response information is a response to the first information;

[0015] The first security parameter set satisfies any of the following:

[0016] Determined based on the security capability parameters of the A-IoT device;

[0017] Determined based on the security capability parameter of the A-IoT device and the security capability parameter of the first network element;

[0018] Determined based on the security capability parameters of the A-IoT device, the security capability parameters of the first network element, and the security capability parameters of the second network element;

[0019] The second network element communicates with the A-IoT device through the first network element.

[0020] In a third aspect, a security capability negotiation method is provided, which is applied to a security capability negotiation system, the security capability negotiation system including an A-IoT device, a first network element, a second network element, and an application server, wherein the second network element communicates with the A-IoT device through the first network element, and the method includes:

[0021] The first network element sends first information to the A-IoT device, and the first network element receives first response information from the A-IoT device; or,

[0022] The second network element sends first information to the A-IoT device through the first network element, and the second network element receives first response information from the A-IoT device through the first network element;

[0023] The first information is used to configure or activate a first security parameter set, and the first response information is a response to the first information;

[0024] The first security parameter set satisfies any of the following:

[0025] Determined based on the security capability parameters of the A-IoT device;

[0026] Determined based on the security capability parameter of the A-IoT device and the security capability parameter of the first network element;

[0027] Determined based on the security capability parameters of the A-IoT device, the security capability parameters of the first network element, and the security capability parameters of the second network element.

[0028] In a fourth aspect, a security capability negotiation device is provided, including:

[0029] A transceiver unit, configured to receive first information from a first network element, wherein the first information is used to configure or activate a first security parameter set;

[0030] In response to the first information, the transceiver unit is further configured to send first response information to the first network element;

[0031] The first security parameter set satisfies any of the following:

[0032] Determined based on the security capability parameters of the security capability negotiation device;

[0033] Determined based on the security capability parameter of the security capability negotiation device and the security capability parameter of the first network element;

[0034] Determined based on the security capability parameter of the security capability negotiation device, the security capability parameter of the first network element, and the security capability parameter of the second network element;

[0035] The second network element communicates with the security capability negotiation device through the first network element.

[0036] In a fifth aspect, a security capability negotiation device is provided, including:

[0037] A transceiver unit, configured to send first information to the A-IoT device, wherein the first information is used to configure or activate a first security parameter set;

[0038] The transceiver unit is further configured to receive first response information from the A-IoT device, wherein the first response information is a response to the first information;

[0039] The first security parameter set satisfies any of the following:

[0040] Determined based on the security capability parameters of the A-IoT device;

[0041] Determined based on the security capability parameter of the A-IoT device and the security capability parameter of the first network element;

[0042] Determined based on the security capability parameters of the A-IoT device, the security capability parameters of the first network element, and the security capability parameters of the second network element;

[0043] The second network element communicates with the A-IoT device through the first network element.

[0044] In a sixth aspect, a security capability negotiation system is provided, the security capability negotiation system comprising an A-IoT device, a first network element, a second network element, and an application server, wherein the second network element communicates with the A-IoT device through the first network element;

[0045] The first network element is used to send the first information to the A-IoT device, and the first network element is used to receive the first response information from the A-IoT device; or, the second network element is used to send the first information to the A-IoT device through the first network element, and the second network element is used to receive the first response information from the A-IoT device through the first network element;

[0046] The first information is used to configure or activate a first security parameter set, and the first response information is a response to the first information;

[0047] The first security parameter set satisfies any of the following:

[0048] Determined based on the security capability parameters of the A-IoT device;

[0049] Determined based on the security capability parameter of the A-IoT device and the security capability parameter of the first network element;

[0050] Determined based on the security capability parameters of the A-IoT device, the security capability parameters of the first network element, and the security capability parameters of the second network element.

[0051] In the seventh aspect, an A-IoT device is provided, which includes a transceiver, a processor and a memory, wherein the memory stores programs or instructions that can be run on the processor, and when the program or instructions are executed by the processor, the steps of the method described in the first aspect are implemented.

[0052] In an eighth aspect, an A-IoT device is provided, including a processor and a communication interface;

[0053] The communication interface is used to receive first information from a first network element, wherein the first information is used to configure or activate a first security parameter set;

[0054] In response to the first information, the communication interface is further used to send first response information to the first network element;

[0055] The first security parameter set satisfies any of the following:

[0056] Determined based on the security capability parameters of the A-IoT device;

[0057] Determined based on the security capability parameter of the A-IoT device and the security capability parameter of the first network element;

[0058] Determined based on the security capability parameters of the A-IoT device, the security capability parameters of the first network element, and the security capability parameters of the second network element;

[0059] The second network element communicates with the A-IoT device through the first network element.

[0060] In a ninth aspect, a first network element is provided, which includes a transceiver, a processor and a memory, wherein the memory stores a program or instruction that can be run on the processor, and when the program or instruction is executed by the processor, the steps of the method described in the second aspect are implemented.

[0061] In a tenth aspect, a first network element is provided, comprising a processor and a communication interface;

[0062] The communication interface is used to send first information to the A-IoT device, wherein the first information is used to configure or activate a first security parameter set;

[0063] The communication interface is also used to receive first response information from the A-IoT device, wherein the first response information is a response to the first information;

[0064] The first security parameter set satisfies any of the following:

[0065] Determined based on the security capability parameters of the A-IoT device;

[0066] Determined based on the security capability parameter of the A-IoT device and the security capability parameter of the first network element;

[0067] Determined based on the security capability parameters of the A-IoT device, the security capability parameters of the first network element, and the security capability parameters of the second network element;

[0068] The second network element communicates with the A-IoT device through the first network element.

[0069] In the eleventh aspect, a readable storage medium is provided, on which a program or instruction is stored. When the program or instruction is executed by a processor, the steps of the method described in the first aspect are implemented, or the steps of the method described in the second aspect are implemented, or the steps of the method described in the third aspect are implemented.

[0070] In the twelfth aspect, a wireless communication system is provided, including: an A-IoT device and a first network element, wherein the A-IoT device can be used to execute the steps of the method described in the first aspect, and the first network element can be used to execute the steps of the method described in the second aspect.

[0071] In the thirteenth aspect, a chip is provided, comprising a processor and a communication interface, wherein the communication interface is coupled to the processor, and the processor is used to run a program or instructions to implement the method as described in the first aspect, or the method as described in the second aspect, or the method as described in the third aspect.

[0072] In a fourteenth aspect, a computer program / program product is provided, wherein the computer program / program product is stored in a storage medium, and the program / program product is executed by at least one processor to implement the steps of the security capability negotiation method as described in any one of the first to third aspects.

[0073] In the embodiment of the present application, the first security parameter set satisfies any one of the following: determined based on the security capability parameters of the A-IoT device, determined based on the security capability parameters of the A-IoT device and the security capability parameters of the first network element, determined based on the security capability parameters of the A-IoT device, the security capability parameters of the first network element, and the security capability parameters of the second network element. That is, in the embodiment of the present application, the first network element or the second network element can at least determine the security parameter set to be configured or activated based on the security capability parameters of the A-IoT device, and negotiate with the A-IoT device to determine whether to activate the security parameter set, so that the secure communication function can be enabled as needed, and some security parameters can be enabled or activated as needed, thereby meeting the low power consumption requirements of the A-IoT device. BRIEF DESCRIPTION OF THE DRAWINGS

[0074] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the description of the embodiments of the present application will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0075] Figure 1 It is a schematic diagram of a communication system architecture provided in an embodiment of the present application.

[0076] Figure 2 It is a schematic diagram of OOK-based backscatter transmission provided by the present application.

[0077] Figure 3 It is a schematic diagram of backscatter communication provided by the present application.

[0078] Figure 4 This is a schematic diagram of an A-IoT device communication application scenario provided by this application.

[0079] Figure 5 It is a schematic diagram of information transmitted between a reader and a tag provided in the present application.

[0080] Figure 6 It is a schematic diagram of a NAS security mode command flow provided by this application.

[0081] Figure 7 This is a schematic diagram of an AS security mode command flow provided by this application.

[0082] Figure 8 It is a schematic flowchart of a security capability negotiation method provided according to an embodiment of the present application.

[0083] Fig. 9 It is a schematic flowchart of another security capability negotiation method provided according to an embodiment of the present application.

[0084] Fig.10 This is a schematic flowchart of an A-IoT device performing security capability reporting and configuration negotiation with a RAN node through an air interface according to an embodiment of the present application.

[0085] Fig.11 This is a schematic flowchart of an A-IoT device that can report security capabilities and perform configuration negotiation with a CN node through a RAN node according to an embodiment of the present application.

[0086] Fig.12 This is a schematic flowchart provided according to an embodiment of the present application, in which an A-IoT device does not need to report security capabilities through an air interface, and the A-IoT device only negotiates security capability configuration with a RAN node.

[0087] Fig.13 This is a schematic flowchart of an A-IoT device provided according to an embodiment of the present application, in which an A-IoT device does not need to report security capabilities through an air interface, and the A-IoT device only negotiates security capability configuration with a CN node through a RAN node.

[0088] Fig.14 It is a schematic block diagram of a security capability negotiation device provided according to an embodiment of the present application.

[0089] Fig.15 It is a schematic block diagram of another security capability negotiation device provided according to an embodiment of the present application.

[0090] Fig.16 It is a schematic block diagram of a security capability negotiation system provided according to an embodiment of the present application.

[0091] Fig.17 It is a schematic block diagram of a communication device provided according to an embodiment of the present application.

[0092] Fig.18 It is a schematic diagram of the hardware structure of a terminal provided according to an embodiment of the present application.

[0093] Fig.19 It is a schematic block diagram of a network side device provided according to an embodiment of the present application.

[0094] Fig. 20 It is a schematic block diagram of another network side device provided according to an embodiment of the present application. DETAILED DESCRIPTION

[0095] The following will be combined with the drawings in the embodiments of the present application to clearly describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field belong to the scope of protection of this application.

[0096] The terms "first", "second", etc. of the present application are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the terms used in this way are interchangeable where appropriate, so that the embodiments of the present application can be implemented in an order other than those illustrated or described herein, and the objects distinguished by "first" and "second" are generally of one type, and the number of objects is not limited, for example, the first object can be one or more. In addition, "or" in the present application represents at least one of the connected objects. For example, "A or B" covers three schemes, namely, Scheme 1: including A but not including B; Scheme 2: including B but not including A; Scheme 3: including both A and B. The character " / " generally indicates that the objects associated with each other are in an "or" relationship.

[0097] The term "indication" in this application can be a direct indication (or explicit indication) or an indirect indication (or implicit indication). A direct indication can be understood as the sender explicitly informing the receiver of specific information, operations to be performed, or request results in the sent indication; an indirect indication can be understood as the receiver determining the corresponding information according to the indication sent by the sender, or making a judgment and determining the operation to be performed or the request result according to the judgment result.

[0098] It is worth noting that the technology described in the embodiments of the present application is not limited to the Internet of Things (IoT) system, but can also be used in other wireless communication systems, such as Long Term Evolution (LTE) / LTE-Advanced (LTE-A) system, Code Division Multiple Access (CDMA), Time Division Multiple Access (TDMA), Frequency Division Multiple Access (FDMA), Orthogonal Frequency Division Multiple Access (OFDMA), Single-carrier Frequency-Division Multiple Access (SC-FDMA), Wireless Local Area Networks (WLAN), Wireless Fidelity (WiFi), Bluetooth system, or other systems. The terms "system" and "network" in the embodiments of the present application are often used interchangeably, and the described technology can be used for the above-mentioned systems and radio technologies as well as other systems and radio technologies. The following description describes a New Radio (NR) system for example purposes, and NR terminology is used in most of the following description, but these techniques may also be applied to systems other than NR systems, such as 6th generation (6 th Generation, 6G) communication system.

[0099] The embodiments of the present application describe various embodiments in conjunction with an ambient Internet of Things (A-IoT) device, a first network element, a second network element or an application server (App server); wherein the A-IoT device may also be referred to as a passive Internet of Things (Passive-IoT) device, an ambient power (AMP) device, a zero-power device, a low-power IoT device, a response device, a tag, etc.; the first network element may be a read-write device or a reader / writer, a RAN node (such as a base station), an access point (AP), a terminal, a station (STA), a transmission reception point (TRP), a relay device or a repeater, etc.; the second network element may be a CN node; the application server may be a server provided by a third party, and of course, it may also be other devices, which are not limited in the embodiments of the present application.

[0100] Exemplarily, the terminal may be a mobile phone, a tablet computer (Tablet Personal Computer), a laptop computer (Laptop Computer), a notebook computer, a personal digital assistant (PDA), a handheld computer, a netbook, an ultra-mobile personal computer (UMPC), a mobile Internet device (Mobile Internet Device, MID), an augmented reality (Augmented Reality, AR), a virtual reality (Virtual Reality, VR) device, a robot, a wearable device (Wearable Device), a flight vehicle (flight vehicle), a vehicle user equipment (VUE), a shipborne equipment, a pedestrian terminal (Pedestrian User Equipment, PUE), a smart home (home appliances with wireless communication functions, such as refrigerators, televisions, washing machines or furniture, etc.), a game console, a personal computer (Personal Computer, PC), a teller machine or a self-service machine and other terminal-side devices. Wearable devices include: smart watches, smart bracelets, smart headphones, smart glasses, smart jewelry (smart bracelets, smart bracelets, smart rings, smart necklaces, smart anklets, smart anklets, etc.), smart wristbands, smart clothing, etc. Among them, the vehicle-mounted device can also be called a vehicle-mounted terminal, a vehicle-mounted controller, a vehicle-mounted module, a vehicle-mounted component, a vehicle-mounted chip or a vehicle-mounted unit, etc. It should be noted that the specific type of the terminal 11 is not limited in the embodiment of the present application.

[0101] Exemplarily, the RAN node may include an access network device, wherein the access network device may also be referred to as a radio access network (RAN) device, a radio access network function, or a radio access network unit. The access network device may include a base station, a wireless local area network (WLAN) access point (AS), or a wireless fidelity (WiFi) node, etc. Among them, the base station can be called Node B (NB), Evolved Node B (eNB), the next generation Node B (gNB), New Radio Node B (NR Node B), access point, Relay Base Station (RBS), Serving Base Station (SBS), Base Transceiver Station (BTS), radio base station, radio transceiver, Basic Service Set (BSS), Extended Service Set (ESS), home Node B (HNB), home evolved Node B (home evolved Node B), Transmission Reception Point (TRP), IAB node, repeater (such as a network controlled repeater), Pole station (Pole 2 The base station or some other suitable term in the field, as long as the same technical effect is achieved, the base station is not limited to specific technical vocabulary. It should be noted that in the embodiments of the present application, only the base station in the NR system is introduced as an example, and the specific type of the base station is not limited.

[0102] Figure 1 A block diagram of a wireless communication system applicable to the embodiment of the present application is shown, and the wireless communication system includes an A-IoT device 11 and a first network element 12; wherein the A-IoT device 11 may also be called a passive Internet of Things (Passive-IoT) device, an AMP device, a zero-power device, a response device, a low-power IoT device, a tag, etc.; the first network element 12 may be a read-write device or a reader / writer, a RAN node (such as a base station), an access point (AP), a terminal device, a station (STA), a TRP, a relay device or a repeater, etc. It should be noted that, Figure 1A first network element and two A-IoT devices are exemplarily shown. Optionally, the wireless communication system may include at least two first network elements and the coverage range of each communication device may include other numbers of A-IoT devices, which is not limited in the embodiments of the present application.

[0103] In order to facilitate a better understanding of the embodiments of the present application, the technologies related to the present application are explained.

[0104] A-IoT devices are IoT devices with low overall power consumption, including low-power signal reception and low-power signal transmission. Due to the low overall power consumption, the energy for communication can come from the environment, such as wind energy, light energy, kinetic energy, thermal energy, radio frequency (RF) signals, etc.

[0105] In some embodiments, the A-IoT device may be the following types of devices:

[0106] Device A: A backscatter communication device in traditional radio frequency identification (RFID), usually a tag, which is a passive IoT device.

[0107] Device B: A semi-passive tag. This type of tag has a certain amplification capability for downlink reception or uplink reflection.

[0108] Device C: An active tag that can actively send information to a reader without relying on the reflection of the incident signal. Active tags generally have the ability to actively generate signals, but in order to achieve low power consumption, the power consumption is generally lower than 0dBm, for example, less than or equal to -10dBm.

[0109] For example, a backscatter transmission method based on binary on-off keying (OOK) can be as follows: Figure 2 As shown, a simple implementation method is that when the tag needs to send '1', the tag reflects the incident carrier signal, and when the tag needs to send '0', it does not reflect.

[0110] For example, backscattering communication can be as follows: Figure 3 As shown, the A-IoT device receives the wireless signal sent by the reading and writing device, modulates the wireless signal, loads the information to be sent and radiates the modulated signal from the antenna. This information transmission process is called backscatter communication.

[0111] Backscatter communication devices (such as A-IoT) control the reflection coefficient Γ of the circuit by adjusting its internal impedance, thereby changing the amplitude, frequency, phase, etc. of the incident signal to achieve signal modulation. The reflection coefficient of the signal can be characterized as:

[0112]

[0113] Where Z0 is the antenna characteristic impedance and Z1 is the load impedance. Assume that the incident signal is S in (t), the output signal is Therefore, corresponding amplitude modulation, frequency modulation or phase modulation can be achieved by properly controlling the reflection coefficient.

[0114] Backscatter communication devices (such as A-IoT devices) usually receive signals with low power consumption, and generally use low-power RF, IF, or baseband envelope detection to receive signals. The waveform of the transmitted signal usually uses simple modulation methods, such as On-Off Keying (OOK), Amplitude Shift Keying (ASK), Frequency Shift Keying (FSK) and other simple modulation methods.

[0115] The device that communicates with such low-power devices (such as A-IoT devices) is called a read-write device or a first network element. For example, it can be a terminal or a relay device or a repeater, or a base station or TRP, or a device with read-write functions, such as a reader / writer, which is not limited here.

[0116] For example, the communication scenarios in which the A-IoT device can be applied can be as follows: Figure 4 Specifically, Figure 4 As shown in a in FIG, the base station sends a continuous wave (CW) and signaling and receives the reflected signal of the tag; Figure 4 As shown in b in Figure 1, the terminal sends CW and signaling and receives the reflected signal of the tag; Figure 4 As shown in c in FIG, the base station sends CW and signaling to the tag, and the terminal receives the backscatter information sent by the tag; Figure 4 As shown in d in FIG. 1 , the terminal sends CW and signaling to the tag, and the base station receives the backscatter information of the tag.

[0117] In order to facilitate a better understanding of the embodiments of the present application, the information transmission between a reader and a tag in an RFID related to the present application is described.

[0118] like Figure 5 As shown, the command (Command) of the reader (Reader) operation can be shown in the following Table 1, and the state of the tag (Tag) can be shown in the following Table 2.

[0119] Table 1

[0120]

[0121] Table 2

[0122]

[0123]

[0124] To facilitate a better understanding of the embodiments of the present application, the security authentication protocol between the Reader and the Tag in the RFID protocol related to the present application is described.

[0125] RFID is a traditional backscatter communication system, and its main design goal is to identify and read data from tags within the coverage of the reader. Optionally, the information transmission between the reader and the tag works in a safe mode. For the tag working in the safe mode, the authentication process must be performed first. Specifically, it usually includes the identity authentication process of the reader and / or the tag, so that the information transmission process between the reader and the tag is carried out on the premise that its identity is legal. On the one hand, referring to the RFID international standard G2 protocol, the current protocol only standardizes the security authentication command. The security communication process is not standardized. At present, it seems that the security communication function and process of the international standard G2 protocol are mainly left to the product implementation solution. On the other hand, referring to the RFID national standard GB 29768 protocol, further standardization supports the one-way / two-way authentication protocol process based on XOR operation and the one-way / two-way authentication protocol process based on symmetric encryption. The common premise of these security authentication protocol processes is that the reader first completes the security parameter acquisition process of the tag. After the security parameter acquisition process is completed, the tag follows the reader command to execute the security communication process.

[0126] To facilitate a better understanding of the embodiments of the present application, the security mechanism in the NR communication system is described.

[0127] The security parameters (encryption algorithm, integrity protection algorithm) used by the terminal to transmit the Non-Access Stratum (NAS) message are determined by the Access and Mobility Management Function (AMF). The specific process can be as follows Figure 6 As shown, it may include the following steps:

[0128] 1a.AMF starts integrity protection;

[0129] 1b.AMF sends a NAS security mode command to the terminal (ngKSI, terminal security capability, encryption algorithm, integrity protection algorithm, [K_AMF_change_flag, ABBA parameters, request initial NAS message flag], NAS media access control (Media Access Control, MAC));

[0130] 1c.AMF starts uplink decryption;

[0131] 2a. The terminal verifies the integrity of the NAS security mode control (SMC). If successful, it starts uplink encryption, downlink decryption and integrity protection.

[0132] 2b. The terminal sends NAS security mode completion to AMF ([Complete initial NAS message in NAS container], NASMAC);

[0133] 1d.AMF starts downlink encryption.

[0134] The security parameters (encryption algorithm, integrity protection algorithm) used by the terminal to transmit Radio Resource Control (RRC) messages and service data are determined by the Radio Access Network (RAN). The specific process can be as follows Figure 7 As shown, it may include the following steps:

[0135] 1a.gNB starts RRC integrity protection;

[0136] 1b. The gNB sends an access stratum (AS) security mode command (encryption algorithm, integrity protection algorithm, MAC-I) to the terminal;

[0137] 1c.gNB starts RRC downlink encryption;

[0138] 2a. The terminal verifies the integrity of the AS SMC. If successful, it starts RRC integrity protection and RRC downlink decryption.

[0139] 2b. The terminal sends AS security mode complete (MAC-I) to the gNB;

[0140] 2c. The terminal starts RRC uplink encryption;

[0141] 1d.gNB starts RRC uplink decryption.

[0142] The security mechanism in the NR communication system supports multiple encryption algorithms, including 5G-EA0, 128-5G-EA1, 128-5G-EA2, 128-5G-EA3, 5G-EA4, 5G-EA5, 5G-EA6, and 5G-EA7.

[0143] The security mechanism in the NR communication system supports multiple integrity algorithms, including 5G-IA0, 128-5G-IA1, 128-5G-IA2, 128-5G-IA3, 5G-IA4, 5G-IA5, 5G-IA6, and 5G-IA7.

[0144] In order to facilitate a better understanding of the embodiments of the present application, the problems solved by the present application are explained.

[0145] Traditional RFID secure communication supports encryption functions for commands and tag replies, but does not support integrity protection. When migrating RFID to the 3GPP communication system, how to design a secure communication mechanism for A-IoT devices is an unresolved issue. Considering that the 3GPP NR communication system has a more robust and complex security design than RFID, and its encryption and integrity protection functions are implemented by the Packet Data Convergence Protocol (PDCP) protocol layer. However, the encryption function of the 3GPP terminal is based on the principle of cryptography, which is power-consuming and complex. The integrity protection function of the terminal will also increase additional data packet overhead (such as 32 bits in the PDCP protocol data unit (PDU)). A-IoT devices need to meet the requirements of a minimalist design with low power consumption and low complexity, so it is not suitable to directly copy the NR secure communication mechanism.

[0146] Based on the above problems, this application proposes a security capability negotiation solution, which can compromise the pros and cons of the security mechanism of RFID and the security mechanism of NR, support A-IoT devices and the first network element or the second network element to negotiate according to the different security capabilities of the A-IoT devices, and enable secure communication on demand.

[0147] To facilitate understanding of the technical solutions of the embodiments of the present application, the technical solutions of the present application are described in detail below through specific embodiments. The above related technologies can be combined arbitrarily with the technical solutions of the embodiments of the present application as optional solutions, and they all belong to the protection scope of the embodiments of the present application. The embodiments of the present application include at least part of the following contents.

[0148] Figure 8 is a schematic flow chart of a security capability negotiation method 200 according to an embodiment of the present application, such as Figure 8 As shown, the security capability negotiation method 200 may include at least part of the following contents:

[0149] S210, the first network element sends first information to the A-IoT device, wherein the first information is used to configure or activate a first security parameter set; wherein the first security parameter set satisfies any one of the following: determined based on a security capability parameter of the A-IoT device, determined based on a security capability parameter of the A-IoT device and a security capability parameter of the first network element, determined based on a security capability parameter of the A-IoT device, a security capability parameter of the first network element, and a security capability parameter of the second network element; wherein the second network element communicates with the A-IoT device through the first network element;

[0150] S220, the A-IoT device receives the first information from the first network element;

[0151] S230, in response to the first information, the A-IoT device sends a first response message to the first network element.

[0152] It should be understood that Figure 8 The steps or operations of the security capability negotiation method 200 are shown, but these steps or operations are only examples. The embodiment of the present application may also perform other operations or Figure 8 Variations of the various operations in .

[0153] It should be noted that A-IoT devices have a simple structure, low complexity, and low cost. They can support energy collection from environmental energy (such as light energy, heat energy, radio frequency energy, mechanical energy, kinetic energy, etc.) to obtain the energy required for communication. They can support backscattering communication methods. For some A-IoT devices, they can also support active transmission communication methods. A-IoT devices refer to IoT devices that use various environmental energies, such as wireless radio frequency energy, light energy, solar energy, thermal energy, mechanical energy, and other environmental energies. A-IoT devices can have no energy storage capacity or have very limited energy storage capacity (such as using capacitors with a capacity of tens of microfarads (uF)).

[0154] In some embodiments, the A-IoT device may also be referred to as a passive IoT device, an ambient power (AMP) device, a zero-power device, a low-power IoT device, a response device, a tag, etc. The first network element may assume the reader function (i.e., the data reading or forwarding function of the A-IoT device), for example, the first network element is a read-write device or a reader / writer, a radio access network (RAN) node (such as a gNB), an access point (AP), a terminal, a station (STA), a TRP, a relay node or a repeater, an intermediate node, an auxiliary node, etc. The second network element may be a core network (CN) node, or, of course, other network elements (such as a third-party network element or server), which is not limited in the embodiments of the present application.

[0155] In some embodiments, the first response information may indicate that the A-IoT device accepts the first information or that the first information is configured or activated successfully, or the first response information may indicate that the A-IoT device rejects the first information or that the first information is configured or activated unsuccessfully.

[0156] In some embodiments, the first information may include specific information of the first security parameter set, or may only include an index of the first security parameter set. For example, when the security capability parameters of the A-IoT device include an index of at least one security parameter set supported by the A-IoT device, the first information may only include an index of the first security parameter set.

[0157] In some embodiments, the first information is generated by the first network element, and the first response information is decoded and processed by the first network element. That is, in addition to assuming the reader function (i.e., the data reading or forwarding function of the A-IoT device), the first network element is also the executor of the security capability negotiation and configuration function.

[0158] In some embodiments, the first information is obtained from the second network element through the first network element, and the first response information is forwarded to the second network element through the first network element and decoded and processed by the second network element. In this case, the second network element can send the first information to the A-IoT device through the first network element, and the second network element can receive the first response information from the A-IoT device through the first network element. That is, the first network element only assumes the reader function (i.e., the data reading or forwarding function of the A-IoT device), and the second network element is the executor of the security capability negotiation and configuration function.

[0159] In some embodiments, the first security parameter set is determined based on the security capability parameters of the A-IoT device, that is, the first network element or the second network element can determine the first security parameter set based on the security capability parameters of the A-IoT device.

[0160] In some embodiments, the first security parameter set is determined based on the security capability parameters of the A-IoT device and the security capability parameters of the first network element. For example, the first network element may determine the first security parameter set based on the intersection of the security capability parameters of the A-IoT device and the security capability parameters of the first network element.

[0161] In some embodiments, the first security parameter set is determined based on the security capability parameters of the A-IoT device, the security capability parameters of the first network element, and the security capability parameters of the second network element. For example, the second network element may determine the first security parameter set based on the intersection of the security capability parameters of the A-IoT device, the security capability parameters of the first network element, and the security capability parameters of the second network element.

[0162] In an embodiment of the present application, the first network element or the second network element can at least determine the configuration or activation of the first security parameter set based on the security capability parameters of the A-IoT device, and negotiate with the A-IoT device to determine whether to activate the first security parameter set, so that the secure communication function can be enabled as needed, and some security parameters (i.e., the specific parameters included in the first security parameter set) can be enabled or activated as needed, thereby meeting the low power consumption requirements of the A-IoT device.

[0163] In some embodiments, the security capability parameters of the A-IoT device include but are not limited to at least one of the following:

[0164] The device identifier or group identifier of the A-IoT device;

[0165] The first indication is used to indicate whether the A-IoT device supports or does not support the authentication function;

[0166] Authentication algorithms supported by the A-IoT device;

[0167] The second indication is used to indicate whether the A-IoT device supports or does not support the encryption function;

[0168] The encryption algorithms supported by the A-IoT device;

[0169] The third indication is used to indicate whether the A-IoT device supports or does not support the integrity protection function;

[0170] The integrity protection algorithms supported by the A-IoT device;

[0171] The key length supported by the A-IoT device;

[0172] A fourth indication, used to indicate whether the A-IoT device supports or does not support a security context storage function;

[0173] An index of at least one security parameter set supported by the A-IoT device;

[0174] The at least one security parameter set includes the first security parameter set.

[0175] Exemplarily, the authentication algorithm supported by the A-IoT device is different from AKA supported by NR Uu, etc. It is a new type of authentication algorithm dedicated to low-power communication of A-IoT devices, which has lower complexity and lower computational power consumption. For example, the authentication algorithm supported by the A-IoT device is the Tuak authentication algorithm, and of course it can be other authentication algorithms, which is not limited in this embodiment.

[0176] Exemplarily, the encryption algorithm supported by the A-IoT device is different from 5G-EA0, 128-5G-EA1, 128-5G-EA2, 128-5G-EA3, 5G-EA4, 5G-EA5, 5G-EA6, 5G-EA7, etc. supported by NR Uu. It is a new type of encryption algorithm dedicated to low-power communication of A-IoT devices, which has lower complexity and lower computational power consumption. For example, the encryption algorithm supported by the A-IoT device is a 128-bit group symmetric encryption algorithm (AES128), and of course it can be other encryption algorithms, which are not limited in this embodiment.

[0177] Exemplarily, the integrity protection algorithm supported by the A-IoT device is different from 5G-IA0, 128-5G-IA1, 128-5G-IA2, 128-5G-IA3, 5G-IA4, 5G-IA5, 5G-IA6, 5G-IA7, etc. supported by NR Uu. It is a new type of integrity protection algorithm dedicated to low-power communication of A-IoT devices, which has lower complexity and lower computational power consumption. For example, the integrity protection algorithm supported by the A-IoT device is Digital Signatures, and of course it can also be other integrity protection algorithms, which are not limited in this embodiment.

[0178] Exemplarily, the key length supported by the A-IoT device is a new type of key length dedicated to low-power communication of A-IoT devices, which has lower complexity and lower computational power consumption. A value shorter than the key length of 128 or 256 supported by NR Uu is required, such as the key length supported by the A-IoT device is 64, and of course other key lengths may be used, which is not limited in this embodiment.

[0179] In some embodiments, when the security capability parameter of the A-IoT device includes an index of at least one security parameter set supported by the A-IoT device, the first security parameter set is determined based on the index of the at least one security parameter set. This embodiment can improve the efficiency of security capability negotiation.

[0180] Exemplarily, a security parameter set may be directly selected from at least one security parameter set (e.g., selected in index order, in power consumption order, or in security level order, etc.). Exemplarily, a security parameter set may be selected from at least one security parameter set based on a security capability parameter of the first network element or a security capability parameter of the second network element.

[0181] In some embodiments, each security parameter set of the at least one security parameter set is determined based on a combination of at least one of the following:

[0182] the first instruction;

[0183] Authentication algorithms supported by the A-IoT device;

[0184] the second instruction;

[0185] The encryption algorithms supported by the A-IoT device;

[0186] the third instruction;

[0187] The integrity protection algorithms supported by the A-IoT device;

[0188] The key length supported by the A-IoT device;

[0189] The fourth instruction.

[0190] In some embodiments, each security parameter set in the at least one security parameter set is determined based on a combination and specific value of at least one of the following:

[0191] the first instruction;

[0192] Authentication algorithms supported by the A-IoT device;

[0193] the second instruction;

[0194] The encryption algorithms supported by the A-IoT device;

[0195] the third instruction;

[0196] The integrity protection algorithms supported by the A-IoT device;

[0197] The key length supported by the A-IoT device;

[0198] The fourth instruction.

[0199] For example, the security parameter set represented by security parameter set index 1 includes: the device identification of the A-IoT device, an indication that the A-IoT device supports the authentication function (i.e., the first indication indicates that the A-IoT device supports the authentication function), and the authentication algorithm supported by the A-IoT device.

[0200] For another example, the security parameter set represented by security parameter set index 2 includes: the device identification of the A-IoT device, an indication that the A-IoT device supports the authentication function (i.e., the first indication indicates that the A-IoT device supports the authentication function), and an indication that the A-IoT device does not support the encryption function (i.e., the second indication indicates that the A-IoT device does not support the encryption function).

[0201] For another example, the security parameter set represented by security parameter set index 3 includes: the device identification of the A-IoT device, an indication that the A-IoT device does not support the authentication function, and an indication that the A-IoT device does not support the encryption function (i.e., the second indication indicates that the A-IoT device does not support the encryption function).

[0202] For another example, the security parameter set represented by security parameter set index 4 includes: the device identification of the A-IoT device, an indication that the A-IoT device supports the authentication function (i.e., the first indication indicates that the A-IoT device supports the authentication function), the authentication algorithms supported by the A-IoT device, an indication that the A-IoT device supports the encryption function (i.e., the second indication indicates that the A-IoT device supports the encryption function), and the encryption algorithms supported by the A-IoT device.

[0203] For another example, the security parameter set represented by security parameter set index 5 includes: the device identification of the A-IoT device, an indication that the A-IoT device supports the authentication function (i.e., the first indication indicates that the A-IoT device supports the authentication function), the authentication algorithms supported by the A-IoT device, an indication that the A-IoT device supports the encryption function (i.e., the second indication indicates that the A-IoT device supports the encryption function), the encryption algorithms supported by the A-IoT device, an indication that the A-IoT device supports the integrity protection function (i.e., the third indication indicates that the A-IoT device supports the integrity protection function), and the integrity protection algorithms supported by the A-IoT device.

[0204] For another example, the security parameter set represented by security parameter set index 6 includes: the device identification of the A-IoT device, an indication that the A-IoT device supports the authentication function (i.e., the first indication indicates that the A-IoT device supports the authentication function), the authentication algorithm supported by the A-IoT device, an indication that the A-IoT device supports the encryption function (i.e., the second indication indicates that the A-IoT device supports the encryption function), the encryption algorithm supported by the A-IoT device, an indication that the A-IoT device supports the integrity protection function (i.e., the third indication indicates that the A-IoT device supports the integrity protection function), the integrity protection algorithm supported by the A-IoT device, and the key length supported by the A-IoT device.

[0205] For another example, the security parameter set represented by security parameter set index 7 includes: the device identification of the A-IoT device, an indication that the A-IoT device supports the authentication function (i.e., the first indication indicates that the A-IoT device supports the authentication function), the authentication algorithm supported by the A-IoT device, an indication that the A-IoT device supports the encryption function (i.e., the second indication indicates that the A-IoT device supports the encryption function), the encryption algorithm supported by the A-IoT device, an indication that the A-IoT device supports the integrity protection function (i.e., the third indication indicates that the A-IoT device supports the integrity protection function), the integrity protection algorithm supported by the A-IoT device, the key length supported by the A-IoT device, and an indication that the A-IoT device supports the security context storage function (i.e., the fourth indication indicates that the A-IoT device supports the security context storage function).

[0206] In some embodiments, the security capability parameters of the A-IoT device come from the second network element. For example, when the first information is generated by the first network element and the first response information is decoded and processed by the first network element, the first network element obtains the security capability parameters of the A-IoT device from the application server through the second network element.

[0207] In some embodiments, the security capability parameters of the A-IoT device come from the application server. For example, when the first information is obtained from the second network element via the first network element, and the first response information is forwarded to the second network element via the first network element and decoded and processed by the second network element, the second network element obtains the security capability parameters of the A-IoT device from the application server.

[0208] In some embodiments, the application server may be a server provided by a third party, which may communicate with a core network element (such as the second network element) through an interface.

[0209] In some embodiments, before the A-IoT device receives the first information from the first network element, the A-IoT device receives security capability query information from the first network element; and the A-IoT device sends security capability information to the first network element, wherein the security capability information includes the security capability parameters of the A-IoT device. That is, in this embodiment, the security capability parameters of the A-IoT device can be obtained by querying.

[0210] In some embodiments, the security capability query information is generated by the first network element, and the security capability information is decoded and processed by the first network element. For example, when the first information is generated by the first network element and the first response information is decoded and processed by the first network element, the security capability query information is generated by the first network element, and the security capability information is decoded and processed by the first network element.

[0211] In some embodiments, the security capability query information is obtained from the second network element through the first network element, and the security capability information is forwarded to the second network element through the first network element and decoded and processed by the second network element. For example, in the case where the first information is obtained from the second network element through the first network element, and the first response information is forwarded to the second network element through the first network element and decoded and processed by the second network element, the security capability query information is obtained from the second network element through the first network element, and the security capability information is forwarded to the second network element through the first network element and decoded and processed by the second network element. That is, the second network element can send the security capability query information to the A-IoT device through the first network element, and the second network element can receive the security capability information from the A-IoT device through the first network element.

[0212] In some embodiments, the security capability query information includes, but is not limited to, at least one of the following: authentication query information, encryption query information, integrity protection query information, key capability query information, and security context storage capability query information;

[0213] Among them, the authentication query information is used to query whether the A-IoT device supports the authentication function, or the authentication query information is used to query the authentication algorithm supported by the A-IoT device, the encryption query information is used to query whether the A-IoT device supports the encryption function, or the encryption query information is used to query the encryption algorithm supported by the A-IoT device, the integrity protection query information is used to query whether the A-IoT device supports the integrity protection function, or the integrity protection query information is used to query the integrity protection algorithm supported by the A-IoT device, the key capability query information is used to query the key length supported by the A-IoT device, and the security context storage capability query information is used to query whether the A-IoT device supports the security context storage function.

[0214] In some embodiments, the security capability query information is carried by an inventory command, or the security capability query information is carried by a security capability query message. Of course, the security capability query information can also be carried by other signaling.

[0215] In some embodiments, part or all of the information received by the A-IoT device from the first network element is accompanied by an excitation signal for powering the A-IoT device. Thus, while collecting ambient energy, the A-IoT device can obtain additional energy through the excitation signal to meet the working requirements of the A-IoT device.

[0216] In some embodiments, when the first response information is used to indicate that the A-IoT device rejects the first information or the first information configuration or activation fails, the first network element shuts down or deconfigures or deactivates the security communication function between it and the A-IoT device, or the second network element shuts down or deconfigures or deactivates the security communication function between it and the first network element, and the first network element shuts down or deconfigures or deactivates the security communication function between it and the A-IoT device.

[0217] In some embodiments, when the first response information is used to indicate that the A-IoT device rejects the first information or the first information configuration or activation fails, the A-IoT device determines to turn off or deconfigure or deactivate the security communication function with the first network element.

[0218] Exemplarily, when the first response information is used to indicate that the A-IoT device rejects the first information or the first information configuration or activation fails, the A-IoT device may disable the secure communication function by default (i.e., subsequent transmissions between the A-IoT device and the first network element do not disable encryption and / or integrity protection functions). This rule may be agreed upon by the protocol or pre-configured (such as agreed upon by the protocol or pre-configured: when the first response information is used to indicate that the A-IoT device rejects the first information or the first information configuration or activation fails, the secure communication function is disabled by default), without the need for further signaling interaction.

[0219] Exemplarily, when the first response information is used to indicate that the A-IoT device rejects the first information or the configuration or activation of the first information fails, the A-IoT device can determine to deconfigure or deactivate the security communication function between the A-IoT device and the first network element through signaling obtained from the first network element (such as radio resource control (Radio Resource Control, RRC) signaling or media access control layer control element (Media Access ControlControl Element, MAC CE) signaling).

[0220] In some embodiments, when the first response information indicates that the A-IoT device rejects the first information or the first information configuration or activation fails, the A-IoT device receives second information from the first network element, wherein the second information is used to: configure or activate the second security parameter set, or, deconfigure or deactivate the first security parameter set; in response to the second information, the A-IoT device sends a second response information to the first network element. That is, in this embodiment, when the first response information indicates that the A-IoT device rejects the first information or the first information configuration or activation fails, the first network element or the second network element can re-trigger the security capability negotiation process of the A-IoT device.

[0221] The second security parameter set satisfies any of the following:

[0222] Determined based on the security capability parameters of the A-IoT device;

[0223] Determined based on the security capability parameter of the A-IoT device and the security capability parameter of the first network element;

[0224] Determined based on the security capability parameters of the A-IoT device, the security capability parameters of the first network element, and the security capability parameters of the second network element.

[0225] Specifically, the method for determining the second security parameter set is the same as that for determining the first security parameter set, which will not be described in detail here.

[0226] In some embodiments, the second information is generated by the first network element, and the second response information is decoded and processed by the first network element. For example, when the first information is generated by the first network element, and the first response information is decoded and processed by the first network element, the second information is generated by the first network element, and the second response information is decoded and processed by the first network element.

[0227] In some embodiments, the second information is obtained from the second network element through the first network element, and the second response information is forwarded to the second network element through the first network element and decoded and processed by the second network element. For example, in the case where the first information is obtained from the second network element through the first network element, and the first response information is forwarded to the second network element through the first network element and decoded and processed by the second network element, the second information is obtained from the second network element through the first network element, and the second response information is forwarded to the second network element through the first network element and decoded and processed by the second network element. That is, the second network element can send the second information to the A-IoT device through the first network element, and the second network element can receive the second response information from the A-IoT device through the first network element.

[0228] Therefore, in an embodiment of the present application, the first network element or the second network element can at least determine the configuration or activation of the first security parameter set based on the security capability parameters of the A-IoT device, and negotiate with the A-IoT device to determine whether to activate the first security parameter set, so that the secure communication function can be enabled as needed, and some security parameters (i.e., the specific parameters included in the first security parameter set) can be enabled or activated as needed, thereby meeting the low power consumption requirements of the A-IoT device.

[0229] Combination of the above Figure 8 , describes in detail the method embodiment of the present application, and the following is combined with Fig. 9 , the embodiments of the present application are described in detail from a system perspective. It should be understood that similar descriptions can refer to the above embodiments and will not be repeated here.

[0230] Fig. 9 is a schematic flow chart of a security capability negotiation method 300 according to an embodiment of the present application, the security capability negotiation method 300 is applied to a security capability negotiation system, the security capability negotiation system includes an A-IoT device, a first network element, a second network element and an application server, wherein the second network element communicates with the A-IoT device through the first network element, such as Fig. 9 As shown, the security capability negotiation method 300 may include at least part of the following contents:

[0231] S310, the first network element sends first information to the A-IoT device, and the first network element receives first response information from the A-IoT device; or, the second network element sends first information to the A-IoT device through the first network element, and the second network element receives first response information from the A-IoT device through the first network element; wherein the first information is used to configure or activate a first security parameter set, and the first response information is a response to the first information; wherein the first security parameter set satisfies any one of the following: determined based on the security capability parameters of the A-IoT device; determined based on the security capability parameters of the A-IoT device and the security capability parameters of the first network element;

[0232] Determined based on the security capability parameters of the A-IoT device, the security capability parameters of the first network element, and the security capability parameters of the second network element.

[0233] It should be understood that Fig. 9 The steps or operations of the security capability negotiation method 300 are shown, but these steps or operations are only examples. The embodiment of the present application may also perform other operations or Fig. 9 Variations of the various operations in .

[0234] In some embodiments, the security capability parameters of the A-IoT device include but are not limited to at least one of the following:

[0235] The device identifier or group identifier of the A-IoT device;

[0236] The first indication is used to indicate whether the A-IoT device supports or does not support the authentication function;

[0237] Authentication algorithms supported by the A-IoT device;

[0238] The second indication is used to indicate whether the A-IoT device supports or does not support the encryption function;

[0239] The encryption algorithms supported by the A-IoT device;

[0240] The third indication is used to indicate whether the A-IoT device supports or does not support the integrity protection function;

[0241] The integrity protection algorithms supported by the A-IoT device;

[0242] The key length supported by the A-IoT device;

[0243] A fourth indication, used to indicate whether the A-IoT device supports or does not support a security context storage function;

[0244] An index of at least one security parameter set supported by the A-IoT device;

[0245] The at least one security parameter set includes the first security parameter set.

[0246] In some embodiments, when the security capability parameter of the A-IoT device includes an index of at least one security parameter set supported by the A-IoT device, the first security parameter set is determined based on the index of the at least one security parameter set.

[0247] In some embodiments, each security parameter set of the at least one security parameter set is determined based on a combination of at least one of the following:

[0248] the first instruction;

[0249] Authentication algorithms supported by the A-IoT device;

[0250] the second instruction;

[0251] The encryption algorithms supported by the A-IoT device;

[0252] the third instruction;

[0253] The integrity protection algorithms supported by the A-IoT device;

[0254] The key length supported by the A-IoT device;

[0255] The fourth instruction.

[0256] In some embodiments, when the first network element sends the first information to the A-IoT device and the first network element receives the first response information from the A-IoT device, the first network element obtains the security capability parameters of the A-IoT device from the application server through the second network element.

[0257] In some embodiments, before the first network element sends the first information to the A-IoT device, the first network element sends security capability query information to the A-IoT device; and the first network element receives security capability information from the A-IoT device, wherein the security capability information includes security capability parameters of the A-IoT device.

[0258] In some embodiments, when the second network element sends the first information to the A-IoT device through the first network element, and the second network element receives the first response information from the A-IoT device through the first network element, the second network element obtains the security capability parameters of the A-IoT device from the application server.

[0259] In some embodiments, before the second network element sends the first information to the A-IoT device through the first network element, the second network element sends security capability query information to the A-IoT device through the first network element; and the second network element receives security capability information from the A-IoT device through the first network element, wherein the security capability information includes security capability parameters of the A-IoT device.

[0260] In some embodiments, the security capability query information includes at least one of the following: authentication query information, encryption query information, integrity protection query information, key capability query information, and security context storage capability query information;

[0261] Among them, the authentication query information is used to query whether the A-IoT device supports the authentication function, or the authentication query information is used to query the authentication algorithm supported by the A-IoT device, the encryption query information is used to query whether the A-IoT device supports the encryption function, or the encryption query information is used to query the encryption algorithm supported by the A-IoT device, the integrity protection query information is used to query whether the A-IoT device supports the integrity protection function, or the integrity protection query information is used to query the integrity protection algorithm supported by the A-IoT device, the key capability query information is used to query the key length supported by the A-IoT device, and the security context storage capability query information is used to query whether the A-IoT device supports the security context storage function.

[0262] In some embodiments, the security capability query information is carried by an inventory command, or the security capability query information is carried by a security capability query message.

[0263] In some embodiments, part or all of the information sent by the first network element to the A-IoT device is accompanied by an excitation signal for powering the A-IoT device.

[0264] In some embodiments, when the first response information is used to indicate that the A-IoT device rejects the first information or the first information configuration or activation fails, the first network element closes or deconfigures or deactivates the secure communication function with the A-IoT device; or, the second network element closes or deconfigures or deactivates the secure communication function with the first network element, and the first network element closes or deconfigures or deactivates the secure communication function with the A-IoT device.

[0265] In some embodiments, when the first response information indicates that the A-IoT device rejects the first information or the first information configuration or activation fails, the first network element sends the second information to the A-IoT device, and the first network element receives the second response information from the A-IoT device; or, the second network element sends the second information to the A-IoT device through the first network element, and the second network element receives the second response information from the A-IoT device through the first network element;

[0266] The second information is used to: configure or activate the second security parameter set, or to deconfigure or deactivate the first security parameter set;

[0267] The second response information is a response to the second information;

[0268] The second security parameter set satisfies any of the following:

[0269] Determined based on the security capability parameters of the A-IoT device;

[0270] Determined based on the security capability parameter of the A-IoT device and the security capability parameter of the first network element;

[0271] Determined based on the security capability parameters of the A-IoT device, the security capability parameters of the first network element, and the security capability parameters of the second network element.

[0272] Therefore, in an embodiment of the present application, the first network element or the second network element can at least determine the configuration or activation of the first security parameter set based on the security capability parameters of the A-IoT device, and negotiate with the A-IoT device to determine whether to activate the first security parameter set, so that the secure communication function can be enabled as needed, and some security parameters (i.e., the specific parameters included in the first security parameter set) can be enabled or activated as needed, thereby meeting the low power consumption requirements of the A-IoT device.

[0273] The technical solution of the present application is described below through Examples 1 to 4. Specifically, in Example 1, the A-IoT device reports security capabilities and negotiates configurations with the RAN node through the air interface, that is, the RAN node not only assumes the reader function (i.e., the data reading or forwarding function of the A-IoT device), but also is the executor of the security capability negotiation and configuration functions. In Example 2, the A-IoT device reports security capabilities and negotiates configurations with the CN node through the RAN node. Specifically, the RAN node only assumes the reader function (i.e., the data reading or forwarding function of the A-IoT device), and the CN node is the executor of the security capability negotiation and configuration functions. In Example 3, the A-IoT device does not need to report security capabilities through the air interface, and the A-IoT device only negotiates security capability configurations with the RAN node, that is, the RAN node not only assumes the reader function (i.e., the data reading or forwarding function of the A-IoT device), but also is the executor of the security capability negotiation and configuration functions. In Example 4, the A-IoT device does not need to report security capabilities through the air interface. The A-IoT device only negotiates security capability configuration with the CN node through the RAN node, that is, the RAN node only assumes the reader function (that is, the data reading or forwarding function of the A-IoT device), and the CN node is the executor of the security capability negotiation and configuration function. It should be noted that in Examples 1 to 4, the RAN node assumes the reader function. Of course, it can also be replaced by a terminal, relay node, AP or STA, etc. assuming the reader function, and this application is not limited to this.

[0274] Embodiment 1, as Fig.10 As shown, the A-IoT device reports security capabilities and negotiates configurations with the RAN node through the air interface. Specifically, the security capabilities reporting and configuration negotiation can be performed through part or all of the following S1-0 to S1-4.

[0275] S1-0. The A-IoT device obtains the security service customization information of the A-IoT device according to the application server configuration, factory configuration or pre-configuration. The specific content may include: a set of security capability parameters corresponding to one / group of A-IoT devices.

[0276] It should be noted that if the security service customization information is factory configured or pre-configured, there is no need for signaling interaction between the APP server and the A-IoT device. Therefore, a dotted line is drawn in the figure (that is, the dotted line in the figure represents an optional step). The explanations of other dotted lines are similar and will not be repeated.

[0277] S1-1. The RAN node triggers the security capability negotiation process of the A-IoT device. Specifically, the RAN node sends security capability query information to the A-IoT device.

[0278] Exemplarily, the security capability query information may be carried by a security capability query message.

[0279] Exemplarily, the security capability query information may be carried by an inventory command.

[0280] Optionally, the security capability query information is sent along with an excitation signal for powering the A-IoT device.

[0281] Optionally, the security capability query information includes at least one of the following:

[0282] Authentication query: used to query whether the A-IoT device supports the authentication function, or to query the authentication algorithm supported by the A-IoT device;

[0283] Encryption query: used to query whether the A-IoT device supports encryption function, or to query the encryption algorithm supported by the A-IoT device;

[0284] Integrity protection query: used to query whether the A-IoT device supports the integrity protection function, or to query the integrity protection algorithm supported by the A-IoT device;

[0285] Key capability query: used to query the key length supported by the A-IoT device;

[0286] Security context storage capability query: used to query whether the A-IoT device supports the security context storage function.

[0287] S1-2. The A-IoT device reports the security capability parameters available for negotiation to the RAN node. Specifically, the security capability parameters of the A-IoT device may include at least one of the following:

[0288] Device ID or group ID of A-IoT device;

[0289] An indication that the A-IoT device supports or does not support the authentication function;

[0290] Authentication algorithms supported by the A-IoT device; in particular, the authentication algorithms supported by the A-IoT device are different from AKA supported by NR Uu, etc., and are a new type of authentication algorithms dedicated to A-IoT device communication, which has lower complexity and lower computational power consumption (for example, the authentication algorithm supported by the A-IoT device is the Tuak authentication algorithm, and of course it can also be other authentication algorithms, which is not limited in this embodiment);

[0291] An indication that the A-IoT device supports or does not support encryption capabilities;

[0292] The encryption algorithm supported by the A-IoT device; in particular, the encryption algorithm supported by the A-IoT device is different from 5G-EA0, 128-5G-EA1, 128-5G-EA2, 128-5G-EA3, 5G-EA4, 5G-EA5, 5G-EA6, 5G-EA7, etc. supported by NR Uu, and is a new type of encryption algorithm dedicated to A-IoT device communication, which has lower complexity and lower computing power consumption overhead (for example, the encryption algorithm supported by the A-IoT device is a 128-bit group symmetric encryption algorithm (AES128), of course, it can also be other encryption algorithms, which are not limited in this embodiment);

[0293] An indication that the A-IoT device supports or does not support integrity protection functions;

[0294] Integrity protection algorithm supported by the A-IoT device; in particular, the integrity protection algorithm supported by the A-IoT device is different from 5G-IA0, 128-5G-IA1, 128-5G-IA2, 128-5G-IA3, 5G-IA4, 5G-IA5, 5G-IA6, 5G-IA7, etc. supported by NR Uu, and is a new type of integrity protection algorithm dedicated to A-IoT device communication, which has lower complexity and lower computational power consumption (for example, the integrity protection algorithm supported by the A-IoT device is digital signatures (Digital Signatures), of course, it can also be other integrity protection algorithms, which are not limited in this embodiment);

[0295] The key length supported by the A-IoT device; in particular, the key length supported by the A-IoT device is a new type of key length dedicated to low-power communication of A-IoT devices, which has lower complexity and lower computational power consumption. A shorter value than the key length of 128 or 256 supported by NR Uu is required (for example, the key length supported by the A-IoT device is 64, of course, it can also be other key lengths, which are not limited in this embodiment);

[0296] An indication that the A-IoT device supports or does not support the security context storage function;

[0297] An index of at least one security parameter set supported by the A-IoT device, wherein the security parameter set is determined based on a combination of at least one of the above security capability parameters, or the security parameter set is determined based on a combination of at least one of the above security capability parameter values.

[0298] For example, the security parameter set represented by the security parameter set index 1 includes: the device identification of the A-IoT device, the indication that the A-IoT device supports the authentication function, and the authentication algorithm supported by the A-IoT device.

[0299] For another example, the security parameter set represented by security parameter set index 2 includes: a device identifier of the A-IoT device, an indication that the A-IoT device supports an authentication function, and an indication that the A-IoT device does not support an encryption function.

[0300] For another example, the security parameter set represented by security parameter set index 3 includes: a device identifier of the A-IoT device, an indication that the A-IoT device does not support an authentication function, and an indication that the A-IoT device does not support an encryption function.

[0301] For another example, the security parameter set represented by security parameter set index 4 includes: the device identification of the A-IoT device, an indication that the A-IoT device supports authentication functions, authentication algorithms supported by the A-IoT device, an indication that the A-IoT device supports encryption functions, and encryption algorithms supported by the A-IoT device.

[0302] For another example, the security parameter set represented by security parameter set index 5 includes: device identification of the A-IoT device, an indication that the A-IoT device supports authentication function, authentication algorithms supported by the A-IoT device, an indication that the A-IoT device supports encryption function, encryption algorithms supported by the A-IoT device, an indication that the A-IoT device supports integrity protection function, and integrity protection algorithms supported by the A-IoT device.

[0303] For another example, the security parameter set represented by security parameter set index 6 includes: device identification of the A-IoT device, indication that the A-IoT device supports authentication function, authentication algorithms supported by the A-IoT device, indication that the A-IoT device supports encryption function, encryption algorithms supported by the A-IoT device, indication that the A-IoT device supports integrity protection function, integrity protection algorithms supported by the A-IoT device, and key length supported by the A-IoT device.

[0304] For another example, the security parameter set represented by security parameter set index 7 includes: device identification of the A-IoT device, an indication that the A-IoT device supports authentication function, authentication algorithms supported by the A-IoT device, an indication that the A-IoT device supports encryption function, encryption algorithms supported by the A-IoT device, an indication that the A-IoT device supports integrity protection function, integrity protection algorithms supported by the A-IoT device, key lengths supported by the A-IoT device, and an indication that the A-IoT device supports security context storage function.

[0305] S1-3. The RAN node determines whether to activate a security parameter set and which security parameter set to activate based on the security capability parameters of the A-IoT device reported by the A-IoT device in S1-2. Specifically, after the RAN node determines to activate a security parameter set, the RAN node sends a security capability configuration to the A-IoT device, wherein the security capability configuration is used to indicate activation of a first security parameter set.

[0306] Optionally, the security capability configuration is sent along with an excitation signal for powering the A-IoT device.

[0307] Optionally, the RAN node may determine the first security parameter set based on at least one of the following:

[0308] Security capability parameters of joint RAN nodes, such as the intersection of security capability parameters of A-IoT devices and security capability parameters of RAN nodes;

[0309] The index of at least one security parameter set supported by the A-IoT device.

[0310] S1-4. The A-IoT device sends a security capability configuration response to the RAN node. Optionally, the security capability configuration response may indicate that the A-IoT device accepts the security capability configuration, or may indicate that the A-IoT device rejects the security capability configuration or the security capability configuration fails.

[0311] Specifically, when the security capability configuration response indicates that the A-IoT device accepts the security capability configuration, a secure communication function is turned on or activated, and secure communication is performed based on the first security parameter set.

[0312] Optionally, when the security capability configuration response indicates that the A-IoT device rejects the security capability configuration or the security capability configuration fails, the RAN node may re-trigger the security capability negotiation process of the A-IoT device or the RAN node may shut down the secure communication function (i.e., encryption and / or integrity protection functions are not disabled for subsequent transmissions between the A-IoT device and the RAN node).

[0313] Embodiment 2, as Fig.11 As shown, the A-IoT device can report security capabilities and negotiate configurations with the CN node through the RAN node. Specifically, the security capabilities can be reported and negotiated through part or all of the following S2-0 to S2-4.

[0314] S2-0. The A-IoT device obtains the security service customization information of the A-IoT device according to the APP server configuration, factory configuration or pre-configuration. The specific content may include: a set of security capability parameters corresponding to one / group of A-IoT devices.

[0315] It should be noted that if the security service customization information is factory configured or pre-configured, there is no need for signaling interaction between the APP server and the A-IoT device. Therefore, a dotted line is drawn in the figure (that is, the dotted line in the figure represents an optional step). The explanations of other dotted lines are similar and will not be repeated.

[0316] S2-1. The CN node triggers the security capability negotiation process of the A-IoT device. Specifically, the CN node sends security capability query information to the RAN node, and the RAN node further forwards the security capability query information to the A-IoT device.

[0317] Exemplarily, the security capability query information may be carried by a security capability query message.

[0318] Exemplarily, the security capability query information may be carried by an inventory command.

[0319] Optionally, the security capability query information is sent along with an excitation signal for powering the A-IoT device.

[0320] Optionally, the security capability query information includes at least one of the following:

[0321] Authentication query: used to query whether the A-IoT device supports the authentication function, or to query the authentication algorithm supported by the A-IoT device;

[0322] Encryption query: used to query whether the A-IoT device supports encryption function, or to query the encryption algorithm supported by the A-IoT device;

[0323] Integrity protection query: used to query whether the A-IoT device supports the integrity protection function, or to query the integrity protection algorithm supported by the A-IoT device;

[0324] Key capability query: used to query the key length supported by the A-IoT device;

[0325] Security context storage capability query: used to query whether the A-IoT device supports the security context storage function.

[0326] S2-2. The A-IoT device reports the security capability parameters available for negotiation to the RAN node, and the RAN node further forwards the security capability parameters of the A-IoT device to the CN node. Specifically, the security capability parameters of the A-IoT device may include at least one of the following:

[0327] Device ID or group ID of A-IoT device;

[0328] An indication that the A-IoT device supports or does not support the authentication function;

[0329] Authentication algorithms supported by the A-IoT device; in particular, the authentication algorithms supported by the A-IoT device are different from AKA supported by NR Uu, etc., and are a new type of authentication algorithms dedicated to A-IoT device communication, which has lower complexity and lower computational power consumption (for example, the authentication algorithm supported by the A-IoT device is the Tuak authentication algorithm, and of course it can also be other authentication algorithms, which is not limited in this embodiment);

[0330] An indication that the A-IoT device supports or does not support encryption capabilities;

[0331] The encryption algorithm supported by the A-IoT device; in particular, the encryption algorithm supported by the A-IoT device is different from 5G-EA0, 128-5G-EA1, 128-5G-EA2, 128-5G-EA3, 5G-EA4, 5G-EA5, 5G-EA6, 5G-EA7, etc. supported by NR Uu, and is a new type of encryption algorithm dedicated to A-IoT device communication, which has lower complexity and lower computing power consumption overhead (for example, the encryption algorithm supported by the A-IoT device is a 128-bit group symmetric encryption algorithm (AES128), of course, it can also be other encryption algorithms, which are not limited in this embodiment);

[0332] An indication that the A-IoT device supports or does not support integrity protection functions;

[0333] Integrity protection algorithm supported by the A-IoT device; in particular, the integrity protection algorithm supported by the A-IoT device is different from 5G-IA0, 128-5G-IA1, 128-5G-IA2, 128-5G-IA3, 5G-IA4, 5G-IA5, 5G-IA6, 5G-IA7, etc. supported by NR Uu, and is a new type of integrity protection algorithm dedicated to A-IoT device communication, which has lower complexity and lower computational power consumption (for example, the integrity protection algorithm supported by the A-IoT device is digital signatures (Digital Signatures), of course, it can also be other integrity protection algorithms, which are not limited in this embodiment);

[0334] The key length supported by the A-IoT device; for example, a value shorter than the key length of 128 or 256 supported by the NR Uu (for example, the key length supported by the A-IoT device is 64, and of course it can be other key lengths, which are not limited in this embodiment);

[0335] An indication that the A-IoT device supports or does not support the security context storage function;

[0336] An index of at least one security parameter set supported by the A-IoT device, wherein the security parameter set is determined based on a combination of at least one of the above security capability parameters, or the security parameter set is determined based on a combination of at least one of the above security capability parameter values.

[0337] For example, the security parameter set represented by the security parameter set index 1 includes: the device identification of the A-IoT device, the indication that the A-IoT device supports the authentication function, and the authentication algorithm supported by the A-IoT device.

[0338] For another example, the security parameter set represented by security parameter set index 2 includes: the device identification of the A-IoT device, an indication that the A-IoT device supports the authentication function, and the authentication algorithm not supported by the A-IoT device.

[0339] For another example, the security parameter set represented by security parameter set index 3 includes: a device identifier of the A-IoT device, an indication that the A-IoT device does not support the authentication function, and an authentication algorithm that the A-IoT device does not support.

[0340] For another example, the security parameter set represented by security parameter set index 4 includes: the device identification of the A-IoT device, an indication that the A-IoT device supports authentication functions, authentication algorithms supported by the A-IoT device, an indication that the A-IoT device supports encryption functions, and encryption algorithms supported by the A-IoT device.

[0341] For another example, the security parameter set represented by security parameter set index 5 includes: device identification of the A-IoT device, an indication that the A-IoT device supports authentication function, authentication algorithms supported by the A-IoT device, an indication that the A-IoT device supports encryption function, encryption algorithms supported by the A-IoT device, an indication that the A-IoT device supports integrity protection function, and integrity protection algorithms supported by the A-IoT device.

[0342] For another example, the security parameter set represented by security parameter set index 6 includes: device identification of the A-IoT device, indication that the A-IoT device supports authentication function, authentication algorithms supported by the A-IoT device, indication that the A-IoT device supports encryption function, encryption algorithms supported by the A-IoT device, indication that the A-IoT device supports integrity protection function, integrity protection algorithms supported by the A-IoT device, and key length supported by the A-IoT device.

[0343] For another example, the security parameter set represented by security parameter set index 7 includes: device identification of the A-IoT device, an indication that the A-IoT device supports authentication function, authentication algorithms supported by the A-IoT device, an indication that the A-IoT device supports encryption function, encryption algorithms supported by the A-IoT device, an indication that the A-IoT device supports integrity protection function, integrity protection algorithms supported by the A-IoT device, key lengths supported by the A-IoT device, and an indication that the A-IoT device supports security context storage function.

[0344] S2-3. The CN node determines whether to activate a security parameter set and which security parameter set to activate based on the security capability parameters of the A-IoT device reported by the A-IoT device in S2-2. Specifically, after the CN node determines to activate a security parameter set, the CN node sends a security capability configuration to the RAN node, and the RAN node further forwards the security capability configuration to the A-IoT device, wherein the security capability configuration is used to indicate activation of the first security parameter set.

[0345] Optionally, the security capability configuration is sent along with an excitation signal for powering the A-IoT device.

[0346] Optionally, the CN node may determine the first security parameter set based on at least one of the following:

[0347] Security capability parameters of the combined CN node, such as the intersection of the security capability parameters of the A-IoT device and the security capability parameters of the CN node;

[0348] Security capability parameters of joint RAN nodes, such as the intersection of security capability parameters of A-IoT devices and security capability parameters of RAN nodes;

[0349] The index of at least one security parameter set supported by the A-IoT device.

[0350] S2-4. The A-IoT device sends a security capability configuration response to the RAN node, and the RAN node further forwards the security capability configuration response to the CN node. Optionally, the security capability configuration response can indicate that the A-IoT device accepts the security capability configuration, or it can indicate that the A-IoT device refuses the security capability configuration or the security capability configuration fails.

[0351] Specifically, when the security capability configuration response indicates that the A-IoT device accepts the security capability configuration, a secure communication function is turned on or activated, and secure communication is performed based on the first security parameter set.

[0352] Optionally, when the security capability configuration response indicates that the A-IoT device refuses the security capability configuration or the security capability configuration fails, the CN node may re-trigger the security capability negotiation process of the A-IoT device or the CN node may shut down the secure communication function (i.e., encryption and / or integrity protection functions are not enabled (disabled) in subsequent transmissions between the A-IoT device and the RAN node and between the RAN node and the CN node).

[0353] Embodiment 3, as Fig.12 As shown, the A-IoT device does not need to report security capabilities through the air interface. The A-IoT device only negotiates security capability configuration with the RAN node. Specifically, the security capability configuration negotiation can be performed through part or all of S3-0 (S3-0a and S3-0b) to S3-3 as follows.

[0354] S3-0a. The A-IoT device obtains the security service customization information of the A-IoT device according to the APP server configuration, factory configuration or pre-configuration. The specific content may include: a set of security capability parameters corresponding to one / group of A-IoT devices.

[0355] It should be noted that if the security service customization information is factory configured or pre-configured, there is no need for signaling interaction between the APP server and the A-IoT device. Therefore, a dotted line is drawn in the figure (that is, the dotted line in the figure represents an optional step). The explanations of other dotted lines are similar and will not be repeated.

[0356] S3-0b. The APP server sends the security service customization information to the CN node, including a set of security capability parameters corresponding to one or a group of A-IoT devices.

[0357] S3-1. The CN node determines the serving RAN node to which an A-IoT device / group belongs, and sends the security capability parameters of an A-IoT device / group managed by the serving RAN node to the serving RAN node. For example, the security capability parameters of an A-IoT device / group managed by the same serving RAN node are sent to the serving RAN node. The specific security capability parameters of each A-IoT device / group may include at least one of the following:

[0358] Device ID or group ID of A-IoT device;

[0359] An indication that the A-IoT device supports or does not support the authentication function;

[0360] Authentication algorithms supported by the A-IoT device; in particular, the authentication algorithms supported by the A-IoT device are different from AKA supported by NR Uu, etc., and are a new type of authentication algorithms dedicated to A-IoT device communication, which has lower complexity and lower computational power consumption (for example, the authentication algorithm supported by the A-IoT device is the Tuak authentication algorithm, and of course it can also be other authentication algorithms, which is not limited in this embodiment);

[0361] An indication that the A-IoT device supports or does not support encryption capabilities;

[0362] The encryption algorithm supported by the A-IoT device; in particular, the encryption algorithm supported by the A-IoT device is different from 5G-EA0, 128-5G-EA1, 128-5G-EA2, 128-5G-EA3, 5G-EA4, 5G-EA5, 5G-EA6, 5G-EA7, etc. supported by NR Uu, and is a new type of encryption algorithm dedicated to A-IoT device communication, which has lower complexity and lower computing power consumption overhead (for example, the encryption algorithm supported by the A-IoT device is a 128-bit group symmetric encryption algorithm (AES128), of course, it can also be other encryption algorithms, which are not limited in this embodiment);

[0363] An indication that the A-IoT device supports or does not support integrity protection functions;

[0364] Integrity protection algorithm supported by the A-IoT device; in particular, the integrity protection algorithm supported by the A-IoT device is different from 5G-IA0, 128-5G-IA1, 128-5G-IA2, 128-5G-IA3, 5G-IA4, 5G-IA5, 5G-IA6, 5G-IA7, etc. supported by NR Uu, and is a new type of integrity protection algorithm dedicated to A-IoT device communication, which has lower complexity and lower computational power consumption (for example, the integrity protection algorithm supported by the A-IoT device is digital signatures (Digital Signatures), of course, it can also be other integrity protection algorithms, which are not limited in this embodiment);

[0365] The key length supported by the A-IoT device; for example, a value shorter than the key length of 128 or 256 supported by the NR Uu (for example, the key length supported by the A-IoT device is 64, and of course it can be other key lengths, which are not limited in this embodiment);

[0366] An indication that the A-IoT device supports or does not support the security context storage function;

[0367] An index of at least one security parameter set supported by the A-IoT device, wherein the security parameter set is determined based on a combination of at least one of the above security capability parameters, or the security parameter set is determined based on a combination of at least one of the above security capability parameter values.

[0368] For example, the security parameter set represented by the security parameter set index 1 includes: the device identification of the A-IoT device, the indication that the A-IoT device supports the authentication function, and the authentication algorithm supported by the A-IoT device.

[0369] For another example, the security parameter set represented by security parameter set index 2 includes: the device identification of the A-IoT device, an indication that the A-IoT device supports the authentication function, and the authentication algorithm not supported by the A-IoT device.

[0370] For another example, the security parameter set represented by security parameter set index 3 includes: a device identifier of the A-IoT device, an indication that the A-IoT device does not support the authentication function, and an authentication algorithm that the A-IoT device does not support.

[0371] For another example, the security parameter set represented by security parameter set index 4 includes: the device identification of the A-IoT device, an indication that the A-IoT device supports authentication functions, authentication algorithms supported by the A-IoT device, an indication that the A-IoT device supports encryption functions, and encryption algorithms supported by the A-IoT device.

[0372] For another example, the security parameter set represented by security parameter set index 5 includes: device identification of the A-IoT device, an indication that the A-IoT device supports authentication function, authentication algorithms supported by the A-IoT device, an indication that the A-IoT device supports encryption function, encryption algorithms supported by the A-IoT device, an indication that the A-IoT device supports integrity protection function, and integrity protection algorithms supported by the A-IoT device.

[0373] For another example, the security parameter set represented by security parameter set index 6 includes: device identification of the A-IoT device, indication that the A-IoT device supports authentication function, authentication algorithms supported by the A-IoT device, indication that the A-IoT device supports encryption function, encryption algorithms supported by the A-IoT device, indication that the A-IoT device supports integrity protection function, integrity protection algorithms supported by the A-IoT device, and key length supported by the A-IoT device.

[0374] For another example, the security parameter set represented by security parameter set index 7 includes: device identification of the A-IoT device, an indication that the A-IoT device supports authentication function, authentication algorithms supported by the A-IoT device, an indication that the A-IoT device supports encryption function, encryption algorithms supported by the A-IoT device, an indication that the A-IoT device supports integrity protection function, integrity protection algorithms supported by the A-IoT device, key lengths supported by the A-IoT device, and an indication that the A-IoT device supports security context storage function.

[0375] S3-2. The RAN node determines whether to activate a security parameter set and which security parameter set to activate based on the security capability parameters of the A-IoT device obtained in S3-1. Specifically, after the RAN node determines to activate a security parameter set, the RAN node sends a security capability configuration to the A-IoT device, wherein the security capability configuration is used to indicate activation of a first security parameter set.

[0376] Optionally, the security capability configuration is sent along with an excitation signal for powering the A-IoT device.

[0377] Optionally, the RAN node may determine the first security parameter set based on at least one of the following:

[0378] Security capability parameters of joint RAN nodes, such as the intersection of security capability parameters of A-IoT devices and security capability parameters of RAN nodes;

[0379] The index of at least one security parameter set supported by the A-IoT device.

[0380] S3-3. The A-IoT device sends a security capability configuration response to the RAN node. Optionally, the security capability configuration response may indicate that the A-IoT device accepts the security capability configuration, or may indicate that the A-IoT device rejects the security capability configuration or the security capability configuration fails.

[0381] Specifically, when the security capability configuration response indicates that the A-IoT device accepts the security capability configuration, a secure communication function is turned on or activated, and secure communication is performed based on the first security parameter set.

[0382] Optionally, when the security capability configuration response indicates that the A-IoT device rejects the security capability configuration or the security capability configuration fails, the RAN node may re-trigger the security capability negotiation process of the A-IoT device or the RAN node may shut down the secure communication function (i.e., encryption and / or integrity protection functions are not disabled for subsequent transmissions between the A-IoT device and the RAN node).

[0383] Embodiment 4, as Fig.13As shown, the A-IoT device does not need to report security capabilities through the air interface. The A-IoT device only negotiates security capability configuration with the CN node through the RAN node. Specifically, the security capability configuration negotiation can be performed through part or all of the following S4-0 (S4-0a and S4-0b) to S4-2.

[0384] S4-0a. The A-IoT device obtains the security service customization information of the A-IoT device according to the APP server configuration, factory configuration or pre-configuration. The specific content may include: a set of security capability parameters corresponding to one / group of A-IoT devices.

[0385] It should be noted that if the security service customization information is factory configured or pre-configured, there is no need for signaling interaction between the APP server and the A-IoT device. Therefore, a dotted line is drawn in the figure (that is, the dotted line in the figure represents an optional step). The explanations of other dotted lines are similar and will not be repeated.

[0386] S4-0b. The APP server sends the security service customization information to the CN node, including a set of security capability parameters corresponding to one or a group of A-IoT devices.

[0387] The specific security capability parameters of an A-IoT device or a group of A-IoT devices may include at least one of the following:

[0388] Device ID or group ID of A-IoT device;

[0389] An indication that the A-IoT device supports or does not support the authentication function;

[0390] Authentication algorithms supported by the A-IoT device; in particular, the authentication algorithms supported by the A-IoT device are different from AKA supported by NR Uu, etc., and are a new type of authentication algorithms dedicated to A-IoT device communication, which has lower complexity and lower computational power consumption (for example, the authentication algorithm supported by the A-IoT device is the Tuak authentication algorithm, and of course it can also be other authentication algorithms, which is not limited in this embodiment);

[0391] An indication that the A-IoT device supports or does not support encryption capabilities;

[0392] The encryption algorithm supported by the A-IoT device; in particular, the encryption algorithm supported by the A-IoT device is different from 5G-EA0, 128-5G-EA1, 128-5G-EA2, 128-5G-EA3, 5G-EA4, 5G-EA5, 5G-EA6, 5G-EA7, etc. supported by NR Uu, and is a new type of encryption algorithm dedicated to A-IoT device communication, which has lower complexity and lower computing power consumption overhead (for example, the encryption algorithm supported by the A-IoT device is a 128-bit group symmetric encryption algorithm (AES128), of course, it can also be other encryption algorithms, which are not limited in this embodiment);

[0393] An indication that the A-IoT device supports or does not support integrity protection functions;

[0394] Integrity protection algorithm supported by the A-IoT device; in particular, the integrity protection algorithm supported by the A-IoT device is different from 5G-IA0, 128-5G-IA1, 128-5G-IA2, 128-5G-IA3, 5G-IA4, 5G-IA5, 5G-IA6, 5G-IA7, etc. supported by NR Uu, and is a new type of integrity protection algorithm dedicated to A-IoT device communication, which has lower complexity and lower computational power consumption (for example, the integrity protection algorithm supported by the A-IoT device is digital signatures (Digital Signatures), of course, it can also be other integrity protection algorithms, which are not limited in this embodiment);

[0395] The key length supported by the A-IoT device; for example, a value shorter than the key length of 128 or 256 supported by the NR Uu (for example, the key length supported by the A-IoT device is 64, and of course it can be other key lengths, which are not limited in this embodiment);

[0396] An indication that the A-IoT device supports or does not support the security context storage function;

[0397] An index of at least one security parameter set supported by the A-IoT device, wherein the security parameter set is determined based on a combination of at least one of the above security capability parameters, or the security parameter set is determined based on a combination of at least one of the above security capability parameter values.

[0398] For example, the security parameter set represented by the security parameter set index 1 includes: the device identification of the A-IoT device, the indication that the A-IoT device supports the authentication function, and the authentication algorithm supported by the A-IoT device.

[0399] For another example, the security parameter set represented by security parameter set index 2 includes: the device identification of the A-IoT device, an indication that the A-IoT device supports the authentication function, and the authentication algorithm not supported by the A-IoT device.

[0400] For another example, the security parameter set represented by security parameter set index 3 includes: a device identifier of the A-IoT device, an indication that the A-IoT device does not support the authentication function, and an authentication algorithm that the A-IoT device does not support.

[0401] For another example, the security parameter set represented by security parameter set index 4 includes: the device identification of the A-IoT device, an indication that the A-IoT device supports authentication functions, authentication algorithms supported by the A-IoT device, an indication that the A-IoT device supports encryption functions, and encryption algorithms supported by the A-IoT device.

[0402] For another example, the security parameter set represented by security parameter set index 5 includes: device identification of the A-IoT device, an indication that the A-IoT device supports authentication function, authentication algorithms supported by the A-IoT device, an indication that the A-IoT device supports encryption function, encryption algorithms supported by the A-IoT device, an indication that the A-IoT device supports integrity protection function, and integrity protection algorithms supported by the A-IoT device.

[0403] For another example, the security parameter set represented by security parameter set index 6 includes: device identification of the A-IoT device, indication that the A-IoT device supports authentication function, authentication algorithms supported by the A-IoT device, indication that the A-IoT device supports encryption function, encryption algorithms supported by the A-IoT device, indication that the A-IoT device supports integrity protection function, integrity protection algorithms supported by the A-IoT device, and key length supported by the A-IoT device.

[0404] For another example, the security parameter set represented by security parameter set index 7 includes: device identification of the A-IoT device, an indication that the A-IoT device supports authentication function, authentication algorithms supported by the A-IoT device, an indication that the A-IoT device supports encryption function, encryption algorithms supported by the A-IoT device, an indication that the A-IoT device supports integrity protection function, integrity protection algorithms supported by the A-IoT device, key lengths supported by the A-IoT device, and an indication that the A-IoT device supports security context storage function.

[0405] S4-1. The CN node determines whether to activate a security parameter set and which security parameter set to activate based on the security capability parameters of the A-IoT device / group obtained in S4-0b. Specifically, after the CN node determines to activate a security parameter set, the CN node sends a security capability configuration to the RAN node, and the RAN node further forwards the security capability configuration to the A-IoT device, wherein the security capability configuration is used to indicate activation of the first security parameter set.

[0406] Optionally, the security capability configuration is sent along with an excitation signal for powering the A-IoT device.

[0407] Optionally, the CN node may determine the first security parameter set based on at least one of the following:

[0408] Security capability parameters of the combined CN node, such as the intersection of the security capability parameters of the A-IoT device and the security capability parameters of the CN node;

[0409] Security capability parameters of joint RAN nodes, such as the intersection of security capability parameters of A-IoT devices and security capability parameters of RAN nodes;

[0410] The index of at least one security parameter set supported by the A-IoT device.

[0411] S4-2. The A-IoT device sends a security capability configuration response to the RAN node, and the RAN node further forwards the security capability configuration response to the CN node. Optionally, the security capability configuration response can indicate that the A-IoT device accepts the security capability configuration, or it can indicate that the A-IoT device refuses the security capability configuration or the security capability configuration fails.

[0412] Specifically, when the security capability configuration response indicates that the A-IoT device accepts the security capability configuration, a secure communication function is turned on or activated, and secure communication is performed based on the first security parameter set.

[0413] Optionally, when the security capability configuration response indicates that the A-IoT device refuses the security capability configuration or the security capability configuration fails, the CN node may re-trigger the security capability negotiation process of the A-IoT device or the CN node may shut down the secure communication function (i.e., encryption and / or integrity protection functions are not enabled (disabled) in subsequent transmissions between the A-IoT device and the RAN node and between the RAN node and the CN node).

[0414] The security capability negotiation method provided in the embodiment of the present application can be executed by a security capability negotiation device or a processing unit in the security capability negotiation device for executing the security capability negotiation method. The security capability negotiation device provided in the embodiment of the present application is described by taking the security capability negotiation device executing the security capability negotiation method as an example.

[0415] Fig.14 FIG. 4 is a schematic block diagram of a security capability negotiation device 400 according to an embodiment of the present application. Fig.14 As shown, the security capability negotiation device 400 includes:

[0416] The transceiver unit 410 is configured to receive first information from a first network element, wherein the first information is used to configure or activate a first security parameter set;

[0417] In response to the first information, the transceiver unit 410 is further configured to send first response information to the first network element;

[0418] The first security parameter set satisfies any of the following:

[0419] Determined based on the security capability parameters of the security capability negotiation device 400;

[0420] Determined based on the security capability parameter of the security capability negotiation device 400 and the security capability parameter of the first network element;

[0421] Determined based on the security capability parameters of the security capability negotiation device 400, the security capability parameters of the first network element, and the security capability parameters of the second network element;

[0422] The second network element communicates with the security capability negotiation device 400 through the first network element.

[0423] In some embodiments, the security capability parameter of the security capability negotiation device 400 includes at least one of the following:

[0424] The device identifier or group identifier of the security capability negotiation device 400;

[0425] A first indication, used to indicate whether the security capability negotiation device 400 supports or does not support the authentication function;

[0426] The authentication algorithm supported by the security capability negotiation device 400;

[0427] A second indication, used to indicate whether the security capability negotiation device 400 supports or does not support the encryption function;

[0428] The encryption algorithm supported by the security capability negotiation device 400;

[0429] A third indication, used to indicate whether the security capability negotiation device 400 supports or does not support the integrity protection function;

[0430] The integrity protection algorithm supported by the security capability negotiation device 400;

[0431] The key length supported by the security capability negotiation device 400;

[0432] A fourth indication, used to indicate whether the security capability negotiation device 400 supports or does not support a security context storage function;

[0433] An index of at least one security parameter set supported by the security capability negotiation device 400;

[0434] The at least one security parameter set includes the first security parameter set.

[0435] In some embodiments, when the security capability parameter of the security capability negotiation device 400 includes an index of at least one security parameter set supported by the security capability negotiation device 400, the first security parameter set is determined based on the index of the at least one security parameter set.

[0436] In some embodiments, each security parameter set of the at least one security parameter set is determined based on a combination of at least one of the following:

[0437] the first instruction;

[0438] The authentication algorithm supported by the security capability negotiation device 400;

[0439] the second instruction;

[0440] The encryption algorithm supported by the security capability negotiation device 400;

[0441] said third instruction;

[0442] The integrity protection algorithm supported by the security capability negotiation device 400;

[0443] The key length supported by the security capability negotiation device 400;

[0444] The fourth instruction.

[0445] In some embodiments, the security capability parameter of the security capability negotiation device 400 comes from the second network element.

[0446] In some embodiments, before the transceiver unit 410 receives the first information from the first network element, the transceiver unit 410 is further configured to receive security capability query information from the first network element;

[0447] The transceiver unit 410 is further configured to send security capability information to the first network element, wherein the security capability information includes security capability parameters of the security capability negotiation device 400 .

[0448] In some embodiments, the security capability query information includes at least one of the following: authentication query information, encryption query information, integrity protection query information, key capability query information, and security context storage capability query information;

[0449] Among them, the authentication query information is used to query whether the security capability negotiation device 400 supports the authentication function, or the authentication query information is used to query the authentication algorithm supported by the security capability negotiation device 400, the encryption query information is used to query whether the security capability negotiation device 400 supports the encryption function, or the encryption query information is used to query the encryption algorithm supported by the security capability negotiation device 400, the integrity protection query information is used to query whether the security capability negotiation device 400 supports the integrity protection function, or the integrity protection query information is used to query the integrity protection algorithm supported by the security capability negotiation device 400, the key capability query information is used to query the key length supported by the security capability negotiation device 400, and the security context storage capability query information is used to query whether the security capability negotiation device 400 supports the security context storage function.

[0450] In some embodiments, the security capability query information is carried by an inventory command, or the security capability query information is carried by a security capability query message.

[0451] In some embodiments, the security capability query information is generated by the first network element, and the security capability information is decoded and processed by the first network element; or,

[0452] The security capability query information is acquired from the second network element through the first network element, and the security capability information is forwarded to the second network element through the first network element and decoded and processed by the second network element.

[0453] In some embodiments, part or all of the information received by the security capability negotiation device 400 from the first network element is accompanied by an excitation signal for powering the security capability negotiation device 400 .

[0454] In some embodiments, the first information is generated by the first network element, and the first response information is decoded and processed by the first network element; or,

[0455] The first information is acquired from the second network element by the first network element, and the first response information is forwarded to the second network element by the first network element and decoded and processed by the second network element.

[0456] In some embodiments, when the first response information is used to indicate that the security capability negotiation device 400 rejects the first information or the configuration or activation of the first information fails, the security capability negotiation device 400 further includes:

[0457] The processing unit 420 is used to determine to close, deconfigure or deactivate the security communication function between the first network element.

[0458] In some embodiments, when the first response information indicates that the security capability negotiation device 400 rejects the first information or the configuration or activation of the first information fails, the transceiver unit 410 is further used to receive second information from the first network element, wherein the second information is used to: configure or activate a second security parameter set, or, deconfigure or deactivate the first security parameter set;

[0459] In response to the second information, the transceiver unit 410 is further configured to send second response information to the first network element;

[0460] The second security parameter set satisfies any one of the following:

[0461] Determined based on the security capability parameters of the security capability negotiation device 400;

[0462] Determined based on the security capability parameter of the security capability negotiation device 400 and the security capability parameter of the first network element;

[0463] It is determined based on the security capability parameter of the security capability negotiation device 400, the security capability parameter of the first network element, and the security capability parameter of the second network element.

[0464] In some embodiments, the second information is generated by the first network element, and the second response information is decoded and processed by the first network element; or,

[0465] The second information is acquired from the second network element through the first network element, and the second response information is forwarded to the second network element through the first network element and decoded and processed by the second network element.

[0466] In some embodiments, the transceiver unit may be a communication interface or a transceiver, or an input / output interface of a communication chip or a system on chip.

[0467] It should be understood that the security capability negotiation device 400 according to the embodiment of the present application may correspond to the A-IoT device in the method embodiment of the present application, and the above and other operations or functions of each unit in the security capability negotiation device 400 are respectively to achieve Figure 8 For the sake of brevity, the corresponding process of the A-IoT device in the method 200 shown is not repeated here.

[0468] Fig.15 FIG. 5 shows a schematic block diagram of a security capability negotiation device 500 according to an embodiment of the present application. Fig.15 As shown, the security capability negotiation device 500 includes:

[0469] The transceiver unit 510 is used to send first information to the ambient Internet of Things A-IoT device, wherein the first information is used to configure or activate a first security parameter set;

[0470] The transceiver unit 510 is further configured to receive first response information from the A-IoT device, wherein the first response information is a response to the first information;

[0471] The first security parameter set satisfies any of the following:

[0472] Determined based on the security capability parameters of the A-IoT device;

[0473] Determined based on the security capability parameters of the A-IoT device and the security capability parameters of the security capability negotiation device 500;

[0474] Determined based on the security capability parameters of the A-IoT device, the security capability parameters of the security capability negotiation device 500 and the security capability parameters of the second network element;

[0475] Among them, the second network element communicates with the A-IoT device through the security capability negotiation device 500.

[0476] In some embodiments, the security capability parameter of the A-IoT device includes at least one of the following:

[0477] The device identifier or group identifier of the A-IoT device;

[0478] A first indication, used to indicate whether the A-IoT device supports or does not support the authentication function;

[0479] The authentication algorithm supported by the A-IoT device;

[0480] A second indication, used to indicate whether the A-IoT device supports or does not support an encryption function;

[0481] The encryption algorithm supported by the A-IoT device;

[0482] A third indication, used to indicate whether the A-IoT device supports or does not support the integrity protection function;

[0483] The integrity protection algorithm supported by the A-IoT device;

[0484] The key length supported by the A-IoT device;

[0485] A fourth indication, used to indicate that the A-IoT device supports or does not support a security context storage function;

[0486] An index of at least one security parameter set supported by the A-IoT device;

[0487] The at least one security parameter set includes the first security parameter set.

[0488] In some embodiments, when the security capability parameter of the A-IoT device includes an index of at least one security parameter set supported by the A-IoT device, the first security parameter set is determined based on the index of the at least one security parameter set.

[0489] In some embodiments, each security parameter set of the at least one security parameter set is determined based on a combination of at least one of the following:

[0490] the first instruction;

[0491] The authentication algorithm supported by the A-IoT device;

[0492] the second instruction;

[0493] The encryption algorithm supported by the A-IoT device;

[0494] said third instruction;

[0495] The integrity protection algorithm supported by the A-IoT device;

[0496] The key length supported by the A-IoT device;

[0497] The fourth instruction.

[0498] In some embodiments, the security capability parameters of the A-IoT device come from the second network element.

[0499] In some embodiments, before the security capability negotiation device 500 sends the first information to the A-IoT device, the transceiver unit 510 is further used to send security capability query information to the A-IoT device;

[0500] The transceiver unit 510 is further configured to receive security capability information from the A-IoT device, wherein the security capability information includes security capability parameters of the A-IoT device.

[0501] In some embodiments, the security capability query information includes at least one of the following: authentication query information, encryption query information, integrity protection query information, key capability query information, and security context storage capability query information;

[0502] Among them, the authentication query information is used to query whether the A-IoT device supports the authentication function, or the authentication query information is used to query the authentication algorithm supported by the A-IoT device, the encryption query information is used to query whether the A-IoT device supports the encryption function, or the encryption query information is used to query the encryption algorithm supported by the A-IoT device, the integrity protection query information is used to query whether the A-IoT device supports the integrity protection function, or the integrity protection query information is used to query the integrity protection algorithm supported by the A-IoT device, the key capability query information is used to query the key length supported by the A-IoT device, and the security context storage capability query information is used to query whether the A-IoT device supports the security context storage function.

[0503] In some embodiments, the security capability query information is carried by an inventory command, or the security capability query information is carried by a security capability query message.

[0504] In some embodiments, the security capability query information is generated by the security capability negotiation device 500, and the security capability information is decoded and processed by the security capability negotiation device 500; or,

[0505] The security capability query information is acquired from the second network element by the security capability negotiation device 500, and the security capability information is forwarded to the second network element by the security capability negotiation device 500 and decoded and processed by the second network element.

[0506] In some embodiments, part or all of the information sent by the security capability negotiation apparatus 500 to the A-IoT device is accompanied by an excitation signal for powering the A-IoT device.

[0507] In some embodiments, the first information is generated by the security capability negotiation device 500, and the first response information is decoded and processed by the security capability negotiation device 500; or,

[0508] The first information is acquired from the second network element through the security capability negotiation device 500, and the first response information is forwarded to the second network element through the security capability negotiation device 500 and decoded and processed by the second network element.

[0509] In some embodiments, when the first response information is used to indicate that the A-IoT device rejects the first information or the configuration or activation of the first information fails, the security capability negotiation device 500 further includes:

[0510] The processing unit 520 is used to close, configure or activate the secure communication function between the A-IoT device.

[0511] In some embodiments, when the first response information indicates that the A-IoT device rejects the first information or the configuration or activation of the first information fails, the transceiver unit 510 is further used to send second information to the A-IoT device, wherein the second information is used to: configure or activate a second security parameter set, or, to configure or deactivate the first security parameter set;

[0512] The transceiver unit 510 is further configured to receive second response information from the A-IoT device, wherein the second response information is a response to the second information;

[0513] The second security parameter set satisfies any one of the following:

[0514] Determined based on the security capability parameters of the A-IoT device;

[0515] Determined based on the security capability parameters of the A-IoT device and the security capability parameters of the security capability negotiation device 500;

[0516] Determined based on the security capability parameters of the A-IoT device, the security capability parameters of the security capability negotiation device 500 and the security capability parameters of the second network element.

[0517] In some embodiments, the second information is generated by the security capability negotiation device 500, and the second response information is decoded and processed by the security capability negotiation device 500; or,

[0518] The second information is acquired from the second network element by the security capability negotiation device 500, and the second response information is forwarded to the second network element by the security capability negotiation device 500 and decoded and processed by the second network element.

[0519] In some embodiments, the transceiver unit may be a communication interface or a transceiver, or an input / output interface of a communication chip or a system on chip.

[0520] It should be understood that the security capability negotiation device 500 according to the embodiment of the present application may correspond to the first network element in the method embodiment of the present application, and the above and other operations or functions of each unit in the security capability negotiation device 500 are respectively to implement Figure 8 For the sake of brevity, the corresponding process of the first network element in the method 200 is not repeated here.

[0521] Therefore, in the embodiment of the present application, the first security parameter set satisfies any one of the following: determined based on the security capability parameters of the A-IoT device, determined based on the security capability parameters of the A-IoT device and the security capability parameters of the first network element, determined based on the security capability parameters of the A-IoT device, the security capability parameters of the first network element, and the security capability parameters of the second network element. That is, in the embodiment of the present application, the first network element or the second network element can at least determine the security parameter set to be configured or activated based on the security capability parameters of the A-IoT device, and negotiate with the A-IoT device to determine whether to activate the security parameter set, so that the secure communication function can be enabled as needed, and some security parameters can be enabled or activated as needed, thereby meeting the low power consumption requirements of the A-IoT device.

[0522] The security capability negotiation device in the embodiment of the present application can be an electronic device, such as an electronic device with an operating system, or a component in an electronic device, such as an integrated circuit or a chip. The electronic device can be an A-IoT device, a first network element, or a second network element, or can be a device other than an A-IoT device, a first network element, or a second network element. Exemplarily, the A-IoT device can include but is not limited to the types of the A-IoT devices 11 listed above, the first network element can include but is not limited to the types of the first network element 12 listed above, and other devices can be servers, network attached storage (NAS), etc., which are not specifically limited in the embodiment of the present application.

[0523] The security capability negotiation device provided in the embodiment of the present application can achieve Figure 8 The various processes implemented by the method embodiment and achieving the same technical effect are not described here to avoid repetition.

[0524] Fig.16 FIG. 6 shows a schematic block diagram of a security capability negotiation system 600 according to an embodiment of the present application. Fig.16 As shown, the security capability negotiation system 600 includes: an A-IoT device 610, a first network element 620, a second network element 630 and an application server 640; wherein the second network element 630 communicates with the A-IoT device 610 through the first network element 620

[0525] The first network element 620 is used to send the first information to the A-IoT device 610, and the first network element 620 is used to receive the first response information from the A-IoT device 610; or, the second network element 630 is used to send the first information to the A-IoT device 610 through the first network element 620, and the second network element 630 is used to receive the first response information from the A-IoT device 610 through the first network element 620;

[0526] The first information is used to configure or activate a first security parameter set, and the first response information is a response to the first information;

[0527] The first security parameter set satisfies any of the following:

[0528] Determined based on the security capability parameters of the A-IoT device 610;

[0529] Determined based on the security capability parameters of the A-IoT device 610 and the security capability parameters of the first network element 620;

[0530] Determined based on the security capability parameters of the A-IoT device 610, the security capability parameters of the first network element 620, and the security capability parameters of the second network element 630.

[0531] In some embodiments, the security capability parameters of the A-IoT device 610 include at least one of the following:

[0532] The device identifier or group identifier of the A-IoT device 610;

[0533] A first indication, used to indicate whether the A-IoT device 610 supports or does not support the authentication function;

[0534] The authentication algorithm supported by the A-IoT device 610;

[0535] A second indication, used to indicate whether the A-IoT device 610 supports or does not support the encryption function;

[0536] The encryption algorithm supported by the A-IoT device 610;

[0537] A third indication, used to indicate whether the A-IoT device 610 supports or does not support the integrity protection function;

[0538] The integrity protection algorithm supported by the A-IoT device 610;

[0539] The key length supported by the A-IoT device 610;

[0540] A fourth indication, used to indicate that the A-IoT device 610 supports or does not support a security context storage function;

[0541] An index of at least one security parameter set supported by the A-IoT device 610;

[0542] The at least one security parameter set includes the first security parameter set.

[0543] In some embodiments, when the security capability parameter of the A-IoT device 610 includes an index of at least one security parameter set supported by the A-IoT device 610, the first security parameter set is determined based on the index of the at least one security parameter set.

[0544] In some embodiments, each security parameter set of the at least one security parameter set is determined based on a combination of at least one of the following:

[0545] the first instruction;

[0546] The authentication algorithm supported by the A-IoT device 610;

[0547] the second instruction;

[0548] The encryption algorithm supported by the A-IoT device 610;

[0549] said third instruction;

[0550] The integrity protection algorithm supported by the A-IoT device 610;

[0551] The key length supported by the A-IoT device 610;

[0552] The fourth instruction.

[0553] In some embodiments, when the first network element 620 sends the first information to the A-IoT device 610 and the first network element 620 receives the first response information from the A-IoT device 610, the first network element 620 is also used to obtain the security capability parameters of the A-IoT device 610 from the application server 640 through the second network element 630.

[0554] In some embodiments, before the first network element 620 sends the first information to the A-IoT device 610, the first network element 620 is further used to send security capability query information to the A-IoT device 610;

[0555] The first network element 620 is further used to receive security capability information from the A-IoT device 610 , wherein the security capability information includes security capability parameters of the A-IoT device 610 .

[0556] In some embodiments, when the second network element 630 sends the first information to the A-IoT device 610 through the first network element 620, and the second network element 630 receives the first response information from the A-IoT device 610 through the first network element 620, the second network element 630 is also used to obtain the security capability parameters of the A-IoT device 610 from the application server 640.

[0557] In some embodiments, before the second network element 630 sends the first information to the A-IoT device 610 through the first network element 620, the second network element 630 is further used to send security capability query information to the A-IoT device 610 through the first network element 620;

[0558] The second network element 630 is further used to receive security capability information from the A-IoT device 610 through the first network element 620, wherein the security capability information includes security capability parameters of the A-IoT device 610.

[0559] In some embodiments, the security capability query information includes at least one of the following: authentication query information, encryption query information, integrity protection query information, key capability query information, and security context storage capability query information;

[0560] Among them, the authentication query information is used to query whether the A-IoT device 610 supports the authentication function, or the authentication query information is used to query the authentication algorithm supported by the A-IoT device 610, the encryption query information is used to query whether the A-IoT device 610 supports the encryption function, or the encryption query information is used to query the encryption algorithm supported by the A-IoT device 610, the integrity protection query information is used to query whether the A-IoT device 610 supports the integrity protection function, or the integrity protection query information is used to query the integrity protection algorithm supported by the A-IoT device 610, the key capability query information is used to query the key length supported by the A-IoT device 610, and the security context storage capability query information is used to query whether the A-IoT device 610 supports the security context storage function.

[0561] In some embodiments, the security capability query information is carried by an inventory command, or the security capability query information is carried by a security capability query message.

[0562] In some embodiments, part or all of the information sent by the first network element 620 to the A-IoT device 610 is accompanied by an excitation signal for powering the A-IoT device 610 .

[0563] In some embodiments, when the first response information is used to indicate that the A-IoT device 610 rejects the first information or the configuration or activation of the first information fails, the first network element 620 is also used to close or deconfigure or deactivate the security communication function with the A-IoT device 610; or, the second network element 630 is also used to close or deconfigure or deactivate the security communication function with the first network element 620, and the first network element 620 closes or deconfigures or deactivates the security communication function with the A-IoT device 610.

[0564] In some embodiments, when the first response information indicates that the A-IoT device 610 rejects the first information or the configuration or activation of the first information fails, the first network element 620 is further used to send the second information to the A-IoT device 610, and the first network element 620 is further used to receive the second response information from the A-IoT device 610; or, the second network element 630 is further used to send the second information to the A-IoT device 610 through the first network element 620, and the second network element 630 is further used to receive the second response information from the A-IoT device 610 through the first network element 620;

[0565] The second information is used to: configure or activate the second security parameter set, or to deconfigure or deactivate the first security parameter set;

[0566] The second response information is a response to the second information;

[0567] The second security parameter set satisfies any one of the following:

[0568] Determined based on the security capability parameters of the A-IoT device 610;

[0569] Determined based on the security capability parameters of the A-IoT device 610 and the security capability parameters of the first network element 620;

[0570] Determined based on the security capability parameters of the A-IoT device 610, the security capability parameters of the first network element 620, and the security capability parameters of the second network element 630.

[0571] Therefore, in the embodiment of the present application, the first security parameter set satisfies any one of the following: determined based on the security capability parameters of the A-IoT device, determined based on the security capability parameters of the A-IoT device and the security capability parameters of the first network element, determined based on the security capability parameters of the A-IoT device, the security capability parameters of the first network element, and the security capability parameters of the second network element. That is, in the embodiment of the present application, the first network element or the second network element can at least determine the security parameter set to be configured or activated based on the security capability parameters of the A-IoT device, and negotiate with the A-IoT device to determine whether to activate the security parameter set, so that the secure communication function can be enabled as needed, and some security parameters can be enabled or activated as needed, thereby meeting the low power consumption requirements of the A-IoT device.

[0572] like Fig.17 As shown, an embodiment of the present application also provides a communication device 700, including a processor 701 and a memory 702, and the memory 702 stores programs or instructions that can be run on the processor 701. For example, when the communication device 700 is an A-IoT device, the program or instruction is executed by the processor 701 to implement the various steps performed by the A-IoT device in the above-mentioned security capability negotiation method embodiment, and can achieve the same technical effect. When the communication device 700 is a first network element, the program or instruction is executed by the processor 701 to implement the various steps performed by the first network element in the above-mentioned security capability negotiation method embodiment, and can achieve the same technical effect. When the communication device 700 is a second network element, the program or instruction is executed by the processor 701 to implement the various steps performed by the second network element in the above-mentioned security capability negotiation method embodiment, and can achieve the same technical effect. To avoid repetition, it will not be repeated here.

[0573] The embodiment of the present application also provides a terminal, including a processor and a communication interface, wherein the communication interface is coupled to the processor, and the processor is used to run a program or instruction to implement the following Figure 8 The steps performed by the first network element in the method embodiment shown. This terminal embodiment corresponds to the first network element side method embodiment described above, and each implementation process and implementation method of the above method embodiment can be applied to the terminal embodiment and can achieve the same technical effect. Specifically, Fig.18 A schematic diagram of the hardware structure of a terminal for implementing an embodiment of the present application.

[0574] The terminal 800 includes but is not limited to: a radio frequency unit 801, a network module 802, an audio output unit 803, an input unit 804, a sensor 805, a display unit 806, a user input unit 807, an interface unit 808, a memory 809 and at least some of the components of a processor 810.

[0575] Those skilled in the art will appreciate that the terminal 800 may also include a power source (such as a battery) for supplying power to various components, and the power source may be logically connected to the processor 810 through a power management system, thereby implementing functions such as managing charging, discharging, and power consumption management through the power management system. Fig.18 The terminal structure shown in the figure does not constitute a limitation on the terminal. The terminal may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently, which will not be described in detail here.

[0576] It should be understood that in the embodiment of the present application, the input unit 804 may include a graphics processing unit (GPU) 8041 and a microphone 8042, and the graphics processor 8041 processes the image data of a static picture or video obtained by an image capture device (such as a camera) in a video capture mode or an image capture mode. The display unit 806 may include a display panel 8061, and the display panel 8061 may be configured in the form of a liquid crystal display, an organic light emitting diode, etc. The user input unit 807 includes a touch panel 8071 and at least one of other input devices 8072. The touch panel 8071 is also called a touch screen. The touch panel 8071 may include two parts: a touch detection device and a touch controller. Other input devices 8072 may include, but are not limited to, a physical keyboard, function keys (such as volume control keys, switch keys, etc.), a trackball, a mouse, and a joystick, which will not be repeated here.

[0577] In the embodiment of the present application, after receiving downlink data from the network side device, the radio frequency unit 801 can transmit the data to the processor 810 for processing; in addition, the radio frequency unit 801 can send uplink data to the network side device. Generally, the radio frequency unit 801 includes but is not limited to an antenna, an amplifier, a transceiver, a coupler, a low noise amplifier, a duplexer, etc.

[0578] The memory 809 can be used to store software programs or instructions and various data. The memory 809 may mainly include a first storage area for storing programs or instructions and a second storage area for storing data, wherein the first storage area may store an operating system, an application program or instruction required for at least one function (such as a sound playback function, an image playback function, etc.), etc. In addition, the memory 809 may include a volatile memory or a non-volatile memory. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), a static random access memory (SRAM), a dynamic random access memory (DRAM), a synchronous dynamic random access memory (SDRAM), a double data rate synchronous dynamic random access memory (DDRSDRAM), an enhanced synchronous dynamic random access memory (ESDRAM), a synchronous link dynamic random access memory (SLDRAM) and a direct memory bus random access memory (DRRAM). The memory 809 in the embodiment of the present application includes but is not limited to these and any other suitable types of memory.

[0579] The processor 810 may include at least one processing unit; optionally, the processor 810 integrates an application processor and a modem processor, wherein the application processor mainly processes operations related to an operating system, a user interface, and application programs, and the modem processor mainly processes wireless communication signals, such as a baseband processor. It is understandable that the modem processor may not be integrated into the processor 810.

[0580] The radio frequency unit 801 is used to send first information to the A-IoT device, wherein the first information is used to configure or activate a first security parameter set; the radio frequency unit 801 is also used to receive first response information from the A-IoT device, wherein the first response information is a response to the first information;

[0581] The first security parameter set satisfies any of the following:

[0582] Determined based on the security capability parameters of the A-IoT device;

[0583] Determined based on the security capability parameters of the A-IoT device and the security capability parameters of the terminal 800;

[0584] Determined based on the security capability parameters of the A-IoT device, the security capability parameters of the terminal 800 and the security capability parameters of the second network element;

[0585] Among them, the second network element communicates with the A-IoT device through the terminal 800.

[0586] It can be understood that the implementation process of each implementation method mentioned in this embodiment can refer to the relevant description of the method embodiment and achieve the same or corresponding technical effect. To avoid repetition, it will not be repeated here.

[0587] The embodiment of the present application also provides a network side device, including a processor and a communication interface, wherein the communication interface is coupled to the processor, and the processor is used to run a program or instruction to implement the following Figure 8 The network side device embodiment may correspond to the first network element or second network element side method embodiment described above, and each implementation process and implementation mode of the method embodiment described above may be applicable to the network side device embodiment and may achieve the same technical effect.

[0588] Specifically, the embodiment of the present application also provides a network side device. Fig.19 As shown, the network side device 900 includes: an antenna 91, a radio frequency device 92, a baseband device 93, a processor 94 and a memory 95. The antenna 91 is connected to the radio frequency device 92. In the uplink direction, the radio frequency device 92 receives information through the antenna 91 and sends the received information to the baseband device 93 for processing. In the downlink direction, the baseband device 93 processes the information to be sent and sends it to the radio frequency device 92. The radio frequency device 92 processes the received information and sends it out through the antenna 91.

[0589] The method executed by the network-side device in the above embodiment may be implemented in the baseband device 93, which includes a baseband processor.

[0590] The baseband device 93 may include, for example, at least one baseband board, on which at least two chips are arranged. Fig.19 As shown, one of the chips is, for example, a baseband processor, which is connected to the memory 95 through a bus interface to call the program in the memory 95 to execute the operations performed by the first network element shown in the above method embodiment.

[0591] The network side device may further include a network interface 96, which is, for example, a Common Public Radio Interface (CPRI).

[0592] Specifically, the network side device 900 of the embodiment of the present application further includes: instructions or programs stored in the memory 95 and executable on the processor 94, and the processor 94 calls the instructions or programs in the memory 95 to execute. Fig.15 The methods executed by the units shown achieve the same technical effects, and therefore will not be described here in detail to avoid repetition.

[0593] Specifically, the embodiment of the present application also provides a network side device. Fig. 20 As shown, the network side device 1000 includes: a processor 1001, a network interface 1002 and a memory 1003. The network interface 1002 is, for example, a common public radio interface (CPRI).

[0594] Specifically, the network side device 1000 of the embodiment of the present application also includes: instructions or programs stored in the memory 1003 and executable on the processor 1001. The processor 1001 calls the instructions or programs in the memory 1003 to execute the method executed by the second network element and achieves the same technical effect. To avoid repetition, it will not be repeated here.

[0595] An embodiment of the present application also provides a readable storage medium, on which a program or instruction is stored. When the program or instruction is executed by a processor, the various processes of the above-mentioned security capability negotiation method embodiment are implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0596] The processor is the processor in the A-IoT device or the first network element described in the above embodiment. The readable storage medium includes a computer-readable storage medium, such as a computer read-only memory ROM, a random access memory RAM, a magnetic disk or an optical disk. In some examples, the readable storage medium may be a non-transient readable storage medium.

[0597] An embodiment of the present application further provides a chip, which includes a processor and a communication interface, wherein the communication interface is coupled to the processor, and the processor is used to run programs or instructions to implement the various processes of the above-mentioned security capability negotiation method embodiment, and can achieve the same technical effect. To avoid repetition, it will not be repeated here.

[0598] It should be understood that the chip mentioned in the embodiments of the present application can also be called a system-level chip, a system chip, a chip system or a system-on-chip chip, etc.

[0599] The embodiment of the present application further provides a computer program / program product, which is stored in a storage medium, and is executed by at least one processor to implement the various processes of the above-mentioned security capability negotiation method embodiment, and can achieve the same technical effect. To avoid repetition, it will not be repeated here.

[0600] An embodiment of the present application also provides a communication system, including: an A-IoT device, a first network element, and a second network element, wherein the A-IoT device can be used to execute the steps performed by the A-IoT device in the security capability negotiation method as described above, the first network element can be used to execute the steps performed by the first network element in the security capability negotiation method as described above, and the second network element can be used to execute the steps performed by the second network element in the security capability negotiation method as described above.

[0601] It should be noted that, in this article, the terms "comprise", "include" or any other variant thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises one..." does not exclude the presence of other identical elements in the process, method, article or device including the element. In addition, it should be pointed out that the scope of the method and device in the embodiment of the present application is not limited to performing functions in the order shown or discussed, and may also include performing functions in a substantially simultaneous manner or in reverse order according to the functions involved, for example, the described method may be performed in an order different from that described, and various steps may also be added, omitted or combined. In addition, the features described with reference to certain examples may be combined in other examples.

[0602] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of a computer software product plus a necessary general hardware platform, and of course, can also be implemented by hardware. The computer software product is stored in a storage medium (such as ROM, RAM, disk, CD, etc.), including several instructions to enable a terminal or a network-side device to execute the methods described in each embodiment of the present application.

[0603] The embodiments of the present application are described above in conjunction with the accompanying drawings, but the present application is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the guidance of the present application, ordinary technicians in this field can also make many forms of implementation methods without departing from the purpose of the present application and the scope of protection of the claims, and these implementation methods are all within the protection of the present application.

Claims

1. A security capability negotiation method, characterized in that: include: The A-IoT device receives first information from the first network element, wherein the first information is used to configure or activate a first security parameter set; In response to the first information, the A-IoT device sends a first response message to the first network element; The first security parameter set satisfies any of the following: Determined based on the security capability parameters of the A-IoT device; Determined based on the security capability parameters of the A-IoT device and the security capability parameters of the first network element; Determined based on the security capability parameters of the A-IoT device, the security capability parameters of the first network element, and the security capability parameters of the second network element; Among them, the second network element communicates with the A-IoT device through the first network element.

2. The method according to claim 1, characterized in that The security capability parameters of the A-IoT device include at least one of the following: The device identifier or group identifier of the A-IoT device; A first indication, used to indicate whether the A-IoT device supports or does not support the authentication function; The authentication algorithm supported by the A-IoT device; A second indication, used to indicate whether the A-IoT device supports or does not support an encryption function; The encryption algorithm supported by the A-IoT device; A third indication, used to indicate whether the A-IoT device supports or does not support the integrity protection function; The integrity protection algorithm supported by the A-IoT device; The key length supported by the A-IoT device; A fourth indication, used to indicate that the A-IoT device supports or does not support a security context storage function; An index of at least one security parameter set supported by the A-IoT device; The at least one security parameter set includes the first security parameter set.

3. The method according to claim 2, characterized in that In a case where the security capability parameter of the A-IoT device includes an index of at least one security parameter set supported by the A-IoT device, the first security parameter set is determined based on the index of the at least one security parameter set.

4. The method according to claim 2 or 3, characterized in that: Each security parameter set in the at least one security parameter set is determined based on a combination of at least one of the following: the first instruction; The authentication algorithm supported by the A-IoT device; the second instruction; The encryption algorithm supported by the A-IoT device; said third instruction; The integrity protection algorithm supported by the A-IoT device; The key length supported by the A-IoT device; The fourth instruction.

5. The method according to any one of claims 1 to 4, characterized in that The security capability parameters of the A-IoT device come from the second network element.

6. The method according to any one of claims 1 to 5, characterized in that Before the A-IoT device receives the first information from the first network element, the method further includes: The A-IoT device receives security capability query information from the first network element; The A-IoT device sends security capability information to the first network element, wherein the security capability information includes security capability parameters of the A-IoT device.

7. The method according to claim 6, characterized in that The security capability query information includes at least one of the following: authentication query information, encryption query information, integrity protection query information, key capability query information, and security context storage capability query information; Among them, the authentication query information is used to query whether the A-IoT device supports the authentication function, or the authentication query information is used to query the authentication algorithm supported by the A-IoT device, the encryption query information is used to query whether the A-IoT device supports the encryption function, or the encryption query information is used to query the encryption algorithm supported by the A-IoT device, the integrity protection query information is used to query whether the A-IoT device supports the integrity protection function, or the integrity protection query information is used to query the integrity protection algorithm supported by the A-IoT device, the key capability query information is used to query the key length supported by the A-IoT device, and the security context storage capability query information is used to query whether the A-IoT device supports the security context storage function.

8. The method according to claim 6 or 7, characterized in that: The security capability query information is carried by an inventory command, or the security capability query information is carried by a security capability query message.

9. The method according to any one of claims 6 to 8, characterized in that The security capability query information is generated by the first network element, and the security capability information is decoded and processed by the first network element; or, The security capability query information is acquired from the second network element through the first network element, and the security capability information is forwarded to the second network element through the first network element and decoded and processed by the second network element.

10. The method according to any one of claims 1 to 9, characterized in that Part or all of the information received by the A-IoT device from the first network element is accompanied by an excitation signal for powering the A-IoT device.

11. The method according to any one of claims 1 to 10, characterized in that The first information is generated by the first network element, and the first response information is decoded and processed by the first network element; or, The first information is acquired from the second network element by the first network element, and the first response information is forwarded to the second network element by the first network element and decoded and processed by the second network element.

12. The method according to any one of claims 1 to 11, characterized in that In the case where the first response information is used to indicate that the A-IoT device rejects the first information or that the configuration or activation of the first information fails, the method further includes: The A-IoT device determines to close, deconfigure, or deactivate a secure communication function with the first network element.

13. The method according to any one of claims 1 to 12, characterized in that In a case where the first response information indicates that the A-IoT device rejects the first information or configuration or activation of the first information fails, the method further includes: The A-IoT device receives second information from the first network element, wherein the second information is used to: configure or activate a second security parameter set, or to deconfigure or deactivate the first security parameter set; In response to the second information, the A-IoT device sends a second response information to the first network element; The second security parameter set satisfies any one of the following: Determined based on the security capability parameters of the A-IoT device; Determined based on the security capability parameters of the A-IoT device and the security capability parameters of the first network element; Determined based on the security capability parameters of the A-IoT device, the security capability parameters of the first network element, and the security capability parameters of the second network element.

14. The method according to claim 13, characterized in that The second information is generated by the first network element, and the second response information is decoded and processed by the first network element; or, The second information is acquired from the second network element through the first network element, and the second response information is forwarded to the second network element through the first network element and decoded and processed by the second network element.

15. A security capability negotiation method, characterized in that: include: The first network element sends first information to an ambient Internet of Things A-IoT device, wherein the first information is used to configure or activate a first security parameter set; The first network element receives first response information from the A-IoT device, wherein the first response information is a response to the first information; The first security parameter set satisfies any of the following: Determined based on the security capability parameters of the A-IoT device; Determined based on the security capability parameters of the A-IoT device and the security capability parameters of the first network element; Determined based on the security capability parameters of the A-IoT device, the security capability parameters of the first network element, and the security capability parameters of the second network element; Among them, the second network element communicates with the A-IoT device through the first network element.

16. The method according to claim 15, characterized in that The security capability parameters of the A-IoT device include at least one of the following: The device identifier or group identifier of the A-IoT device; A first indication, used to indicate whether the A-IoT device supports or does not support the authentication function; The authentication algorithm supported by the A-IoT device; A second indication, used to indicate whether the A-IoT device supports or does not support an encryption function; The encryption algorithms supported by the A-IoT device; A third indication, used to indicate whether the A-IoT device supports or does not support the integrity protection function; The integrity protection algorithm supported by the A-IoT device; The key length supported by the A-IoT device; A fourth indication, used to indicate that the A-IoT device supports or does not support a security context storage function; An index of at least one security parameter set supported by the A-IoT device; The at least one security parameter set includes the first security parameter set.

17. The method according to claim 16, characterized in that In a case where the security capability parameter of the A-IoT device includes an index of at least one security parameter set supported by the A-IoT device, the first security parameter set is determined based on the index of the at least one security parameter set.

18. The method according to claim 16 or 17, characterized in that Each security parameter set in the at least one security parameter set is determined based on a combination of at least one of the following: the first instruction; The authentication algorithm supported by the A-IoT device; the second instruction; The encryption algorithms supported by the A-IoT device; said third instruction; The integrity protection algorithm supported by the A-IoT device; The key length supported by the A-IoT device; The fourth instruction.

19. The method according to any one of claims 15 to 18, characterized in that The security capability parameters of the A-IoT device come from the second network element.

20. The method according to any one of claims 15 to 19, characterized in that Before the first network element sends the first information to the A-IoT device, the method further includes: The first network element sends security capability query information to the A-IoT device; The first network element receives security capability information from the A-IoT device, wherein the security capability information includes security capability parameters of the A-IoT device.

21. The method according to claim 20, characterized in that The security capability query information includes at least one of the following: authentication query information, encryption query information, integrity protection query information, key capability query information, and security context storage capability query information; Among them, the authentication query information is used to query whether the A-IoT device supports the authentication function, or the authentication query information is used to query the authentication algorithm supported by the A-IoT device, the encryption query information is used to query whether the A-IoT device supports the encryption function, or the encryption query information is used to query the encryption algorithm supported by the A-IoT device, the integrity protection query information is used to query whether the A-IoT device supports the integrity protection function, or the integrity protection query information is used to query the integrity protection algorithm supported by the A-IoT device, the key capability query information is used to query the key length supported by the A-IoT device, and the security context storage capability query information is used to query whether the A-IoT device supports the security context storage function.

22. The method according to claim 20 or 21, characterized in that The security capability query information is carried by an inventory command, or the security capability query information is carried by a security capability query message.

23. The method according to any one of claims 20 to 22, characterized in that The security capability query information is generated by the first network element, and the security capability information is decoded and processed by the first network element; or, The security capability query information is acquired from the second network element through the first network element, and the security capability information is forwarded to the second network element through the first network element and decoded and processed by the second network element.

24. The method according to any one of claims 15 to 23, characterized in that Part or all of the information sent by the first network element to the A-IoT device is accompanied by an excitation signal for powering the A-IoT device.

25. The method according to any one of claims 15 to 24, characterized in that The first information is generated by the first network element, and the first response information is decoded and processed by the first network element; or, The first information is acquired from the second network element by the first network element, and the first response information is forwarded to the second network element by the first network element and decoded and processed by the second network element.

26. The method according to any one of claims 15 to 25, characterized in that In the case where the first response information is used to indicate that the A-IoT device rejects the first information or that the configuration or activation of the first information fails, the method further includes: The first network element shuts down, deconfigures, or deactivates a secure communication function with the A-IoT device.

27. The method according to any one of claims 15 to 26, characterized in that In a case where the first response information indicates that the A-IoT device rejects the first information or configuration or activation of the first information fails, the method further includes: The first network element sends second information to the A-IoT device, wherein the second information is used to: configure or activate a second security parameter set, or to deconfigure or deactivate the first security parameter set; The first network element receives second response information from the A-IoT device, wherein the second response information is a response to the second information; The second security parameter set satisfies any one of the following: Determined based on the security capability parameters of the A-IoT device; Determined based on the security capability parameters of the A-IoT device and the security capability parameters of the first network element; Determined based on the security capability parameters of the A-IoT device, the security capability parameters of the first network element, and the security capability parameters of the second network element.

28. The method according to claim 27, characterized in that The second information is generated by the first network element, and the second response information is decoded and processed by the first network element; or, The second information is acquired from the second network element through the first network element, and the second response information is forwarded to the second network element through the first network element and decoded and processed by the second network element.

29. A security capability negotiation method, characterized in that: Applied to a security capability negotiation system, the security capability negotiation system includes an A-IoT device, a first network element, a second network element, and an application server, wherein the second network element communicates with the A-IoT device through the first network element, and the method includes: The first network element sends first information to the A-IoT device, and the first network element receives first response information from the A-IoT device; or, The second network element sends first information to the A-IoT device through the first network element, and the second network element receives first response information from the A-IoT device through the first network element; The first information is used to configure or activate a first security parameter set, and the first response information is a response to the first information; The first security parameter set satisfies any of the following: Determined based on the security capability parameters of the A-IoT device; Determined based on the security capability parameters of the A-IoT device and the security capability parameters of the first network element; Determined based on the security capability parameters of the A-IoT device, the security capability parameters of the first network element, and the security capability parameters of the second network element.

30. The method according to claim 29, characterized in that The security capability parameters of the A-IoT device include at least one of the following: The device identifier or group identifier of the A-IoT device; A first indication, used to indicate whether the A-IoT device supports or does not support the authentication function; The authentication algorithm supported by the A-IoT device; A second indication, used to indicate whether the A-IoT device supports or does not support an encryption function; The encryption algorithms supported by the A-IoT device; A third indication, used to indicate whether the A-IoT device supports or does not support the integrity protection function; The integrity protection algorithm supported by the A-IoT device; The key length supported by the A-IoT device; A fourth indication, used to indicate that the A-IoT device supports or does not support a security context storage function; An index of at least one security parameter set supported by the A-IoT device; The at least one security parameter set includes the first security parameter set.

31. The method according to claim 30, characterized in that In a case where the security capability parameter of the A-IoT device includes an index of at least one security parameter set supported by the A-IoT device, the first security parameter set is determined based on the index of the at least one security parameter set.

32. The method according to claim 30 or 31, characterized in that Each security parameter set in the at least one security parameter set is determined based on a combination of at least one of the following: the first instruction; The authentication algorithm supported by the A-IoT device; the second instruction; The encryption algorithms supported by the A-IoT device; said third instruction; The integrity protection algorithm supported by the A-IoT device; The key length supported by the A-IoT device; The fourth instruction.

33. The method according to any one of claims 29 to 32, characterized in that In a case where the first network element sends the first information to the A-IoT device, and the first network element receives the first response information from the A-IoT device, the method further includes: The first network element obtains the security capability parameters of the A-IoT device from the application server through the second network element.

34. The method according to any one of claims 29 to 32, characterized in that Before the first network element sends the first information to the A-IoT device, the method further includes: The first network element sends security capability query information to the A-IoT device; The first network element receives security capability information from the A-IoT device, wherein the security capability information includes security capability parameters of the A-IoT device.

35. The method according to any one of claims 29 to 32, characterized in that In a case where the second network element sends the first information to the A-IoT device through the first network element, and the second network element receives the first response information from the A-IoT device through the first network element, the method further includes: The second network element obtains the security capability parameters of the A-IoT device from the application server.

36. The method according to any one of claims 29 to 32, characterized in that Before the second network element sends the first information to the A-IoT device through the first network element, the method further includes: The second network element sends security capability query information to the A-IoT device through the first network element; The second network element receives security capability information from the A-IoT device through the first network element, wherein the security capability information includes security capability parameters of the A-IoT device.

37. The method according to claim 34 or 36, characterized in that The security capability query information includes at least one of the following: authentication query information, encryption query information, integrity protection query information, key capability query information, and security context storage capability query information; Among them, the authentication query information is used to query whether the A-IoT device supports the authentication function, or the authentication query information is used to query the authentication algorithm supported by the A-IoT device, the encryption query information is used to query whether the A-IoT device supports the encryption function, or the encryption query information is used to query the encryption algorithm supported by the A-IoT device, the integrity protection query information is used to query whether the A-IoT device supports the integrity protection function, or the integrity protection query information is used to query the integrity protection algorithm supported by the A-IoT device, the key capability query information is used to query the key length supported by the A-IoT device, and the security context storage capability query information is used to query whether the A-IoT device supports the security context storage function.

38. The method according to claim 34, 36 or 37, characterized in that The security capability query information is carried by an inventory command, or the security capability query information is carried by a security capability query message.

39. The method according to any one of claims 29 to 38, characterized in that Part or all of the information sent by the first network element to the A-IoT device is accompanied by an excitation signal for powering the A-IoT device.

40. The method according to any one of claims 29 to 39, characterized in that In the case where the first response information is used to indicate that the A-IoT device rejects the first information or that the configuration or activation of the first information fails, the method further includes: The first network element shuts down, deconfigures or deactivates a secure communication function with the A-IoT device; or, The second network element turns off or deconfigures or deactivates the security communication function between itself and the first network element, and the first network element turns off or deconfigures or deactivates the security communication function between itself and the A-IoT device.

41. The method according to any one of claims 29 to 40, characterized in that In a case where the first response information indicates that the A-IoT device rejects the first information or configuration or activation of the first information fails, the method further includes: The first network element sends second information to the A-IoT device, and the first network element receives second response information from the A-IoT device; or, The second network element sends second information to the A-IoT device through the first network element, and the second network element receives second response information from the A-IoT device through the first network element; The second information is used to: configure or activate the second security parameter set, or to deconfigure or deactivate the first security parameter set; The second response information is a response to the second information; The second security parameter set satisfies any one of the following: Determined based on the security capability parameters of the A-IoT device; Determined based on the security capability parameters of the A-IoT device and the security capability parameters of the first network element; Determined based on the security capability parameters of the A-IoT device, the security capability parameters of the first network element, and the security capability parameters of the second network element.

42. A security capability negotiation device, characterized in that: include: A transceiver unit, configured to receive first information from a first network element, wherein the first information is used to configure or activate a first security parameter set; In response to the first information, the transceiver unit is further used to send first response information to the first network element; The first security parameter set satisfies any of the following: Determined based on the security capability parameters of the security capability negotiation device; Determined based on the security capability parameter of the security capability negotiation device and the security capability parameter of the first network element; Determined based on the security capability parameter of the security capability negotiation device, the security capability parameter of the first network element, and the security capability parameter of the second network element; The second network element communicates with the security capability negotiation device through the first network element.

43. A security capability negotiation device, characterized in that: include: A transceiver unit, configured to send first information to an ambient Internet of Things (A-IoT) device, wherein the first information is used to configure or activate a first security parameter set; The transceiver unit is further configured to receive first response information from the A-IoT device, wherein the first response information is a response to the first information; The first security parameter set satisfies any of the following: Determined based on the security capability parameters of the A-IoT device; Determined based on the security capability parameters of the A-IoT device and the security capability parameters of the security capability negotiation device; Determined based on the security capability parameters of the A-IoT device, the security capability parameters of the security capability negotiation device, and the security capability parameters of the second network element; Among them, the second network element communicates with the A-IoT device through the security capability negotiation device.

44. A security capability negotiation system, comprising an A-IoT device, a first network element, a second network element and an application server, wherein: The second network element communicates with the A-IoT device through the first network element; The first network element is used to send first information to the A-IoT device, and the first network element is used to receive first response information from the A-IoT device; or, The second network element is used to send first information to the A-IoT device through the first network element, and the second network element is used to receive first response information from the A-IoT device through the first network element; The first information is used to configure or activate a first security parameter set, and the first response information is a response to the first information; The first security parameter set satisfies any of the following: Determined based on the security capability parameters of the A-IoT device; Determined based on the security capability parameters of the A-IoT device and the security capability parameters of the first network element; Determined based on the security capability parameters of the A-IoT device, the security capability parameters of the first network element, and the security capability parameters of the second network element.

45. An A-IoT device, characterized in that: It comprises a transceiver, a processor and a memory, wherein the memory stores a program or instruction that can be run on the processor, and when the program or instruction is executed by the processor, the steps of the security capability negotiation method as described in any one of claims 1 to 14 are implemented.

46. ​​A first network element, characterized in that: It comprises a transceiver, a processor and a memory, wherein the memory stores a program or instruction that can be run on the processor, and when the program or instruction is executed by the processor, the steps of the security capability negotiation method as described in any one of claims 15 to 28 are implemented.

47. A readable storage medium, characterized in that The readable storage medium stores a program or instruction, and when the program or instruction is executed by the processor, it implements the steps of the security capability negotiation method as described in any one of claims 1-14, or implements the steps of the security capability negotiation method as described in any one of claims 15 to 28.

Images