Communication method and related device

Abstract

A communication method and a related device are applied to the technical field of communication. A second management node in the embodiment of the invention can receive a security communication parameter from a first management node, wherein the security communication parameter comprises a parameter used when the first management node is in communication connection with a terminal node and is associated with a security context of the terminal node. And the second management node performs an association operation with the security context with the terminal node according to the security communication parameter. Thus, the second management node can directly or indirectly use the communication security parameter to ensure the security of the interactive information in the association operation, on one hand, when the second management node and the terminal node perform the association operation, the second management node does not need to negotiate the security context with the terminal node again, signaling interaction is reduced, and the association time delay is reduced. And on the other hand, re-determination of security communication parameters, negotiation of security context and the like are not needed, the calculation amount of the terminal node and the second management node is reduced, and the time delay of connection establishment is further shortened.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to the field of short-range communication technology, such as communications in scenarios such as smart cars, smart homes, smart terminals and smart manufacturing, and specifically to a communication method and related devices. Background Art

[0002] With the continuous development of communication technology, smart application scenarios such as smart home, smart cockpit, smart driving, smart manufacturing, and smart transportation have emerged. In the era of mobile Internet, communication tools are more convenient to use than traditional computers, especially desktop workstations and servers.

[0003] As the interconnection between communication nodes becomes more and more common, the connections between communication nodes become more and more diverse. Taking the roaming scenario as an example, a station (STA) can access access point (AP) 1. As the STA moves, at another moment, the STA can access AP2, which is currently closer to it, thereby improving the connection stability and ensuring the transmission efficiency.

[0004] Before a communication node connects to a new communication node, for example, before a STA needs to establish a connection with AP2, it needs to go through handshake and authentication processes with the new communication node. These complex connection processes usually result in a relatively high latency for the communication node to connect to the new node. In order to ensure transmission efficiency and improve the stability of user services, various business scenarios have high requirements for the latency of establishing a connection with a new node. For example, in roaming scenarios, real-time applications, such as augmented reality (AR), online games, and online video conferencing, require the media access control (MAC) layer switching latency to be less than 50ms. For another example, the roaming latency requirement for automated guided vehicles (AGVs) is usually lower than 50ms.

[0005] How to reduce the delay of a communication node connecting to a new node is a hot issue that technicians in this field are currently studying. Summary of the invention

[0006] The embodiments of the present application provide a communication method and related devices, which can reduce the delay in establishing a communication connection while ensuring secure communication.

[0007] In a first aspect, an embodiment of the present application provides a communication method, the method comprising: receiving security communication parameters from a first management node, and performing an association operation with a terminal node having a security context based on the security communication parameters.

[0008] The method can be applied to the second management node. Among them, the security communication parameters include parameters used when the first management node is connected to the terminal node for communication, and the security communication parameters are associated with the security context of the terminal node. The aforementioned security context includes parameters for security protection of the communicated information, such as session keys, and further includes fresh parameters, key algorithms, or temporary identities used for security protection. The security communication parameters may include some or all of the parameters in the security context, or the security communication parameters may be used to generate some or all of the parameters in the security context. The associated operations with the security context include: using the parameters in the security context to securely protect the transmitted information (such as encryption, integrity protection, etc.), and the other end may also use the parameters in the security context to securely obtain the corresponding information. Among them, security protection includes one or more of encryption, integrity protection (abbreviated as integrity protection), or authenticated encryption, etc.

[0009] In an embodiment of the present application, when a terminal node is associated with a second management node, the secure communication parameters provided by the first management node can be used to perform an association operation with the terminal node with a secure context. That is, the communication security parameters are used directly or indirectly to ensure the security of the information exchanged in the association operation. On the one hand, the association operation between the second management node and the terminal can be performed without re-negotiating with the terminal node to obtain the security context, which can reduce the signaling in the authentication process, thereby reducing the delay in signaling interaction. On the other hand, there is no need to redetermine the secure communication parameters, negotiate the security context, etc., which can reduce the amount of calculation of the terminal node and the second management node, and further shorten the delay in establishing a connection.

[0010] Furthermore, the method further comprises: after establishing the association, performing data transmission with the second management node. Furthermore, during data transmission, secure communication parameters or a secure context may be used to perform security protection on the data.

[0011] In a possible implementation of the first aspect, the security context of the terminal node includes a key. The key here may include one or more of a shared key or a session key. Optionally, the session key may include one or more of an encryption key, an integrity protection key, an authentication encryption key, etc. Further, the encryption key may include a user plane encryption key, a signaling plane encryption key, etc. Alternatively, the encryption key may also include a unicast encryption key, a multicast encryption key, etc. Similarly, the integrity key may include a user plane integrity key, a signaling plane integrity key, etc., and / or the integrity key may include a unicast integrity key and a multicast integrity key. The authentication encryption key may also include the above-mentioned subdivided categories of keys, which are not described one by one here.

[0012] In a possible implementation of the first aspect, when the security context includes a key, the security context may also include key information, wherein the key information includes one or more of a key identifier, a key validity period, a key startup time, etc. Exemplarily, the security context includes a shared key, a shared key ID, and a shared key validity period. Of course, when there are multiple keys, the present application does not limit the presence of information about each key in the security context. For example, the security context may include a security key, but may not include the validity period of the security key.

[0013] In a possible implementation of the first aspect, the security context of the terminal node includes a fresh parameter. The fresh parameter is a parameter used in the security field, which is used to obtain a key or participate in a security protection process to improve security. The first fresh parameter and the second fresh parameter are exemplary fresh parameters. In some schemes, the first fresh parameter is used to derive a session key, and the second fresh parameter is used as a parameter used for security protection.

[0014] In a possible implementation of the first aspect, the security context of the terminal includes information about a security algorithm, such as indication information of the security algorithm. The security algorithm refers to an algorithm related to security protection, such as one or more of a key agreement algorithm, an encryption algorithm, a security algorithm, an authenticated encryption algorithm, a digest algorithm, a key derivation algorithm, etc.

[0015] Exemplarily, a possible terminal security context includes one or more of the following parameters: a shared key, a first fresh parameter, a session key, an identifier of a security algorithm, a first identity identifier of a terminal node, and a second fresh parameter, etc.

[0016] In another possible implementation of the first aspect, the second freshness parameter is determined by a first number and a second number, wherein the first number corresponds to a number of a protocol data unit (PDU), for example, the first number is the same as the number of the protocol data unit, or the first number is determined by the number of the protocol data unit.

[0017] The above embodiment is an example of a second fresh parameter. A protocol data unit is a data unit transmitted during communication, and its number changes as data transmission proceeds. Therefore, by determining the second fresh parameter by the number of the protocol data unit, the second fresh parameter can be updated as the number of the protocol transmission unit changes, thereby making the value of the second fresh parameter updateable. Since the second fresh parameter is encrypted / decrypted during communication, the second fresh parameter can be updated after one or several encryption / decryption, thereby improving the security of communication.

[0018] Optionally, the initial value of the second number is predetermined. The second number may be updated, for example, the second number is updated when the first number is flipped. Optionally, the second fresh parameter is determined by the first number and the second number, including: the second fresh parameter includes the first number and the second number.

[0019] Exemplarily, the second fresh parameter is N bits of data, wherein the first number contains M bits, and the second number contains L bits, wherein N, M, and L are non-negative integers. The number of bits occupied by the L bits of the second number is higher than the M bits of the first number, and when the M bits of the first number change from all 1 to all 0, the data represented by the L bits of the second number is increased by 1. Optionally, N=M+L.

[0020] Optionally, the second fresh parameter is a global frame number (GFN), and GFN includes a high frame number (HFN) and a serial number (serial number, or sequence number, SN). Optionally, the sequence number is the same as the number of the protocol data unit PDU, and the HFN is predetermined.

[0021] In a possible implementation manner of the first aspect, the second fresh parameter is a predefined parameter value, such as HFN. Further, the second fresh parameter can be updated by the number of the protocol data unit. For example, the second fresh parameter is updated when the SN flips.

[0022] In yet another possible implementation of the first aspect, the secure communication parameter is a security context of the terminal node.

[0023] In this implementation, the first management node can provide the security context of the terminal node obtained by itself to other nodes, so that the second management node can obtain the security context of the terminal node and obtain the security context of the terminal node that it should store, for example, using part or all of the parameters in the security context of the terminal node provided by the first management node as part or all of the parameters of the security context of the terminal node that it should store. For example, the second management node can use the session key between the first management node and the terminal node for communication encryption / decryption.

[0024] When the second management node establishes a connection with the terminal node, through the above implementation, it is no longer necessary to spend a lot of time negotiating and generating a security context, which greatly shortens the communication delay.

[0025] In another possible implementation of the first aspect, the secure communication parameter includes some parameters in the security context and / or includes parameters used to obtain some parameters in the security context. In this way, the second management node can obtain the security context of the terminal node based on the secure communication parameter and the parameters determined by itself.

[0026] Exemplarily, the secure communication parameter includes a key. The key can be directly used as a session key for security protection of the communication process. Or the key can be used to derive a session key.

[0027] Exemplarily, the secure communication parameter includes a shared key, and the method further includes:

[0028] The session key is obtained according to the shared key. Further, the session key derived by the second management node is included in the security context of the terminal node. Optionally, the security context also includes the shared key.

[0029] Optionally, fresh parameters, key identifiers, etc. may also be used when deriving the session key. For example, the secure communication parameters include the shared key Kgt and the first security parameter counter, and the second terminal node determines the user plane encryption key based on the shared key Kgt and the first security parameter counter and the identifier of the user plane encryption key.

[0030] Exemplarily, the secure communication parameter further includes an identifier of the shared key and a first freshness parameter, and obtaining the session key according to the shared key includes:

[0031] A session key is determined according to the shared key, the identifier of the shared key and the first fresh parameter.

[0032] Understandably, re-determining the secure communication parameters requires a negotiation process, which not only requires a lot of computation, but also takes a lot of computation and time to ensure the security of the negotiation process. The above implementation enables the second management node to determine the security context based on the secure communication parameters, and no longer needs to spend a lot of time negotiating and generating the security context, which greatly shortens the communication delay.

[0033] Exemplarily, the security communication parameters further include an identifier of a security algorithm and a first identity identifier of the terminal node.

[0034] In another possible implementation of the first aspect, the session key includes an integrity protection key. According to the secure communication parameter, an association operation with a security context is performed with the terminal node, including: receiving first information from the terminal node, the first information is integrity protected by the integrity protection key, and the integrity of the first information is checked according to the integrity protection key. In the case where the integrity of the first information is successfully checked, second information is sent to the terminal node. Optionally, the second information is used for the terminal node to establish an association with the second management node, and the second information is integrity protected by the integrity protection key.

[0035] In the above implementation, the terminal node and the first management node can use the security context to protect the integrity of the transmitted signaling, which can not only prevent the first information from being tampered with, but also authenticate each other's identity through integrity verification (only both ends with a security context can successfully verify the integrity), thereby improving communication security.

[0036] Optionally, the session key includes an encryption key, and the second information is encrypted by the encryption key.

[0037] In another possible implementation of the first aspect, the security context of the terminal includes a session key and an identifier of the first security algorithm. The first information includes first verification information, and the first verification information corresponds to the session key, the first information, and the first security algorithm. Checking the integrity of the second information according to the security context of the terminal node includes: verifying the first verification information according to the session key, the first information, and the first security algorithm. Exemplarily, the session key is an integrity protection key, and the identifier of the first security algorithm is an identifier of the first integrity protection algorithm.

[0038] In the above implementation, the terminal node can generate verification information through the session key and the first information, and the second management node can verify the verification information through the session key in the security context of the terminal node, thereby improving security. It can be seen that the terminal node and the second management node can communicate with integrity protection based on the session key without having to negotiate and determine the session key through interactive signaling, thereby reducing signaling overhead, reducing the amount of node calculation, and reducing the delay in connection establishment.

[0039] In another possible implementation of the first aspect, the security context includes a first identity of the terminal node, and the first information includes the first identity of the terminal node. The method further includes: acquiring the security context of the terminal node according to the first identity in the first information.

[0040] In the above implementation, the security context can correspond to the node's identity, and the node's identity can be used to manage the node to retrieve whether it has the terminal's security context, thereby facilitating the storage and management of the terminal's security context and improving the convenience of using the security context.

[0041] In another possible implementation of the first aspect, the method further includes: generating a second identity of the terminal node, and sending the second identity to the terminal node. Optionally, the identity is used to identify the terminal node, and the second identity is carried in the second information.

[0042] In the above implementation, the second management node can generate a new identity for the terminal node, namely the second identity, which is used to correspond to the terminal node. Updating the identity of the terminal node can prevent the fixed identity of the terminal from being leaked, improve the privacy of the terminal identity, and enhance communication security.

[0043] In another possible implementation of the first aspect, the second fresh parameter in the security context may be determined by the second management node. For example, the second fresh parameter may be predefined. For example, 128 bits are set to all 0, or a preset value is set.

[0044] In another possible implementation of the first aspect, the security context of the terminal node includes a second fresh parameter. The method further includes: determining the first number according to the number of the protocol data unit PDU from the terminal node, and determining the second fresh parameter according to the second number and the first number. The initial value of the second number is predetermined and the second number is updated when the first number is flipped.

[0045] The above describes a method for determining the second fresh parameter. The second fresh parameter is determined according to the second number and the first number, wherein the second number may be predefined, and the first number is determined according to the PDU from the terminal node.

[0046] On the one hand, the above method allows the second management node to use the second fresh parameter determined by itself for subsequent security protection, and avoids using the second fresh parameter (or second number) that is consistent with the first management node, thereby improving security. On the other hand, if the second fresh parameter determined by the first management node is used, since the PUD number will be updated after each transmission and the second number may also be updated, this will cause the second management node to receive the updated value of the second fresh parameter or part of the data in the second fresh parameter multiple times, increasing the transmission pressure of the node, while using the second fresh parameter determined by itself can reduce the transmission pressure of the second management node and save signaling overhead.

[0047] In another possible implementation of the first aspect, the method further includes: receiving parameter update information from the first management node, and updating some or all of the parameters in the security communication parameters according to the parameter update information. Wherein, updating some or all of the parameters in the security communication parameters may include updating some or all of the parameters in the security context.

[0048] In some scenarios, when the first management node updates the parameters in the communication parameters, it can instruct other nodes to update the security communication parameters through parameter update information, so that the second management node can use the latest and correct security context when connecting to the terminal node, thereby improving the success rate of connection establishment.

[0049] Exemplarily, the secure communication parameters of the terminal include a shared key, an identifier of the shared key, and a validity period of the shared key, and the parameter update information includes an updated shared key, a validity period of the updated shared key, and a validity period of the updated shared key.

[0050] Exemplarily, the secure communication parameters of the terminal include a first freshness parameter, and the parameter update information includes the updated first freshness parameter. Exemplarily, the secure communication parameters of the terminal include a second freshness parameter, and the parameter update information includes the updated second freshness parameter.

[0051] Exemplarily, the secure communication parameter of the terminal includes a portion of the second fresh parameter, and the parameter update information includes an updated portion of the second fresh parameter.

[0052] In another possible implementation of the first aspect, the first management node and the second management node are connected or indirectly connected, and the connection here can be wired or wireless. When the two are directly connected, the second management node can receive the security communication parameters sent by the first management node. The indirect connection can be connected through an intermediate node, and the intermediate node forwards the information between the two.

[0053] Exemplarily, receiving the secure communication parameter from the first management node includes: receiving the secure communication parameter forwarded via the control node, the control node being in communication connection with the first management node and the second management node. At this time, the control node acts as an intermediate node, the first management node can send the secure communication parameter to the control node, and the control node then provides the secure communication parameter to the second management node. It should be understood that the number of intermediate nodes can be one or more.

[0054] Optionally, the first management node and the terminal node are connected via a wireless communication link, and the first management node, the second management node and the AC are connected via a wired communication link.

[0055] In another possible implementation of the first aspect, the secure communication parameters are transmitted through messages that meet the CAPWAP protocol. The CAPWAP protocol provides security protection for the transmitted information, which can improve the privacy of the secure communication parameters. For example, the first management node can provide the secure communication parameters to the control node through the CAPWAP tunnel, and the control node also provides the secure communication parameters to the second management node through the CAPWAP tunnel.

[0056] In yet another possible implementation of the first aspect, the method further includes: in case of association failure, performing an association operation without a security context with the terminal node.

[0057] For example, when the second management node does not have the security context of the terminal node, the integrity protection key verification fails, and the second management node does not support fast secure connection, the second management node and the terminal node perform an association operation without a security context. At this time, the second management node needs to renegotiate with the terminal node to determine a new security context to establish an association.

[0058] In another possible implementation of the first aspect, the second management node is a node supporting a fast connection establishment method, wherein the fast connection establishment method is a method supporting association with the terminal node through secure communication parameters from other nodes, and the other nodes include the first management node and / or the control node.

[0059] In some scenarios, since the fast connection establishment can directly establish an association through the secure communication parameters of other nodes, this secure communication parameter may be used by multiple nodes, which may pose risks to management nodes with high security requirements or management nodes connected to external nodes. In the above implementation, the management node can be flexibly set to support fast connection establishment, so that the node that supports the fast connection establishment method can establish a communication connection with the terminal node with a secure context based on the secure communication parameters provided by other nodes, which enhances the personalized settings of the system, can be applied to systems containing complex node networks, and improves the user experience.

[0060] Furthermore, whether the second management node supports the fast connection establishment mode may be set by the user, determined by itself according to security risks, or configured by the management node. For example, the second management node reports one or more of its own security requirements or security capabilities, and the control node evaluates whether it has the conditions to support the fast connection establishment mode. When it meets the conditions to support the fast connection establishment, the security communication parameters from other nodes are forwarded to it.

[0061] In another possible implementation of the first aspect, the method further includes: sending a security communication parameter between the second management node and the terminal node to the control node. The security communication parameter between the second management node and the terminal node is used to obtain a security context of the terminal node. In this way, when other management nodes, such as the first management node, the third management node, etc., need to connect to the terminal node, the security context of the terminal node can be obtained through the security communication parameter between the second management node and the terminal node, thereby saving signaling overhead and reducing the delay in establishing a connection.

[0062] Optionally, when the second management node successfully establishes an association, a security communication parameter between the second management node and the terminal node is sent to the control node.

[0063] In yet another possible implementation of the first aspect, the method further includes: sending parameter update information to the control node, where the parameter update information is used to update a security communication parameter between the second management node and the terminal node.

[0064] In a second aspect, an embodiment of the present application provides a communication method, including: transmitting data with a first management node, and when a connection establishment condition is met, performing an association operation with a second management node with a security context, the second management node having a security context with a terminal node.

[0065] The first management node has a security context with the terminal node.

[0066] The method may be applied to a terminal node. Optionally, the security context of the terminal node in the second management node is associated with a security parameter provided by the first management node to the second management node.

[0067] In an embodiment of the present application, after the terminal node is connected to the first management node, it can be connected to the second management node with a security context of security context. For example, the first management node can provide security parameters to the second management node, so that the second management node can obtain the security context of the terminal node. On the one hand, the association operation can reduce the signaling in the authentication process without re-negotiating with the second management node to obtain the security context, thereby reducing the delay in signaling interaction. On the other hand, there is no need to re-determine the security communication parameters and negotiate the security context between the terminal node and the second management node, which can reduce the computational complexity of the terminal node and the second management node, further shortening the delay in establishing the connection.

[0068] Optionally, the method further includes: transmitting data with the second management node.

[0069] In a possible implementation manner of the second aspect, the connection establishment condition includes: receiving a roaming request from the first management node, where the roaming request instructs the terminal node to perform connection switching.

[0070] In another possible implementation of the second aspect, the method further includes: measuring the distances between the first management node and the second management node and the terminal node respectively, and the connection establishment condition includes: the distance between the second management node and the terminal node is less than the distance between the first management node and the terminal node.

[0071] It should be understood that the above distance can also replace other parameters related to communication quality, for example: the distance can also be replaced by evaluation data such as communication efficiency, channel quality, communication stability, and delay. The communication efficiency here can include the rate of transmitting data. Exemplarily, the connection establishment condition also includes: the communication efficiency between the second management node and the terminal node is higher than the communication efficiency between the first management node and the terminal node. The rest of the cases can be deduced by analogy, and no examples are given here one by one.

[0072] In yet another possible implementation of the second aspect, after performing an association operation with a security context with the second management node, the method further includes: disconnecting data transmission with the first management node.

[0073] The above describes a communication scenario in which the terminal node disconnects from the first management node after associating with the second management node. In other words, the terminal node roams from the first management node to the second management node.

[0074] In some scenarios, a terminal node may be connected to multiple nodes at the same time. When the terminal node is connected to a new management node, the method of the present application is also applicable.

[0075] In yet another possible implementation of the second aspect, the method further includes: receiving switching indication information from the first management node, where the switching indication information includes information indicating the second management node.

[0076] In this implementation, the first management node can indicate which second management node the terminal node is connected to, enabling the terminal node to establish an association with the second management node. In this way, operations such as calculation and evaluation can be concentrated on the first management node side, making it easier for the management node to manage the terminal node and improving the service quality of the management node.

[0077] In another possible implementation of the second aspect, the second management node is a node that supports a fast connection establishment method, and the fast connection establishment method is a method that supports associating with the terminal node through secure communication parameters from other nodes, and the other nodes include the first management node.

[0078] In another possible implementation of the second aspect, the security context of the terminal node includes an integrity protection key. Performing an association operation with the second management node having a security context includes: sending first information to the second management node, receiving second information from the second management node, and checking integrity of the first information according to the integrity protection key. When the integrity of the first information is successfully checked, the association is completed.

[0079] The first information is integrity protected by an integrity protection key, the second information is used for the terminal node to establish an association with the second management node, and the second information is integrity protected by an integrity protection key.

[0080] In yet another possible implementation of the second aspect, the method further includes: in case of association failure, performing an association operation without a security context with the terminal node.

[0081] In a third aspect, the embodiment of the present invention further provides a communication method, the method comprising: transmitting data with a terminal node, and providing a secure communication parameter between a second management node and the terminal node. The secure communication parameter is associated with a security context of the terminal node, and the secure communication parameter is used for an association process with a security context between the second management node and the terminal node.

[0082] Optionally, the method may be applied to a first management node, where the first management node has a security context of the terminal node, or the first management node has a security communication parameter with the terminal node.

[0083] In yet another possible implementation of the third aspect, the method further includes: sending parameter update information to the second management node, where the parameter update information is used to update part or all of the security communication parameters.

[0084] In another possible implementation of the third aspect, the second management node is connected to the control node, and sending security communication parameters between the second management node and the terminal node includes: sending security communication parameters between the second management node and the terminal node to the control node, and the control node is used to provide the security communication parameters between the second management node and the terminal node.

[0085] In another possible implementation of the third aspect, the second management node is connected to the control node, and sending the parameter update information to the second management node includes: sending the parameter update information to the control node, and the control node is used to provide the parameter update information to the second management node.

[0086] In yet another possible implementation of the third aspect, the method further includes: sending switching indication information to the terminal node, where the switching indication information includes information indicating the second management node.

[0087] In another possible implementation of the third aspect, the method also includes: receiving third information from a control node, the third information is used to indicate nodes that support a fast connection establishment method, the nodes that support the fast connection establishment method include a second management node, and the fast connection establishment method is a method that supports association with a terminal node through secure communication parameters from other nodes.

[0088] In a fourth aspect, the embodiment of the present invention further provides a communication method, the method comprising: receiving a security communication parameter between the first management node and the terminal node from the first management node, and sending the security communication parameter to the second management node. The security communication parameter is associated with the security context of the terminal node, and the security communication parameter is used for the second management node and the terminal node to perform an association process with a security context.

[0089] The method may be applied to a control node, where the control node is connected to a first management node and a second management node.

[0090] In a possible implementation of the fourth aspect, the method includes: receiving parameter update information from a first management node, and sending the parameter update information to a second management node, wherein the parameter update information is used to update some or all parameters in the security communication parameters.

[0091] In a possible implementation of the fourth aspect, the method further includes: sending third information to the first management node, the third information being used to indicate a node that supports a fast connection establishment method. The node that supports the fast connection establishment method includes a second management node, and the fast connection establishment method is a method that supports associating with a terminal node through secure communication parameters from other nodes.

[0092] In a possible implementation of the fourth aspect, the method includes: determining nodes among multiple nodes that support a fast connection establishment method based on security requirements of multiple management nodes and / or the degree of trust between the multiple management nodes and the first management node respectively, the multiple management nodes are connected to the control node, and the multiple management nodes include a second management node.

[0093] In a fifth aspect, an embodiment of the present application provides a communication device, the communication device comprising a communication unit and a processing unit. The communication device is used to implement any method of the first aspect; or to implement any method of the second aspect; or to implement any method of the third aspect; or to implement any method of the fourth aspect.

[0094] In a sixth aspect, an embodiment of the present application provides a communication device, the communication device comprising a processor. When the processor calls a computer program or instruction in a memory, the method of any one of the first aspect, or the method of any one of the second aspect, or the method of any one of the third aspect, or the method of any one of the fourth aspect is implemented.

[0095] It should be noted that the processor described in the sixth aspect above can be a processor specifically used to execute these methods (for convenience of distinction, it is called a dedicated processor), or it can be a processor that executes these methods by calling a computer program, such as a general-purpose processor.

[0096] Optionally, the computer program may be stored in a memory. Exemplarily, the memory may be a non-transitory memory, such as a read-only memory (ROM), which may be integrated with the processor on the same device or may be separately provided on different devices. The present application does not limit the type of memory and the manner in which the memory and the processor are provided.

[0097] In a possible implementation manner, the at least one memory is located outside the communication device.

[0098] In yet another possible implementation, the at least one memory is located within the communication device.

[0099] In yet another possible implementation, part of the at least one memory is located inside the communication device, and another part of the memory is located outside the communication device.

[0100] In the present application, the processor and the memory may also be integrated into one device, that is, the processor and the memory may also be integrated together.

[0101] In a seventh aspect, an embodiment of the present application provides a communication device, including a logic circuit and an interface, wherein the logic circuit and the interface are coupled;

[0102] The interface is used to input data to be processed, the logic circuit processes the data to be processed according to any one of the methods of the first aspect to the fourth aspect to obtain processed data, and the interface is used to output the processed data.

[0103] In an eighth aspect, an embodiment of the present application provides a computer-readable storage medium, which is used to store instructions or computer programs; when the instructions or computer programs are executed, any method of the first aspect is implemented, or any method of the second aspect is implemented, or any method of the third aspect is implemented, or any method of the fourth aspect is implemented.

[0104] In the ninth aspect, an embodiment of the present application provides a computer program product. When the instruction or computer program is executed, it implements any method of the first aspect, or implements any method of the second aspect, or implements any method of the third aspect, or implements any method of the fourth aspect.

[0105] In the tenth aspect, an embodiment of the present application provides a terminal, which includes the communication device of any one of the fifth to seventh aspects. Furthermore, the terminal can be an intelligent terminal or a means of transportation such as a vehicle, a robot, a drone, a ship, a ship, etc. Among them, the vehicle is a vehicle in a broad sense, which can be a means of transportation (such as a commercial vehicle, a passenger car, a motorcycle, a flying car, a train, etc.), an industrial vehicle (such as a forklift, a trailer, a tractor, etc.), an engineering vehicle (such as an excavator, a bulldozer, a crane, etc.), an agricultural equipment (such as a mower, a harvester, etc.), etc. For another example, the robot can be an intelligent handling robot (automated guided vehicle, AGV), a walkable conversational robot, a service robot, and other robots.

[0106] In an eleventh aspect, an embodiment of the present application provides a communication system, which includes a second management node, a first management node and a terminal node.

[0107] Among them, the second management node is used to implement any method of the first aspect; the terminal node is used to implement any method of the second aspect; and the first management node is used to implement any method of the third aspect.

[0108] Optionally, the communication system further includes a control node, which is used to implement any method of the fourth aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0109] The following is a brief introduction to the drawings required for describing the embodiments.

[0110] Figure 1 is a schematic diagram of a communication scenario of a communication system provided in an embodiment of the present application;

[0111] Figure 2A is a possible topology diagram of a communication system;

[0112] Figure 2B is another possible topology diagram of the communication system;

[0113] Figure 3 is a schematic diagram of information included in a security context provided by an embodiment of the present application;

[0114] Figure 4 It is a schematic diagram of a key system;

[0115] Figure 5It is a schematic diagram of an association process without a security context;

[0116] Figure 6 It is a schematic diagram of an associated process with a security context;

[0117] Figure 7 It is a flow chart of a communication method provided in an embodiment of the present application;

[0118] Figure 8 is a schematic diagram of a GFN;

[0119] Fig. 9 It is a flowchart of another communication method provided in an embodiment of the present application;

[0120] Fig. 10A It is a flowchart of another communication method provided in an embodiment of the present application;

[0121] Fig. 10B It is a flowchart of another communication method provided in an embodiment of the present application;

[0122] Fig.11A It is a flowchart of another communication method provided in an embodiment of the present application;

[0123] Fig. 11B It is a flowchart of another communication method provided in an embodiment of the present application;

[0124] Fig. 12A It is a flowchart of another communication method provided in an embodiment of the present application;

[0125] Fig. 12B It is a flowchart of another communication method provided in an embodiment of the present application;

[0126] Fig.13 is a structural diagram of a communication device provided in an embodiment of the present application;

[0127] Fig.14 It is a structural diagram of another communication device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0128] The embodiments of the present application are described in detail below with reference to the accompanying drawings.

[0129] The following is an introduction to nodes. A node is a device with communication capabilities, including but not limited to one or more of user equipment, network equipment, industrial equipment, etc. Among them, user devices include handheld terminals, wearable terminals, transportation tools, vehicle-mounted devices, sensing devices, smart home devices, or leisure and entertainment devices, etc. Handheld terminals include but are not limited to mobile phones, tablets, or laptops, etc. Wearable devices include but are not limited to headphones, smart bracelets, smart watches, or smart glasses, etc. Transportation tools include but are not limited to vehicles, ships, aircraft, rail transit (such as subways, high-speed railways, etc.), or logistics robots (such as automated guided vehicles (AGVs), etc.), etc. Vehicle-mounted devices include but are not limited to domain controllers (DC), screens, microphones, speakers, electronic keys, keyless entry, start system controllers, battery management systems (BMS), battery packs, or batteries, etc. Sensing devices include but are not limited to cameras, radars, lidars, light sensors, temperature sensors, or humidity sensors, etc. Smart home devices include but are not limited to projectors, smart TVs, smart refrigerators, smart home gateways, or security equipment, etc. Leisure and entertainment equipment such as virtual reality (VR) equipment, mixed reality (MR) equipment, massage chairs, home theaters, game control equipment or 4D theater cabins, etc.

[0130] Network equipment includes but is not limited to routers, switches, or base stations, etc. Industrial equipment such as industrial robots or robotic arms, etc.

[0131] The nodes in the embodiments of the present application can be applied to various scenarios such as smart cars, smart homes, smart terminals, smart manufacturing, or smart exhibition halls. In some application scenarios or some network types, devices with similar communication capabilities may not be called nodes, but for the convenience of description, in the embodiments of the present application, devices with communication capabilities are collectively referred to as nodes.

[0132] See also Figure 1 , Figure 1 It is a schematic diagram of a communication scenario of a communication system provided in an embodiment of the present application. The communication system 10 includes a management node and a terminal node. The management node is such as a first management node 101 and a second management node 102, and the terminal node is such as a terminal node 103.

[0133] Among them, a management node refers to a node with communication capabilities and management capabilities. Management capabilities may include management capabilities in communication, such as nodes that can perform connection management, resource scheduling, and information security-related management. Exemplarily, a management node is a node that can send scheduling information. In some scenarios, a management node may also be called a G node, an access point, etc. It should be understood that management nodes and terminal nodes are exemplary names made to distinguish between communication nodes in a certain communication connection situation. During the specific implementation process, a node may be a terminal node or a management node. In some scenarios, a node even belongs to two or more communication systems at the same time, serving as a terminal node in some communication systems and as a management node in another communication system.

[0134] The terminal node is a node with communication capabilities, which can transmit services with the management node. In some scenarios, the terminal node can also be called a T-node. The terminal device can include user equipment (UE), such as barcodes, radio frequency identification (RFID), sensors, global positioning systems (GPS), laser scanners and other information sensing devices.

[0135] The first management node 101 can establish a communication connection with the terminal node 103 and perform service transmission. In order to ensure security, the service transmission between the first management node 101 and the terminal node 103 is protected by a key. Security can be further improved by adding fresh parameters in the security protection process. These keys, fresh parameters, and information such as the security algorithm used during security protection can form a security context and be stored in the first management node. Before performing service transmission, the first management node 101 needs to obtain the security context corresponding to the terminal node 103 to ensure the information security of the service transmission.

[0136] As the communication proceeds, in various scenarios, the terminal node 103 may have a need to establish a communication connection with the second management node 102. For example, in roaming scenarios, the terminal node is connected to multiple management nodes, the first management node fails, the first management node actively exits the network (such as node replacement, or network change, etc.). Figure 1 A possible roaming scenario is shown. The terminal node 103 may be movable. When it is about to leave the first management node 101 and approach the second management node 102, the terminal node 103 can establish a connection with the second management node 102 and optionally disconnect the communication connection with the first management node 101.

[0137] In order to ensure the security of data transmission between the terminal node 103 and the second management node 102, the two also need to first determine the key, fresh parameters, etc., and authenticate each other's identities. The first management node 101 can provide other nodes with the communication security parameters between it and the terminal node. This communication security parameter can include the security context corresponding to the terminal node determined by the first management node 101, and can also include part of the information in the security context, and can also include parameters that can be used to determine the security context. In short, the second management node can obtain the security context of the terminal node based on the communication security parameters. In this way, the second management node can implement the association operation with the security context, thereby establishing a connection for business transmission.

[0138] Considering some possible situations, if the second management node 102 does not have the security context of the terminal node 103, the terminal node 103 and the second management node 102 need to perform key negotiation through signaling interaction to determine the key, fresh parameters, etc., and authenticate each other's identities when establishing a connection. Since the negotiation of the key requires multiple signaling interactions and has privacy requirements, the two need to send and receive multiple signalings for authentication, which makes the communication connection between the terminal node 103 and the second management node 102 less efficient and has a higher latency.

[0139] In the embodiment of the present application, the second management node 102 can obtain the security context of the terminal node 103 in advance before association, so that the association operation with the terminal node 103 can be performed. On the one hand, the association operation can reduce the signaling in the authentication process without re-negotiating the security context with the terminal node 103, thereby reducing the delay of the signaling interaction. On the other hand, the need to renegotiate the security context can reduce the amount of calculation, further reducing the delay of the signaling interaction.

[0140] In addition, the second management node 102 and the first management node 101 may be communicatively connected, where the communication connection includes a direct connection, a connection through an intermediate node (eg, a control node), and the like.

[0141] Optionally, in Figure 1 In the solution shown, the connection between any two nodes can be wired, wireless, or a combination. For example, the first management node 101 and the second management node 102 are connected via a wired communication technology (including direct and wireless connection). Figure 1 The management node and the terminal are connected via wireless communication technology. Figure 1 Indicated by dotted line.

[0142] The communication method, communication device, communication system or node of the embodiment of the present application is applicable to a variety of networks, such as a wired communication network, a wireless communication network, or a network including a combination of wired communication and wireless communication. For example, the wireless communication network includes a network connected by the following communication technologies: SparkLink, 802.11b / g, Bluetooth, Zigbee, radio frequency identification technology (RFID), ultra-wideband (UWB) technology, or a wireless short-range communication system (such as a vehicle-mounted wireless short-range communication system), or the long-range connection technology may also include a communication technology based on Long Term Evolution (Long Term Evolution), a fifth generation mobile communication technology (5th generation mobile networks or 5th generation wireless systems, 5th-Generation, referred to as 5G or 5G technology), a global system for mobile communications (GSM), a general packet radio service (GPRS), a universal mobile telecommunications system (UMTS), and other wireless access type technologies. For example, the wired communication network includes a network connected by the following communication technologies: one or more of fiber optic connection technology, vehicle-mounted wired communication technology, controller area network (CAN), local interconnect network bus (LIN), CAN flexible data rate (CAN Flexible Data-Rate, CAN FD), or vehicle-mounted Ethernet.

[0143] As a possible example, Figure 2AA topological diagram of a possible communication system is shown, and the communication system 20A includes a T node and a G node. Among them, the G node manages a certain number of T nodes, and the G node is connected to these T nodes to jointly complete the communication function. In the process of the T node associating with the G node, the G node can obtain the security context of the T node. For example, the G node 201, which can be regarded as the first management node 101, can establish a connection with the T node 203 (which can be regarded as the terminal node 103), and the security context of the T node 203 can be stored in the G node 201. The G node 201 can provide security communication parameters to other G nodes, such as the G node 202 (which can be regarded as the second management node 102), and the security communication parameters can be used to obtain the security context of the T node 203 obtained by the G node 202. When the T node 203 needs to access the G node 202, the G node 202 can perform an access process with the T node 203 with a security context.

[0144] Optionally, the connection between G node 201 and G node 202 may be a wireless connection (eg Figure 2A The dotted line shown in the figure) can also be a wired connection, or a combination of an effective and wireless connection. As another possible example, Figure 2B A possible topology diagram of a communication system is shown, where the communication system 20B includes a T node, a G node, and a SparkLink-Access Controller (SL-AC). The relevant descriptions of the G and T nodes can be found in the above. Figure 2B In the embodiment, the G node 201 can provide the SL-AC node 204 with a security communication parameter, and the security communication parameter can be used to obtain the security context of the T node 203 associated with the G node 201. Figure 2B , SL-AC node 204 can be connected to one or more G nodes, and multiple SL-AC nodes can also be connected to each other. SL-AC node 204 can forward the security communication parameters provided by G node 201 to other G nodes to which it is connected or to other SL-AC nodes, such as SL-AC node 205. In the latter case, SL-AC node 205 can forward the security communication parameters to the G nodes to which it is connected, such as G node 202. In this way, G node 202 can receive security communication parameters from other G nodes, such as G node 201, and obtain the security context of the T node to which the other nodes are connected. Exemplarily, when T node 203 needs to access G node 202, G node 202 can perform an access process with a security context with T node 203.

[0145] Optionally, the SL-AC node may also be connected to other networks, where the other networks include but are not limited to the Internet or other networks of the same type.

[0146] The security context has been mentioned several times above, so let’s first introduce it here.

[0147] The security context refers to a set of information including parameters related to communication security, such as one or more of a key, a freshness parameter, a key negotiation parameter, information about a security algorithm, an identity of a terminal, etc. The information about a security algorithm includes one or more of indication information of a security algorithm, a version of a security algorithm, etc.

[0148] The parameters in the security context are introduced below. The key may include one or more of a shared key or a session key. A shared key is a key pre-shared with a terminal node. Optionally, when the security context includes a shared key, the security context also includes an identifier of the shared key and a validity period of the shared key. Among them, the identifier of the shared key is used to distinguish different shared keys. A session key refers to a key used to securely protect a communication session, including one or more of an encryption key, an integrity protection key, an authentication encryption key, etc. Further, an encryption key may include a user plane encryption key, or a signaling plane encryption key, etc. Alternatively, an encryption key may also include a unicast encryption key, a multicast encryption key, etc. Similarly, a security key may include a user plane security key, a signaling plane security key, etc., and / or, the security key may include a unicast security key, a multicast security key. The authentication encryption key may also include the above-mentioned subdivided categories of keys, which are not described one by one here.

[0149] Furthermore, in the case where the security context includes a key, the security context may also include key information, and the key information includes one or more of the key identification, key validity period, key startup time, etc. Exemplarily, the security context includes a shared key, a shared key ID, and a shared key validity period. Of course, when there are multiple keys, the present application does not limit the presence of information about each key in the security context. For example, the security context may include a security key, but may not include the validity period of the security key. After the shared key expires and is updated, the node derives a new security key based on the updated shared key and adds it to the security context, and the old security key may no longer be used.

[0150] Fresh parameters are parameters used in the security field to obtain keys or participate in the security protection process to improve security. Fresh parameters are usually updated after use to improve security. Fresh parameters include but are not limited to counter values, random numbers, frame numbers, etc. In some scenarios, NONCE is also commonly used as a fresh parameter. For example, the first fresh parameter and the second fresh parameter mentioned in some embodiments of the present application are exemplary fresh parameters. In some schemes, the first fresh parameter is used to derive a session key. For example, the secure communication parameter includes a shared key, and the session key can be derived from the first fresh parameter and the shared key. Of course, other parameters may also be used when deriving the key, which are not listed here. Exemplarily, the first fresh parameter may include a counter value (counter), and the value of the counter will be updated after each use, for example, it will increase by 1 after each use. The second fresh parameter is used as a parameter used for security protection. The second fresh parameter is used as an input to the cryptographic algorithm used for communication encryption. For example, when encrypting / decrypting transmitted information through a security context, the second fresh parameter can be used to improve security.

[0151] Key negotiation parameters are the inputs to the key negotiation algorithm used when negotiating keys.

[0152] Security algorithm refers to an algorithm related to security protection, such as one or more of the following: key negotiation algorithm, encryption algorithm, integrity algorithm, authenticated encryption algorithm, digest algorithm, key derivation algorithm, etc. The indication information of the security algorithm refers to information that can indicate one or several security algorithms. Taking the encryption algorithm as an example, Table 1 shows a possible encryption algorithm identifier. The encryption algorithm is indicated by 2 bits of binary data. When the identifier is 00, it indicates encryption algorithm 1; when the identifier is 01, it indicates encryption algorithm 2, and so on. Among them, encryption algorithms 1-4 are used to refer to encryption algorithms. In the specific implementation process, which algorithms are referred to can be designed according to the needs, and the same is true for the integrity algorithm and authenticated encryption algorithm.

[0153] Table 1 Identification of encryption algorithms

[0154] Logo Indicates the encryption algorithm 00 Encryption algorithm 1 01 Encryption Algorithm 2 10 Encryption Algorithm 3 11 Encryption Algorithm 4

[0155] The terminal node's identity is used to identify the terminal, and the identity can be used to distinguish different terminals. The identity here can be temporary or fixed. The temporary identity of the terminal node may be updated to improve security.

[0156] Exemplarily, the security context of the node of the terminal stored in the management node may include one or more of the following parameters: a shared key, a first fresh parameter, a session key, an identifier of a security algorithm, a first identity identifier of the terminal node, and a second fresh parameter, etc. Optionally, in the case where the security context includes a shared key, the security context may also include an identifier of the shared key and the validity period of the shared key. It should be understood that the number of the above-mentioned shared key, the first fresh parameter, the session key, the security algorithm, and the second fresh parameter may be multiple, and the scenarios used may also be different. For example, different session keys may be used in different communication modes. Exemplarily, the session key may include a unicast session key, a multicast session key (such as a group encryption key, a group security key, etc.), a broadcast session key, etc., and the security algorithm may include a unicast security algorithm, a multicast security algorithm, a broadcast security algorithm, etc., and the second fresh parameter includes a second fresh parameter for unicast, a second fresh parameter for multicast, etc. The remaining cases are no longer exemplified one by one.

[0157] See also Figure 3 , Figure 3 It is a schematic diagram of information included in a security context provided in an embodiment of the present application. The security context is a security context of a terminal node obtained by a management node, including: a fixed ID of the terminal node, a temporary ID of the terminal node, a shared key (for example, expressed as Kgt), a validity period of the shared key, an identifier of the shared key (for example, KgtID), indication information of a key negotiation algorithm, indication information of an encryption algorithm of the signaling plane, indication information of an integrity protection algorithm of the signaling plane, an encryption key of the signaling plane, an integrity protection key of the signaling plane, indication information of an encryption algorithm of the user plane, indication information of an integrity protection algorithm of the user plane, indication information of an authentication encryption algorithm of the user plane, an encryption key of the user plane, an integrity protection key of the user plane, an authentication encryption key of the user plane, a key deduction counter counter, COUNTERg, a global frame number (GFN), a group key (for example, expressed as GK), an identifier of GK (GKID), a group algorithm (Galgorithm), a validity period of the group key (GK expiration), and a group global frame number (groupglobalframe number, GGFN).

[0158] In some possible implementations, there is a correlation between the parameters in the security context, for example, an encryption key, a security key, etc. can be obtained through a shared key. Figure 4A schematic diagram of a key system is shown. Among them, KEt and KEg are key negotiation parameters exchanged by the two communicating parties during key negotiation, which are respectively referred to as the first key negotiation parameter (i.e., KEt) and the second key negotiation parameter (KEg) in some schemes. Taking the negotiation of keys between GT nodes as an example, KEt is the parameter provided by the T node, and KEg is the parameter provided by the g node. Through the first key negotiation parameter and the second key negotiation parameter, the two communicating parties can negotiate the key K KE Further, a shared key such as shared key kgt may be based on key K KE For example, through the key K KE The shared key is obtained with the fresh parameters, such as the third fresh parameter NONCEt and the fourth fresh parameter NONCEg. Similarly, NONCEt may be a parameter provided by the T node, and NONCEg may be a parameter provided by the G node.

[0159] In addition, it should be noted that although kgt is referred to as a shared key in some embodiments of the present application, as explained above, a shared key refers to a key shared with another node. Therefore, in some scenarios Figure 4 The key K shown KE , Kmid, signaling plane encryption key Ks.enc, signaling plane integrity protection key Ks.int, user plane encryption key Ku.enc, user plane integrity protection key Ku.int or user plane encryption key Ku.ac, etc. can also be used as shared keys.

[0160] In some possible implementations, the session key may be a shared key (eg, kgt, K KE or Kmid). Figure 4 As shown, the key Kmid can be derived based on the shared key kgt and the counter counter, wherein the counter counter is regarded as a fresh parameter and is updated after obtaining Kmid, so that different keys Kmid can be derived multiple times based on the shared key and counter. Furthermore, multiple session keys can be obtained based on the key Kmid and the algorithm identifier. Exemplarily, the signaling plane encryption key Ks.enc can be obtained based on the key Kmid and the algorithm identifier "signalling enc". Another exemplary method is to obtain the signaling plane encryption key Ku.int based on the key Kmid and the algorithm identifier "signallingint". Of course, the keys Kmid used in these two examples may be different. For other keys, see Figure 4 , which will not be explained one by one here.

[0161] The following is an exemplary association process. Specifically, association refers to the process in which two nodes obtain a consistent communication key and establish a connection. In some scenarios, the association between a terminal node and a management node can also be called the terminal node accessing the management node.

[0162] See also Figure 5 , Figure 5 It is a schematic diagram of an association process without a security context, which includes authentication and security context processes. For ease of distinction, the messages (or information) exchanged during the association process are represented as M1-M5 below. Before this association process, there is no security context in the terminal node and the management node, and no session key is negotiated, so there is no security context. When associating, the terminal node sends a message M1, which includes the terminal node ID, the first key negotiation parameter, and the third fresh parameter. The management node determines the second key negotiation parameter and the fourth fresh parameter, and determines the first key based on the first key negotiation parameter and the second key negotiation parameter. Furthermore, the management node can determine the first key based on the first key (such as the key K KE ), the third fresh parameter and the fourth fresh parameter determine the second key (such as key Kgt). Optionally, the management node can derive a session key based on the second key (or the first key) for security protection of the message. The management node provides the second key negotiation parameter and the fourth fresh parameter to the terminal node through a message M2, and the optional message M2 carries authentication information (i.e., the first authentication information) for verifying the key, identity, or message integrity.

[0163] The terminal node obtains the first key, or the second key, in the same way. Furthermore, the terminal node also derives a session key based on the second key (or the first key) to protect the subsequent messages. In this way, the terminal node and the management node negotiate to obtain a consistent key. The terminal node can further generate a second authentication information and send it to the management node in a message M3. The management node verifies the second authentication information. If the verification is successful, the management node sends a message M4 to the terminal node to complete the association. The optional terminal node responds with a message M5, indicating that the association is complete.

[0164] It should be understood that in the specific implementation process, the association process may exchange more messages, or the message may carry more or fewer parameters. For example, the third fresh parameter and the fourth fresh parameter may not be carried, and the second key may be obtained according to the first key and the counter when the second key is obtained. For another example, the first authentication information or the second authentication information may not be carried. For another example, the message M1 may optionally carry one or more of the security capabilities of the terminal node (used to indicate the security algorithm supported by the terminal node), the indication information of the key negotiation algorithm, etc. For another example, the message M2 may also carry the length of the authentication information, the length of the session key, the ID of the second key (or the ID of the first key), and the indication information of the security algorithm. For another example, the message M4 may also carry one or more of the temporary ID assigned by the terminal node to the management node, the validity period of the second key, the validity period of the first key, etc. In the case where the terminal node belongs to a communication group, the management node may also carry one or more of the group key of the communication group, the ID of the group key, the group security algorithm, the validity period of the group key, etc. in the message M4.

[0165] See also Figure 6 , Figure 6 This is a schematic diagram of an association process with a security context. For ease of distinction, the following messages (or information) are represented as M6-M8. Before the association process, the management node obtains the security context of the terminal node. The content of the association context can be found in the above, for example Figure 3 When associating, the terminal node sends a message M6 to the management node, carrying the identity of the terminal node (optionally a temporary identity or a fixed identity), as shown in FIG. Figure 6 The ID of the terminal node shown. Optionally, the message M6 may also carry an identifier of a shared key, such as a Kgt ID. Optionally, the message M6 may be integrity protected by an integrity protection key. The following description takes the message M6 after integrity protection as an example. If the message M6 is not integrity protected, the subsequent step of checking integrity may be skipped. Among them, integrity protection may be achieved by generating verification information of the message content in the message M6. The verification information may be carried in the message M6 and used to verify the integrity of part or all of the message content in the message M6.

[0166] The management node obtains the integrity protection key shared with the terminal node according to the identity of the terminal node, and checks the integrity of the message M6 according to the integrity protection key. If the management node successfully checks the integrity of the message M6, it sends a message M7, and an association is established between the management node and the terminal node. Optionally, if the management node successfully checks the integrity of the message M6, the management node can also assign a temporary ID to the terminal node. At this time, the message M7 can carry the new temporary ID assigned by the management node to the terminal node.

[0167] It is understandable that the integrity protection key may be included in the security context, and the aforementioned "checking the integrity of the associated message according to the integrity protection key" may also be replaced by "checking the integrity of the associated message according to the security context". Further, the security context may include indication information and the integrity protection key of the integrity protection algorithm, and the management node may check the integrity of the message M6 by using the integrity protection key and the specified integrity protection algorithm. Optionally, the integrity protection key here may be the integrity protection algorithm of the signaling plane.

[0168] Further, the management node uses the integrity protection algorithm of the signaling plane and the signaling plane integrity protection key Ks.int to perform integrity protection on the message M7. Optionally, when the signaling plane encryption protection is enabled, the management node may also use the encryption algorithm of the signaling plane and the encryption key Ks.enc of the signaling plane to perform encryption protection on the message M7.

[0169] The optional terminal node responds with a message M8, indicating that the association is complete. In some scenarios, if the message M7 is encrypted, the terminal node decrypts the message M7. If the message M7 is integrity protected, the terminal node verifies the integrity of the message M7. If the integrity verification passes, the association is complete, and the terminal node can send a message M8 to the management node.

[0170] The method of the embodiment of the present application is introduced below.

[0171] See also Figure 7 , Figure 7 is a flow chart of a communication method provided in an embodiment of the present application. Optionally, the method may be based on Figure 1 , Figure 2A ,or Figure 2B The communication system described in one or more embodiments is implemented. Figure 7 The communication method shown may include step S701 and / or step S702. It should be understood that for the convenience of description, the order of S701 to S702 is used for description, and it is not intended to limit the execution to the above order. The embodiment of the present application does not limit the execution order, execution time, execution number, etc. of the above one or more steps. S701 to step S702 are as follows:

[0172] Step S701: The second management node receives security communication parameters from the first management node.

[0173] The secure communication parameters include parameters used when the first management node communicates with the terminal node, including at least one of a key, a fresh parameter, information about a security algorithm, a key negotiation parameter, etc. Further, the secure communication parameters also include information about a key, information about a fresh parameter, etc. Among them, the key includes but is not limited to a shared key and a session key, and the key information includes but is not limited to a key identifier, a key validity period, etc. The security algorithm information includes an identifier of the security algorithm, etc.

[0174] As a possible implementation, the secure communication parameter includes the security context of the terminal node, or the secure communication parameter is the security context of the terminal node. Specifically, the first management node has established a connection with the terminal, and the first management node has the security context of the terminal node associated with it. The first management node can provide the security context directly or indirectly to other nodes, such as the second management node.

[0175] As another possible implementation, the secure communication parameter includes a key. The key can be used to derive a session key, or the key can be directly used as a session key for security protection of the communication process. In this case, it can be considered that the secure communication parameter does not directly include all parameters in the security context of the terminal node, but only includes some of the parameters, or it can be considered that the second management node can obtain some or all parameters in the security context of the terminal node based on the secure communication parameter.

[0176] Exemplarily, the secure communication parameter may include a shared key, an identifier of the shared key, a validity period of the shared key, etc. Again exemplarily, the secure communication parameter may include a fresh parameter, such as one or more of a first fresh parameter, a second fresh parameter, and a fresh parameter NONCEg, etc. Again exemplarily, the secure communication parameter may include indication information of a security algorithm, such as indication information of a user plane encryption algorithm and indication information of a user plane integrity algorithm. Again exemplarily, the secure communication parameter may include an identity identifier of a terminal.

[0177] In some scenarios, the first management node can directly or indirectly provide secure communication parameters to the second management node. The method used to provide the second management node usually depends on the connection relationship between the first management node and the second management node, and further on whether the two can perceive each other. The following introduces several possible connection relationships between the second management node and the first management node:

[0178] Connection relationship 1: The first management node and the second management node are connected to the control node respectively. The first management node sends a secure communication parameter to the control node, and the secure communication parameter is forwarded by the control node and received by the second management node. For details, see Figure 2BIt should be noted that the number of control nodes is not limited here. Figure 2B In the architecture, when G node 201 provides security communication parameters to G node 202, the security communication parameters may be forwarded through two SL-AC nodes.

[0179] Optionally, when the first management node and the second management node are not directly connected, the first management node may or may not perceive the second management node. Perceiving the second management node refers to obtaining relevant information of the second management node, such as the communication group where the second management node is located, the ID of the second management node, or the communication address of the second management node. When providing secure communication parameters, if the first management node perceives the second management node, the first management node may specify to send the secure communication parameters to the second management node or the communication group where the second management node is located. At this time, the secure communication parameters or the message carrying the secure communication parameters may contain relevant information of the second management node.

[0180] Optionally, the second management node provided with security parameters may meet some conditions. That is, the control node may not provide security parameters to all connected (or perceived) management nodes. The following are some possible conditions that can be met by the management node that provides security parameters:

[0181] Condition 1: The second management node and the first management node belong to the same communication combination, and the communication combination includes multiple management nodes, and further includes one or more nodes such as control nodes or terminal nodes. The nodes in the communication combination trust each other, or in other words, only nodes that have passed trust verification (or identity verification) can join the communication combination. Nodes (or management nodes) in the same communication combination can provide each other with secure communication parameters. Furthermore, the communication combination can be further divided into multiple small combinations, and different small combinations are distinguished by small combination identifiers, that is, nodes with the same small combination identifier are in the same small combination. Management nodes in the same communication combination or the same small combination can provide each other with secure communication parameters. Nodes (or management nodes) in the same small combination can provide each other with secure communication parameters.

[0182] Exemplarily, the second management node and the first management node belong to the same extended service set (ESS). Further, the first management node and the first management node have the same service set identifier (SSID). In other words, the first management node can provide secure communication parameters to management nodes with the same SSID in the same ESS.

[0183] Optionally, the first management node here may also be replaced by a control node, that is, the second management node and the control node belong to the same communication group, or the second management node and the control node belong to the same small group.

[0184] Condition 2: A secure communication channel is established between the control node and the second management node. For example, the control node and the second management node are connected by wired communication, or a secure channel exists between the control node and the second management node. Exemplarily, the secure channel includes but is not limited to a transmission channel based on one or more of the following protocols: Secure Sockets Layer (SSL), Hypertext Transfer Protocol Secure (HTTPs), Transport Layer Security (TLS), Datagram Transport Layer Security (DTLS), etc.

[0185] Condition 3, the second management node supports fast connection establishment. Among them, fast connection establishment, or fast association, refers to the ability to establish a connection with a terminal node based on the security communication parameters provided by other nodes. Exemplarily, since the fast connection establishment can directly establish an association through the security communication parameters of other nodes, this security communication parameter may be used by multiple nodes, and there may be risks for management nodes with high security requirements or management nodes connected to external nodes. Therefore, the management node can pre-set security requirement information, which is used to indicate that it can quickly connect based on the security communication parameters of other management nodes (or management nodes that receive a certain security level).

[0186] Furthermore, whether the second management node supports the fast connection establishment mode may be set by the user, determined by itself according to security risks, or configured by the management node. For example, the second management node reports one or more of its own security requirements or security capabilities, and the control node evaluates whether it has the conditions to support the fast connection establishment mode. When it meets the conditions to support the fast connection establishment, the security communication parameters from other nodes are forwarded to it.

[0187] Condition 4: the second management node is the management node to which the terminal node is about to connect. For example, the terminal node selects or is designated to connect to the second management node, and the first management node or the control node can obtain indication information about the second management node and provide it with secure communication parameters.

[0188] It should be understood that the above conditions are only exemplary conditions, and there may be more or fewer conditions in the specific implementation process. Multiple conditions can also be combined. As an example of a combination, the first management node can provide security communication parameters to management nodes with the same SSID in the same ESS, and the nodes provided with security communication parameters support fast connection establishment.

[0189] The above is the relevant content under the first connection relationship, and the second exemplary connection relationship is further introduced below.

[0190] Connection relationship 2: The first management node and the second management node are directly connected. The first management node sends a secure communication parameter to the second management node, and correspondingly, the second management node receives the secure communication parameter from the first management node. For architecture, see Figure 2A .

[0191] Similarly, the first management node may not provide secure communication parameters to all connected management nodes. In this case, the second management node may be a node in the same communication group or communication subgroup as the first management node, or a secure communication channel is established between the two, or the second management node supports establishing an association based on the secure communication parameters of the first management node. For a specific description, please refer to the related introduction of conditions 1 to 4 above, which will not be described one by one here.

[0192] Of course, the above two situations are two exemplary connection situations. During the specific test process, there may be other connections between the two, which will not be explained one by one here.

[0193] In some solutions, the secure communication parameters can be sent through a secure channel. For example, a communication tunnel is established between the two ends of the secure communication parameters, or the two ends of the secure communication parameters are authenticated to ensure the security of the secure communication parameters during transmission.

[0194] As a possible implementation method, the secure communication parameters are transmitted through messages that meet the control and provisioning of wireless access points protocol specification (CAPWAP). CAPWAP is an application layer protocol based on the user datagram protocol (UDP) port. Messages transmitted through the CAPWAP protocol can be protected using the DTLS protocol, and the transmission channel that meets the CAPWAP protocol can also be called a CAPWAP tunnel.

[0195] For example, in combination Figure 2BThe architecture and connection relationship 1 are taken as an example. A CAPWAP tunnel is established between the first management node and the SL-AC, a CAPWAP tunnel is also established between the SL-ACs, and a CAPWAP tunnel is also established between the SL-AC and the second management node. Taking the security parameter as the security context of the terminal node as an example, the first management node provides the security context of its associated (optionally currently associated and / or previously associated) terminal node to the SL-AC through the CAPWAP tunnel, and the SL-ACs also transmit the security context through the CAPWAP tunnel. Furthermore, the SL-AC can provide the security context of the terminal node to the second management node through the CAPWAP tunnel.

[0196] In a possible implementation manner, there may be multiple possible designs for the timing or conditions for the first management node to send the security communication parameter.

[0197] For example, after the first management node establishes an association with the terminal node, it can synchronize the security communication parameters to other nodes (such as the second management node, the control node, etc.). For another example, after the first management node establishes an association, it sends the security communication parameters to other nodes when a subsequent condition is triggered.

[0198] For example, after the first management node establishes an association with the terminal node, it can synchronize the security communication parameters to other nodes (such as the second management node, the control node, etc.). For another example, the first management node provides security communication parameters to other nodes under a certain trigger condition. The trigger conditions here include but are not limited to: the terminal node has the need to establish a connection with other management nodes (such as roaming scenarios), the networking relationship changes according to regulation, or the first management node exits the network (such as node replacement), etc.

[0199] Optionally, when the first management node establishes an association with the terminal node, and when the first condition is met, the first management node provides the other nodes with a secure communication parameter. By way of example, several possible conditions are described below:

[0200] Condition 1: When triggering a connection switch, the first management node provides secure communication parameters to other nodes. Specifically, if the terminal node has a need to establish a connection with other management nodes (for example, in a roaming scenario), a connection switch is triggered. Exemplarily, the first management node sends a connection switch instruction to the terminal node to trigger a connection switch, and the connection switch instruction is used to instruct the terminal node to connect to a new management node. The connection switch instruction may include indication information of the second management node, so that the terminal node is associated with the second management node. As another example, the terminal node measures the distance to the management node, and the distance between it and the second management node is less than the distance between it and the first management node. The terminal node sends the measurement result to the first management node or sends relevant information of the second management node to trigger a connection switch.

[0201] Condition 2: When the first management node is overloaded, it provides secure communication parameters to other nodes.

[0202] Condition 3: The first management node receives indication information from a terminal node, where the indication information is used to indicate that the terminal node needs to establish a connection with the second management node.

[0203] Condition 4: The first management node receives control information from the control node, where the control information instructs the first management node to provide secure communication parameters to other nodes.

[0204] Optionally, these conditions can be used alone as the first condition, or can be combined as the first condition. In addition, the conditions here can also be combined with the conditions of the management node that can be provided with security communication parameters in the aforementioned connection relationship, which will not be described one by one here.

[0205] In some possible implementations, the secure communication parameters are associated with the security context of the terminal node. The association here means that the secure communication parameters directly or indirectly affect some or all parameters in the terminal node. The following is an exemplary introduction to the possible implementation of the association between the two:

[0206] Implementation method 1: The security communication parameters include the security context of the terminal node, and the second management node can directly use the security communication parameters as the security context of the terminal node. For example, the first management node provides all the parameters in the security context of the terminal node, or all the necessary parameters (i.e., parameters other than optional parameters), and the first management node establishes the security context of the terminal node based on the security communication parameters. It should be understood that the security context here can be regarded as an initial security context, which can be updated later, such as adding parameters to it, deleting parameters, or updating parameters therein.

[0207] In implementation mode 2, the security communication parameters provided by the first management node only include some parameters in the security context. The second management node can determine the security context by itself, but the security communication parameters are used in the process of determining the security context. In this case, some parameters in the security context can be determined by the second management node itself.

[0208] As a possible example, the secure communication parameters include a shared key, an ID of the shared key, a first fresh parameter, a first identity identifier of the terminal node, and indication information of a security algorithm. The second management node determines a security context of the terminal node, and the security context may include parameters in the secure communication parameters. Further, the second management node may determine a session key based on the shared key and the first fresh parameter, and the security context may also include the session key.

[0209] Taking the second management node determining the second fresh parameter as an example, the second management node can determine the first number according to the number of the protocol data unit PDU from the terminal node, and determine the second fresh parameter according to the second number and the first number. The security context includes the second fresh parameter. The initial value of the second number is predetermined and the second number is updated when the first number flips.

[0210] Exemplarily, the second fresh parameter comprises GFN, Figure 8 The figure shows a schematic diagram of a GFN. The GFN includes an HFN and a SN. The SN is the same as the number of the protocol data unit, and the HFN may be determined by the second management node, for example, set to 0. Alternatively, the second management node may also use the HFN in the security communication parameter as the HFN.

[0211] Optionally, the protocol data unit PDU from the terminal node can be, for example, a PDU carrying the first information. In other words, when receiving the first information, the second management node can determine the SN by the number of the protocol data unit carrying the first information, thereby obtaining the second fresh parameter based on the HFN and the SN. Further, the second fresh parameter is added to the security context. In addition, in some schemes, the second fresh parameter can be used in the integrity check process of the first information as an input to the integrity protection algorithm.

[0212] In some scenarios, the security communication parameters can also be updated. As a possible implementation, the first management node can send parameter update information after the security communication parameters are updated. Optionally, sending the parameter update information includes sending it directly to the first management node, or forwarding it through an intermediate node (for example, via one or more control nodes). Correspondingly, the second management node can receive the parameter update information from the first management node and update some or all of the local security communication parameters. The local security communication parameters here may also include the security context of the terminal node in the second management node.

[0213] Exemplarily, the secure communication parameters of the terminal include a shared key, an identifier of the shared key and a validity period of the shared key, and the parameter update information includes an updated shared key, a validity period of the updated shared key and a validity period of the updated shared key.

[0214] Exemplarily, the secure communication parameter of the terminal includes a first freshness parameter, and the parameter update information includes an updated first freshness parameter.

[0215] Exemplarily, the secure communication parameter of the terminal includes a second fresh parameter, and the parameter update information includes the updated second fresh parameter.

[0216] Exemplarily, the secure communication parameters of the terminal include a portion of the second fresh parameters, and the parameter update information includes an updated portion of the second fresh parameters. For example, the secure communication parameters include an HFN in the GFN, and the parameter update information includes an updated HFN. At this time, the second management node obtains a new GFN based on the updated HFN and SN.

[0217] Step S702: The second management node performs an association operation with a security context with the terminal node according to the security communication parameters.

[0218] Specifically, the associated operation with the security context includes: using the parameters in the security context to perform security protection (such as encryption, integrity protection, etc.) on the transmitted information, and the other end can also use the parameters in the security context to obtain the corresponding information. The following lists several possible implementation methods according to the different contents of the security communication parameters:

[0219] In the first implementation mode, the secure communication parameter includes a key, and the second management node uses the key in the secure communication parameter to securely protect the signaling sent to the terminal node, or obtains the content of the securely protected signaling from the terminal node through the key in the secure communication parameter. These signalings include associated related signalings.

[0220] For example, in combination Figure 6Taking the case where the security communication parameter includes the integrity protection key, the message M6 can be integrity protected by the integrity protection key by the terminal node, and the second management node can check the integrity of the message M6 by the integrity protection key. If the integrity check of the message M6 is successful, the message M7 is sent to the security communication parameter, and the message M7 is also integrity protected by the integrity protection key. If the terminal node passes the integrity check of the message M7, the association is completed.

[0221] Again exemplarily, in combination Figure 6 , Taking the case where the secure communication parameter includes an encryption key, when the signaling plane encryption is turned on, the message M7 can be encrypted by the encryption key. When the terminal node successfully decrypts the message M7, the association is completed.

[0222] Again illustratively, in combination Figure 6 , Take the case where the secure communication parameters include a shared key. The second management node derives a session key based on the shared key. Optionally, when a fresh parameter (such as a counter) is used in the key derivation process, the fresh parameter can be reset to a preset value, or the fresh parameter can be included in the secure communication parameters. Exemplarily, the derived session key includes a security key and / or an encryption key, and details can be found in the above two examples.

[0223] In the second implementation mode, the secure communication parameters include key negotiation parameters. Figure 4 For example, the secure communication parameters include parameters for obtaining the key KKE, or parameters for obtaining the key Kgt, or parameters for obtaining the session key.

[0224] Combination Figure 4 Taking the example that the secure communication parameters include the key negotiation parameter KEt and the key negotiation parameter KEg, the second management node can obtain the key K according to the key negotiation parameter KEt and the key negotiation parameter KEg. KE NONCEt and NONCEg may be included in the secure communication parameters, or the second management node and / or the terminal node may determine NONCEt and NONCEg during association and provide them to the other party. KE , NONCEt and NONCEg obtain a shared key, and further obtain a session key. Optionally, counter can be set to a preset value or included in the secure communication parameters.

[0225] Implementation method 3: the secure communication parameters include fresh parameters. For the case where both fresh parameters and keys are included, please refer to the above description. The case where only fresh parameters are included is described below.

[0226] Taking the case where the secure communication parameters only include the first fresh parameter as an example, the second management node and the terminal node obtain a new shared key by exchanging key negotiation parameters, and obtain a session key based on the shared key and the first fresh parameter. At this time, since the first fresh parameter is updated after each key generation, the second management node and the terminal node can continue to use the previous first fresh parameter to obtain the session key. In some scenarios, since the past parameters are difficult to crack, even if the attacker eavesdrops on the communication process between the second management node and the terminal node and obtains the relevant parameters for key negotiation, it is difficult to crack the session key, thereby improving the communication security between the second management node and the terminal node.

[0227] Taking the case where the secure communication parameter only includes the second fresh parameter, the second fresh parameter can be used for encryption during the session. Figure 5 In the association process shown, the second management node and the terminal node obtain a new shared key by exchanging key negotiation parameters, and obtain a session key based on the shared key and the first fresh parameter. The second management node generates verification information based on the session key and the second fresh parameter, and the verification information is carried in the message M2. The terminal node needs to check the integrity of the verification information based on the second fresh parameter and the session key. In other words, the second fresh parameter can be used to obtain the session key during association. Since the second fresh parameter is updated after use, it is difficult for an attacker to crack it, thereby improving communication security.

[0228] In implementation mode 4, the secure communication parameter includes an identifier of a security algorithm. The second management node and the terminal node continue to use the previous security algorithm to perform the association process, and there is no need to re-determine the security algorithm.

[0229] In short, the secure communication parameters include the parameters related to communication security that have been determined in the past. When the terminal node and the second management node are associated, the previously determined parameters can be used. On the one hand, the time for re-determining the parameters between the two can be reduced, reducing latency. On the other hand, the interaction of parameters can be avoided, which reduces the privacy of the parameters and improves security. In particular, when the secure communication parameters include keys, signaling interactions can be significantly reduced, greatly reducing communication latency.

[0230] In the fifth implementation mode, the secure communication parameters may also include one or more of key information, or an identity identifier of a terminal node, and the like.

[0231] It should be understood that the above embodiments can be combined. Fig. 10A , Fig. 10B , Fig.11A , Fig. 11B , Fig. 12A and Fig. 12BAn exemplary introduction is given. It should be noted that the aforementioned implementation modes are all introduced by using the keys and fresh parameters in the security communication parameters to perform association operations. In some implementation modes, since the keys (or fresh parameters, etc.) in the security communication parameters are also consistent with the keys of the security context, the two can also be replaced. That is, the present application is also applicable to the following situations: the second management node can also first establish a security context based on the security communication parameters, and perform association operations based on the parameters in the security context.

[0232] In a possible implementation, a terminal node may receive a connection indication from a first management node, and the connection indication is used to indicate that the terminal node is connected to a second management node. Accordingly, the terminal node performs an association operation with the second management node according to the connection indication. For example, the connection indication includes information about the second management node, such as the ID and network address of the second management node. Taking a roaming scenario as an example, the connection indication may include a roaming request. Specifically, the first management node sends a roaming request to the terminal node, triggering the terminal node to switch to the second management node. Accordingly, the terminal node establishes a connection with the second management node.

[0233] As a possible implementation, during the association operation, the second management node may receive a message from the terminal node, the message carrying the terminal node's identity identifier (referred to as the first identity identifier for easy distinction), and the second management node may query whether it has the security context of the terminal node based on the first identity identifier. If the second management node does not have the security context of the terminal node, it may indicate that the terminal node association has failed, or instruct the terminal node to perform an association process without a security context. For example Figure 5 The process shown.

[0234] Optionally, in the association operation, the second management node may generate a new identity for the terminal node, for example, called a second identity, and send it to the terminal node.

[0235] As a possible implementation, after the second management node successfully establishes an association with the terminal node, the two can perform data transmission via a communication connection.

[0236] Optionally, if the association between the second management node and the terminal node based on the security context fails to be established, an association operation without the security context may be performed. Figure 5 It should be understood that there are many possible reasons for the failure of association establishment, such as the second management node does not have the security context of the terminal, or the second management node fails to verify the integrity of the message, or the terminal node fails to verify the integrity of the message, or the terminal node cannot successfully decrypt the message from the second management node.

[0237] In some possible implementations, before the second management node establishes an association with the terminal node, the terminal node and the first management node may still be in a communication connection state. At this time, after the second management node successfully establishes an association with the terminal node, the terminal node and the first management node may be disconnected.

[0238] In some possible implementations, after the second management node establishes an association with the terminal, the second management node may provide secure communication parameters to other management nodes or control nodes for other management nodes to perform an association process with the terminal node in a secure context.

[0239] Optionally, when the security communication parameters are updated, the second management node may send parameter update information to other management nodes or control nodes.

[0240] Figure 7 In the illustrated embodiment, when the terminal node is associated with the second management node, the secure communication parameters provided by the first management node can be used to perform an association operation with the terminal node with a secure context. That is, the communication security parameters are used directly or indirectly to ensure the security of the information exchanged in the association operation. On the one hand, the association operation can reduce the signaling in the authentication process without re-negotiating with the terminal node to obtain the security context, thereby reducing the delay in signaling interaction. On the other hand, there is no need to re-determine the secure communication parameters, negotiate the security context, etc., which can reduce the amount of calculation of the terminal node and the second management node, further shortening the delay in establishing the connection.

[0241] In the above-mentioned embodiment, we mentioned that the first management node and the second management node may not be directly connected. The following is an exemplary description based on the case where the two are connected through a control node.

[0242] See also Fig. 9 , Fig. 9 FIG. 1 is a flow chart of another communication method provided in an embodiment of the present application. Fig. 9 The communication method shown may include one or more steps from step S901 to step S905. It should be understood that for the convenience of description, the order from S901 to S905 is described here, and it is not intended to limit the execution to the above order. The embodiment of the present application does not limit the execution order, execution time, execution number, etc. of the above one or more steps. S901 to step S905 are as follows:

[0243] Step S901: The first management node performs data transmission with the terminal node.

[0244] The first management node is associated with the terminal node, that is, the terminal is connected to the first management node. There is a communication connection between the two, and data transmission can be performed based on the communication connection.

[0245] The first management node has the security context of the terminal node, which includes the content as mentioned above, for example Figure 3 shown.

[0246] Step S902: The first management node sends a security communication parameter to the control node. Correspondingly, the control node may receive the security communication parameter from the first management node.

[0247] There are many possible designs for the timing of the first management node sending security parameters, for example, the sending timing can be sending after the terminal node is associated, or sending when the terminal node has a connection with other management nodes, or sending to the control node in response to the instruction of the control node.

[0248] In some scenarios, the terminal node can measure the distance between it and the management node or the quality of the communication channel between it and the management node, and determine whether to connect to a new management node based on the measurement results. For example, the quality of the communication channel can be indicated by one or more of the following parameters: communication signal strength, communication stability, communication delay, etc.

[0249] As a possible implementation, the terminal node periodically or non-periodically sends the measurement result to the first management node, and the first management node can make a decision based on the measurement result, select the best management node as the target management node, and instruct the terminal node to connect to the target management node. The target management node can be the second management node. Further optionally, the first management node can send information about the target management node to the control node.

[0250] Optionally, the security communication parameter is sent through a secure channel. Exemplarily, the first management node synchronizes the security context of the terminal node connected to it to the control node through a secure channel. The secure channel here includes but is not limited to a CAPWAP channel and the like.

[0251] Step S903: The control node sends the security communication parameter to the second management node. Correspondingly, the second management node receives the security communication parameter from the control node.

[0252] Optionally, the security communication parameter is sent through a security channel. Exemplarily, the first management node sends the security communication parameter to the second management node through a CAPWAP channel.

[0253] In a possible implementation, the control node sends the security communication parameter to the target management node, and the second management node belongs to the target management node or is the target management node. For the target management node, refer to the description in step S902.

[0254] In some scenarios, the second management node is a node that supports a fast connection establishment method. The fast connection establishment method is a method that supports associating with the terminal node through secure communication parameters from other nodes, and the other nodes include the first management node and / or the control node.

[0255] Furthermore, whether the second management node supports the fast connection establishment mode may be set by the user, determined by itself according to security risks, or configured by the management node, etc. For example, the second management node reports one or more of its own security requirements or security capabilities to the control node, and the control node evaluates whether it has the conditions to support the fast connection establishment mode. When it meets the conditions to support the fast connection establishment, the control node forwards the security communication parameters from the first management node to it.

[0256] In a possible implementation, the control node is connected to multiple management nodes, and the management node can send its own security requirements or security capability information such as the trust between the first management node and the control node. Correspondingly, the control node determines the node that supports the fast connection establishment method among the multiple nodes according to the security capability information reported by the management node.

[0257] Further, the control node may send third information to the first management node, and the third information is used to indicate a node that supports the fast connection establishment method. Exemplarily, the node that supports the fast connection establishment method includes a second management node, and the first management node may provide a secure communication parameter to the second management node, or the first management node may instruct the terminal node to connect to the second management node through the fast connection establishment method (i.e., perform an association process with a security context).

[0258] Step S904: The second management node performs an association operation with the terminal node having a security context according to the security communication parameter.

[0259] Taking the case where the secure communication parameter includes an integrity protection key or includes a parameter for obtaining an integrity protection key as an example, the terminal node may send the first information to the second management node, and the first information is integrity protected by the integrity protection key. Accordingly, the second management node receives the first information and checks the integrity of the first information by the integrity protection key. In the case where the integrity check of the first information is successful, the second management node sends the second information to the terminal node, and the second information is integrity protected by the integrity protection key. Accordingly, the terminal node receives the second information, and in the case where the integrity check of the second information is successful, the association is established. Further, the terminal node may send a response message to the second management node, and the association is completed.

[0260] Optionally, the secure communication parameter includes indication information of an integrity protection algorithm, and the second management node may use the integrity protection algorithm indicated by the indication information when checking the integrity of the information and performing integrity protection.

[0261] Exemplarily, the first information includes first verification information, and the first verification information is obtained by the terminal node according to the integrity protection key, the first information and the integrity protection algorithm. The first management node can verify the first information according to the integrity protection key, the first information and the integrity protection algorithm. If the verification is successful, the integrity check passes. The integrity protection algorithm used here can be specified by the indication information in the secure communication parameter.

[0262] Further optionally, the secure communication parameter further includes a second fresh parameter. During the integrity check process, the terminal node can perform an integrity check based on the second fresh parameter, the integrity protection key, and the integrity protection algorithm. For example, the first verification information is obtained based on the integrity protection key, the integrity protection algorithm, the second fresh parameter, and the first information.

[0263] Optionally, the secure communication parameter further includes an encryption key, or further includes indication information of an encryption algorithm. The second information can be encrypted by the encryption key and the encryption algorithm. The second fresh parameter is also used in the optional encryption process.

[0264] In a possible implementation, the first management node may send a handover indication message to the terminal node, the handover indication message including information of the second management node. The terminal node may receive the handover indication message, thereby performing an association process with the second management node with a security context. Exemplarily, the handover indication message is a roaming request instruction, instructing the terminal node to connect to the second management node.

[0265] For related descriptions, please refer to the description of step S702.

[0266] Optionally, Fig. 9 The communication method shown also includes step S905, which is as follows:

[0267] Step S905: the terminal node disconnects from the first management node.

[0268] Exemplarily, the terminal node and the first management node originally transmit data through a logical channel, and the terminal node and / or the first management node may release a meta-logical channel.

[0269] exist Fig. 9In the embodiment shown, the management node can provide the security communication parameters of the terminal node connected to it to the control node, and the control node sends the security communication parameters to other management nodes, such as the second management node, so that other management nodes can perform association operations with the terminal node with a security context. This can not only save signaling overhead, but also reduce the amount of calculation when the management node and the terminal node are associated, greatly shortening the delay in establishing a communication connection.

[0270] The foregoing Figure 7 and Fig. 9 Provides a variety of possible solutions, the following combined Fig. 10A , Fig. 10B , Fig.11A , Fig. 11B , Fig. 12A or Fig. 12B Some possible designs are exemplarily described. It should be understood that Fig. 10A , Fig. 10B , Fig.11A , Fig. 11B , Fig. 12A , Fig. 12B The logic, terminology, etc. in the illustrated embodiment may refer to the foregoing.

[0271] See also Fig. 10A , Fig. 10A It is a flow chart of another communication method provided by an embodiment of the present application. The communication method may include some or all of the steps in step S1001 to step S1006. Specifically, it is as follows:

[0272] Step S1001: The terminal node and the first management node establish an access layer default bearer.

[0273] That is, the terminal node and the first management node establish an initial connection, and the process may include an authentication process in a scenario without a security context and a negotiation process of a security context. Figure 5 The figure shows an authentication and security context negotiation process in a scenario without a security context. It should be understood that after the security context negotiation process, the first management node has the security context of the terminal node.

[0274] Fig. 10AA possible process of establishing a connection is also shown. The first management node can send an X resource control (Xresourcecontrol, XRC) setup message to the terminal node, and the terminal node can return a response message. The first management performs authentication and security context negotiation process with the terminal. The first management node sends an XRC reconfiguration message to the terminal node, and the access layer bearer is established, and data transmission can be performed. Among them, the X resource control message can be replaced by other information indicating communication resources, such as channels. It should be understood that the signaling process for establishing a connection here is only an example, and the specific implementation process can have other designs.

[0275] Optionally, before establishing a connection between the terminal node and the first management node, the terminal node may perform scanning to select a management node to connect to.

[0276] Optionally, the management node, including the first management node and the second management node, can send a system message to facilitate other nodes to perceive the management node. For example, the system message includes information about the management node that sends the message, so that the terminal node obtains the information about the management node.

[0277] Step S1002: The first management node sends a security context to the second management node.

[0278] Correspondingly, the second management node receives the security context from the first management node.

[0279] The first management node may be connected to the second management node, including a connection based on wired communication technology and / or a connection based on wireless communication technology. Optionally, the connection between the two may also pass through an intermediate node, such as a control node.

[0280] Optionally, the method may further include step S1003, which is as follows:

[0281] Step S1003: the first management node sends parameter update information to the second management node.

[0282] Correspondingly, the second management node receives the parameter update information from the first management node.

[0283] It is understandable that after the first management node obtains the security context, the parameters in the security context may be updated. In the case where the security context is updated, such as the key, HFN, etc., the first management node can send the updated parameters to the second management node. Correspondingly, the second management node can obtain the update of the parameters and replace the values ​​of the parameters with the updated values. For example, the second management node replaces the shared key with the updated shared key. For another example, the second management node replaces the HFN in the GFN with the updated HFN, and when the PUD is received next time, the GFN is obtained according to the SN of the new PDU and the updated HFN.

[0284] Optionally, the method may further include step S1004, which is as follows:

[0285] Step S1004: the first management node triggers connection switching.

[0286] For example, the first management node sends a connection instruction to the terminal node, and the connection instruction includes information of a management node to be connected. Optionally, the terminal node may also scan and make a connection switching decision to determine a management node to be connected.

[0287] Step S1005: The terminal node establishes an access layer default bearer with the second management node.

[0288] During the establishment process, the terminal node and the second management node perform an association process with a security context scenario.

[0289] Optionally, the method may further include step S1006, which is as follows:

[0290] Step S1006: The first management node and the terminal node perform a connection release request / response.

[0291] Exemplarily, the first management node sends a connection release request to the terminal node. Correspondingly, the terminal node responds to the request. Both support the default bearer release of the access layer. Of course, the same is true for the case where the terminal node sends a connection release request.

[0292] Optionally, the connection release request may also be replaced by an access link release request, etc., to release the access layer default bearer.

[0293] exist Fig. 10A In the illustrated embodiment, after the first management node establishes an access layer connection with the terminal node, it can obtain the security context of the terminal node and provide the security context of the terminal node to the second management node. At a later time, the terminal node can switch the management node to access and perform an access process with a security context with the second management node.

[0294] Optionally, as mentioned in step S1002, the first management node and the second management node may not be directly connected. Fig. 10B , Fig. 10B is a flow chart of another communication method provided in an embodiment of the present application, wherein step S1001 and step S1004-step 1006 can be referred to Fig. 10A In the embodiment of Fig. 10B In the example, the first management node is not directly connected to the second management node, but is connected through a control node (the number of control nodes passed through in the middle may be multiple). In step S1002, the first management node may send a security context to the control node, and the security context is forwarded to the second management node via the control node. Similarly, in step S1003, the parameter update information is also forwarded via the control node.

[0295] See also Fig.11A , Fig.11A FIG. 1 is a flow chart of another communication method provided in an embodiment of the present application. Fig.11A In the embodiment, the first management node provides the security context of the terminal node to other nodes after triggering the connection switching.

[0296] Specifically, Fig.11A The communication method shown may include some or all of the steps in step S1101 to step S1106. Specifically, it is as follows:

[0297] Step S1101: The terminal node and the first management node establish an access layer default bearer.

[0298] Optionally, the method may further include step S1102, which is as follows:

[0299] Step S1102: The first management node triggers connection switching.

[0300] Step S1103: The first management node sends a security context to the second management node.

[0301] Optionally, the method may further include step S1104, which is as follows:

[0302] Step S1104: the first management node sends parameter update information to the second management node.

[0303] Step S1105: The terminal node establishes an access layer default bearer with the second management node.

[0304] During the establishment process, the terminal node and the second management node perform an association process with a security context scenario.

[0305] Optionally, the method may further include step S1106, which is as follows:

[0306] Step S1106: The first management node and the terminal node perform a connection release request / response.

[0307] Fig.11A The detailed description of some steps shown can be found in the aforementioned embodiments, for example Figure 7 , Fig. 9 , Fig. 10A etc. embodiments.

[0308] exist Fig.11A In the illustrated embodiment, after the first management node establishes an access layer connection with the terminal node, the security context of the terminal node can be obtained. At a later time, when the terminal node needs to access the second management node, the first management node provides the security context of the terminal node to the second management node, so that the terminal node can perform an access process with a security context with the second management node.

[0309] Optionally, the first management node and the second management node may not be directly connected. Fig. 11B , Fig. 11B is a flow chart of another communication method provided in an embodiment of the present application, wherein step S1101, step S1102, and step S1105-step S1106 can be referred to Fig.11A In the embodiment of Fig. 11B In the embodiment, the first management node is not directly connected to the second management node, but is connected through a control node (the number of control nodes passed through in the middle may be multiple). In step S1103, the first management node may send a security context to the control node, and the security context is forwarded to the second management node via the control node. Similarly, in step S1104, the parameter update information is also forwarded via the control node.

[0310] See also Fig. 12A , Fig. 12A FIG. 1 is a flow chart of another communication method provided in an embodiment of the present application. Fig. 12A In the present invention, the first management node does not directly provide the security context of the terminal node but provides security communication parameters, and the security communication parameters include some parameters in the security context and / or the security communication parameters include information used to determine the parameters in the security context. After receiving the security communication parameters, the second management node obtains the security context and can perform an association operation with the terminal node having the security context.

[0311] Specifically, Fig. 12A The communication method shown may include some or all of the steps in step S1201 to step S1206. Specifically, it is as follows:

[0312] Step S1201: The terminal node and the first management node establish an access layer default bearer.

[0313] Optionally, the method may further include step S1202, which is as follows:

[0314] Step S1202: The first management node and the second management node send security communication parameters.

[0315] Optionally, the secure communication parameters include indication information of a security algorithm (eg, an encryption algorithm and an integrity protection algorithm or an authenticated encryption algorithm, a key derivation function), a shared key (eg, Kgt), an identifier of the shared key (eg, Kgt ID), and a second fresh parameter (eg, counter).

[0316] Furthermore, the secure communication parameter may also include a first identity of the terminal node. Furthermore, the first identity may be allocated to the terminal node by the first management node.

[0317] Optionally, the method may further include step S1203, which is as follows:

[0318] Step S1203: the first management node sends parameter update information to the second management node.

[0319] Exemplarily, taking the case where the security communication parameters include temporary ID, Kgt, Kgt ID, counter and other parameters, when the temporary ID, Kgt, Kgt ID, counter and other parameters are updated, the first management node sends the updated parameters, such as updated Kgt, updated Kgt ID, or updated counter, to the second management node.

[0320] Step S1204: the first management node triggers connection switching.

[0321] Step S1205: The terminal node establishes an access layer default bearer with the second management node.

[0322] During the establishment process, the terminal node and the second management node perform an association process with a security context scenario.

[0323] Optionally, the method may further include step S1206, which is as follows:

[0324] Step S1206: The first management node and the terminal node perform a connection release request / response.

[0325] Fig. 12A The detailed description of some steps shown can be found in the aforementioned embodiments, for example Figure 7 , Fig. 9 , Fig. 10A , Fig. 11B etc. embodiments.

[0326] exist Fig. 12A In the illustrated embodiment, after the first management node establishes an access layer connection with the terminal node, the security context of the terminal node can be obtained. The first management node provides the security communication parameters to the second management node, and the second management node determines the security context of the terminal node based on the security communication parameters. Later, when the terminal node accesses the second management node, the two can perform an access process with a security context.

[0327] Optionally, the first management node and the second management node may not be directly connected. Fig. 12B , Fig. 12B This is a flow chart of another communication method provided in an embodiment of the present application. Some steps can be found in Fig. 12A In the embodiment of Fig. 12B In the embodiment, the first management node is not directly connected to the second management node, but is connected through a control node (the number of control nodes passed through in the middle may be multiple). In step S1202, the first management node can send a security communication parameter to the control node, and the security communication parameter is forwarded to the second management node via the control node. Similarly, in step S1203, the parameter update information is also forwarded via the control node.

[0328] The method of the embodiment of the present application is described in detail above, and the device of the embodiment of the present application is provided below.

[0329] It should be understood that the division of the units in the device provided in the embodiments of the present application is only a division of logical functions, and in actual implementation, it can be fully or partially integrated into one physical entity, or it can be physically separated. In addition, the units in the device can be implemented in the form of a processor calling software. For example, the device includes a processor, the processor is connected to a memory, and instructions are stored in the memory. The processor calls the instructions stored in the memory to implement any of the above methods or implement the functions of each unit of the device, wherein the processor is, for example, a general-purpose processor, such as a central processing unit (CPU) or a microprocessor, and the memory is a memory inside the device or a memory outside the device.

[0330] Alternatively, the units in the device may be implemented in the form of hardware circuits, and the functions of some or all of the units may be implemented by designing the hardware circuits, and the hardware circuits may be understood as one or more processors. For example, in one implementation, the hardware circuit is an application-specific integrated circuit (ASIC), and the functions of some or all of the above units are implemented by designing the logical relationship of the components in the circuit. For another example, in another implementation, the hardware circuit may be implemented by a programmable logic device (PLD), taking a field programmable gate array (FPGA) as an example, which may include a large number of logic gate circuits, and the connection relationship between the logic gate circuits is configured by a configuration file, thereby implementing the functions of some or all of the above units.

[0331] In an embodiment of the present application, each unit in the device may be one or more processors (or processing circuits) configured to implement the above method, such as: CPU, (graphics processing unit, GPU), neural network processing unit (neural network processing Unit, NPU), tensor processing unit (tensor processing unit, TPU), deep learning processing unit (deep learning processing unit, DPU), microprocessor (microprocessor unit, MPU), digital signal processor (digital signal processor, DSP), ASIC, FPGA, or a combination of at least two of these processor forms.

[0332] In addition, the units in the above devices can be fully or partially integrated together, or can be implemented independently. In one implementation, these units are integrated together and implemented in the form of a system-on-a-chip (SOC, or system-level chip). The SOC may include at least one processor for implementing any of the above methods or implementing the functions of each unit of the device. The type of the at least one processor may be different, for example, including a CPU and an FPGA, or including a CPU and an artificial intelligence processor, or including a CPU and a GPU, etc. Several possible devices are listed below.

[0333] See also Fig.13 , Fig.131 is a schematic diagram of the structure of a communication device provided in an embodiment of the present application. Optionally, the communication device 130 may be an independent device, such as a node. Alternatively, the communication device 130 may also be a device in an independent device (such as a node), such as a chip or an integrated circuit. The communication device 130 is used to implement the aforementioned communication method, such as Figure 7 , Fig. 9 , Fig. 10A , Fig. 10B , Fig.11A , Fig. 11B , Fig. 12A ,or Fig. 12B The communication method shown.

[0334] In one possible design, the communication device 130 includes a communication unit 1301 and a processing unit 1302, and the communication device 130 is used to implement the method on the second management node side in the aforementioned communication method.

[0335] In a possible implementation, the communication unit 1301 is used to receive a security communication parameter from the first management node, where the security communication parameter includes a parameter used when the first management node communicates with the terminal node, and the security communication parameter is associated with a security context of the terminal node;

[0336] The processing unit 1302 and the communication unit 1301 are further configured to perform an association operation with a security context with the terminal node according to the security communication parameters.

[0337] For example, the processing unit is used to complete one or more of the aforementioned operations of determining, checking (or verifying), calculating, generating, updating, encrypting, or decrypting, and the communication unit is used to complete one or more of the aforementioned operations of sending, receiving, etc.

[0338] In yet another possible implementation, the processing unit 1302 and the communication unit 1301 are further configured to perform data transmission with the second management node after establishing the association.

[0339] In another possible implementation, the security context of the terminal node includes a key. Optionally, when the security context includes a key, the security context may also include key information, where the key information includes one or more of a key identifier, a key validity period, a key activation time, and the like.

[0340] In another possible implementation, the security context of the terminal node includes fresh parameters. The first fresh parameter and the second fresh parameter are exemplary fresh parameters. In some schemes, the first fresh parameter is used to derive a session key, and the second fresh parameter is used as a parameter used for security protection.

[0341] Optionally, the second fresh parameter is determined by the first number and the second number. Optionally, the initial value of the second number is predetermined. The second number can be updated, for example, the second number is updated when the first number is flipped. Optionally, the second fresh parameter is a global frame number (GFN), and the GFN includes a hyper frame number (HFN) and a sequence number (serial number, or sequence number, SN). Optionally, the sequence number is the same as the number of the protocol data unit PDU, and the HFN is predetermined.

[0342] Alternatively, the second fresh parameter is a predefined parameter value, such as HFN. Further, the second fresh parameter can be updated by the number of the protocol data unit. For example, the second fresh parameter is updated when the SN flips.

[0343] In yet another possible implementation, the security context of the terminal includes information about a security algorithm, such as indication information of the security algorithm.

[0344] In yet another possible implementation, the secure communication parameter is a security context of the terminal node.

[0345] In yet another possible implementation, the secure communication parameters include some parameters in the security context and / or include parameters used to obtain some parameters in the security context.

[0346] Exemplarily, the secure communication parameter includes a key. The key can be directly used as a session key for security protection of the communication process. Or the key can be used to derive a session key.

[0347] Exemplarily, the secure communication parameter includes a shared key, and the processing unit 2601 is further configured to obtain a session key based on the shared key. Further, the session key derived by the second management node is included in the security context of the terminal node. Optionally, the security context also includes a shared key.

[0348] Optionally, fresh parameters, key identifiers, etc. may also be used when deriving the session key. For example, the secure communication parameters include the shared key Kgt and the first security parameter counter, and the second terminal node determines the user plane encryption key based on the shared key Kgt and the first security parameter counter and the identifier of the user plane encryption key.

[0349] Exemplarily, the secure communication parameters further include an identifier of a shared key and a first freshness parameter, and the processing unit is configured to determine a session key according to the shared key, the identifier of the shared key and the first freshness parameter.

[0350] Exemplarily, the security communication parameters further include an identifier of a security algorithm and a first identity identifier of the terminal node.

[0351] In another possible implementation, the session key includes an integrity protection key. The communication unit 1301 is further configured to receive first information from a terminal node, the first information being integrity protected by the integrity protection key;

[0352] The processing unit 1302 is further configured to check the integrity of the first information according to the integrity protection key;

[0353] The communication unit 1301 is further configured to send second information to the terminal node when the integrity check of the first information is successful. Optionally, the second information is used for the terminal node to establish an association with the second management node, and the second information is integrity protected by an integrity protection key.

[0354] Optionally, the session key includes an encryption key, and the second information is encrypted by the encryption key.

[0355] In another possible implementation, the security context of the terminal includes a session key and an identifier of the first security algorithm. The first information includes first verification information, and the first verification information corresponds to the session key, the first information, and the first security algorithm.

[0356] The processing unit 1302 is further configured to verify the first verification information according to the session key, the first information and the first security algorithm.

[0357] Exemplarily, the session key is an integrity protection key, and the identifier of the first security algorithm is an identifier of the first integrity protection algorithm.

[0358] In another possible implementation, the security context includes the first identity of the terminal node. The processing unit 1302 is further configured to obtain the security context of the terminal node according to the first identity in the first information.

[0359] In another possible implementation, the processing unit 1302 is further configured to generate a second identity of the terminal node, the identity being used to identify the terminal node. The communication unit 1301 is further configured to send the second identity to the terminal node. Optionally, the second identity is carried in the second information.

[0360] In another possible implementation, the second fresh parameter in the security context may be determined by the second management node. For example, the second fresh parameter may be predefined, such as 128 bits of all 0s, or a preset value.

[0361] In another possible implementation, the security context of the terminal node includes a second fresh parameter. The processing unit 1302 is further configured to determine the first number according to the number of the protocol data unit PDU from the terminal node. The processing unit 1302 is further configured to determine the second fresh parameter according to the second number and the first number, wherein the initial value of the second number is predetermined and the second number is updated when the first number is flipped.

[0362] In another possible implementation, the communication unit 1301 is further configured to receive parameter update information from the first management node. The processing unit 1302 is further configured to update some or all parameters in the security communication parameters according to the parameter update information. Wherein, updating some or all parameters in the security communication parameters may include updating some or all parameters in the security context.

[0363] In another possible implementation, the first management node and the communication device 130 are connected or indirectly connected, and the connection here can be wired or wireless. When the two are directly connected, the communication device 130 can receive the security communication parameters sent by the first management node. The indirect connection can be connected through an intermediate node, and the intermediate node forwards the information between the two.

[0364] Exemplarily, the communication device 130 receives the security communication parameter from the first management node, including: the communication unit 1301 receives the security communication parameter forwarded via the control node, and the control node is in communication connection with the first management node and the communication device 130 .

[0365] In yet another possible implementation, the security communication parameters are transmitted via messages that comply with the CAPWAP protocol.

[0366] In yet another possible implementation, the communication unit 1301 and the processing unit 1302 are further configured to perform an association operation without a security context with the terminal node when the association fails.

[0367] In yet another possible implementation, the communication device 130 is a node that supports a fast connection establishment mode, or the communication device 130 belongs to a node that supports a fast connection establishment mode.

[0368] In another possible implementation, the communication unit 1301 is further configured to send a security communication parameter between the second management node and the terminal node to the control node. The security communication parameter between the second management node and the terminal node is used to obtain a security context of the terminal node.

[0369] In yet another possible implementation, the communication unit 1301 is further configured to send parameter update information to the control node, where the parameter update information is used to update a security communication parameter between the second management node and the terminal node.

[0370] In one possible design, the communication device 130 includes a communication unit 1301 and a processing unit 1302, and the communication device 130 is used to implement the method on the terminal node side in the aforementioned communication method.

[0371] In a possible implementation, the communication unit 1301 and the processing unit 1302 are used to perform data transmission with the first management node, and the first management node has a security context with the terminal node;

[0372] The communication unit 1301 and the processing unit 1302 are further configured to perform an association operation with a second management node having a security context when a connection establishment condition is met, and the second management node has a security context with the terminal node.

[0373] Optionally, the communication unit 1301 and the processing unit 1302 are further configured to perform data transmission with the second management node.

[0374] In another possible implementation, the communication unit 1301 is further configured to receive a roaming request from the first management node, the roaming request instructing the terminal node to perform a connection switch. Further, in response to the roaming request, the communication device 130 performs an association operation with the second management node with a security context.

[0375] In another possible implementation, the communication unit 1301 and the processing unit 1302 are further configured to measure the distances between the first management node and the second management node and the terminal node respectively. The connection establishment condition includes: the distance between the second management node and the terminal node is less than the distance between the first management node and the terminal node.

[0376] In yet another possible implementation, the communication unit 1301 and the processing unit 1302 are further configured to disconnect data transmission with the first management node.

[0377] In yet another possible implementation, the communication unit 1301 is further configured to receive switching indication information from the first management node, where the switching indication information includes information indicating the second management node.

[0378] In yet another possible implementation manner, the second management node is a node that supports a fast connection establishment mode.

[0379] In yet another possible implementation, the security context of the terminal node includes an integrity protection key. The communication unit 1301 is further configured to send the first information to the second management node, where the first information is integrity protected by the integrity protection key.

[0380] The communication unit 1301 is further configured to receive second information from the second management node, where the second information is used to establish an association between the terminal node and the second management node, and the second information is integrity protected by the integrity protection key;

[0381] The processing unit 1302 is further configured to check the integrity of the first information according to the integrity protection key;

[0382] In case the integrity check of the first information is successful, the association is completed.

[0383] In yet another possible implementation, the communication unit 1301 and the processing unit 1302 are further configured to perform an association operation without a security context with the terminal node when the association fails.

[0384] In one possible design, the communication device 130 includes a communication unit 1301 and a processing unit 1302, and the communication device 130 is used to implement the method on the first management node side in the aforementioned communication method.

[0385] In a possible implementation, the communication unit 1301 and the processing unit 1302 are used to perform data transmission with the terminal node;

[0386] The communication unit 1301 is also used to send security communication parameters between the first management node and the terminal node, the security communication parameters are associated with the security context of the terminal node, and the security communication parameters are used for the second management node and the terminal node to perform an association process with a security context.

[0387] In yet another possible implementation, the communication unit 1301 is further configured to send parameter update information to the first management node, where the parameter update information is used to update part or all of the security communication parameters.

[0388] In a possible implementation, the communication unit 1301 is further configured to send security communication parameters between the control node and the terminal node to the control node, and the control node is configured to provide the security communication parameters between the control node and the terminal node to the second management node.

[0389] In a possible implementation manner, the parameter update information is sent to the control node, and the control node is configured to provide the parameter update information to the second management node.

[0390] In yet another possible implementation, the communication unit 1301 is further configured to send switching indication information to the terminal node, where the switching indication information includes information indicating the second management node.

[0391] In another possible implementation, the communication unit 1301 is also used to receive third information from the control node, and the third information is used to indicate nodes that support a fast connection establishment method, and the nodes that support a fast connection establishment method include a second management node. The fast connection establishment method is a method that supports association with a terminal node through secure communication parameters from other nodes.

[0392] In one possible design, the communication device 130 includes a communication unit 1301 and a processing unit 1302, and the communication device 130 is used to implement the method on the control node side in the aforementioned communication method.

[0393] In a possible implementation, the communication unit 1301 is used to receive a security communication parameter between the first management node and the terminal node from the first management node. The communication unit 1301 is also used to send the security communication parameter to the second management node, the security communication parameter is associated with the security context of the terminal node, and the security communication parameter is used for the second management node and the terminal node to perform an association process with a security context.

[0394] In a possible implementation, the communication unit 1301 is further configured to receive parameter update information from the first management node, the parameter update information being used to update some or all of the security communication parameters. The communication unit 1301 is further configured to send the parameter update information to the second management node.

[0395] In a possible implementation, the communication unit 1301 is also used to send third information to the first management node, and the third information is used to indicate nodes that support a fast connection establishment method, and the nodes that support a fast connection establishment method include a second management node. The fast connection establishment method is a method that supports association with a terminal node through secure communication parameters from other nodes.

[0396] In a possible implementation, the communication unit 1301 is also used to determine the nodes among the multiple nodes that support the fast connection establishment method based on the security requirements of the multiple management nodes and / or the trust between the multiple management nodes and the first management node respectively, the multiple management nodes are connected to the control node, and the multiple management nodes include the second management node.

[0397] See also Fig.14 , Fig.14140 is a schematic diagram of the structure of another communication device provided in an embodiment of the present application. The communication device 140 may be an independent device, such as a node, or a device contained in an independent device, such as a chip, a software module, or an integrated circuit. The communication device 140 may include at least one processor 1401 and a communication interface 1402. Optionally, at least one memory 1403 may also be included. Further optionally, a connection line 1404 may also be included, wherein the processor 1401, the communication interface 1402 and / or the memory 1403 are connected via the connection line 1404, and / or communicate with each other via the connection line 1404 to transmit control signals and / or data signals.

[0398] in:

[0399] The processor 1401 is a module that performs arithmetic operations and / or logical operations, and may specifically include one or more of the following modules: a filter, a modem, a power amplifier, a low noise amplifier (LNA), a baseband processor, a radio frequency processor, a radio frequency circuit, a central processing unit (CPU), an application processor (AP), a microcontroller unit (MCU), an electronic control unit (ECU), a graphics processing unit (GPU), a microprocessor (MPU), an application specific integrated circuit (ASIC), an image signal processor (ISP), a digital signal processor (DSP), a field programmable gate array (FPGA), a complex programmable logic device (CPLD), or a coprocessor, etc.

[0400] The communication interface 1402 may be used to provide information input or output for the at least one processor, or to receive externally sent signals and / or send externally sent signals.

[0401] For example, communication interface 1402 may include interface circuitry.

[0402] For example, the communication interface 1402 may include a wired link interface such as an Ethernet cable, or may be a wireless link (Wi-Fi, Bluetooth, general wireless transmission, vehicle-mounted short-range communication technology, and other short-range wireless communication technologies, etc.) interface.

[0403] Optionally, the communication interface 1402 may further include a radio frequency transmitter, an antenna, etc. When the communication interface 1402 includes an antenna, the number of antennas may be one or more.

[0404] As a possible design, if the communication device 140 is an independent device, the communication interface 1402 may include a receiver and a transmitter. The receiver and the transmitter may be the same component or different components. When the receiver and the transmitter are the same component, the component may be referred to as a transceiver.

[0405] As another possible design, if the communication device 140 is a chip or a circuit, the communication interface 1402 may include an input interface and an output interface, and the input interface and the output interface may be the same interface, or may be different interfaces.

[0406] Optionally, the functions of the communication interface 1402 may be implemented by a transceiver circuit or a dedicated transceiver chip.

[0407] The memory 1403 is used to provide a storage space, in which data such as an operating system and a computer program can be stored. The memory 1403 can be a random access memory (RAM), a read-only memory (ROM), an erasable programmable read only memory (EPROM), or a portable read only memory (compact disc read-only memory, CD-ROM), etc., or a combination of multiple thereof.

[0408] The functions and actions of the modules or units in the communication device 140 listed above are only exemplary.

[0409] Each functional unit in the communication device 140 can be used to implement the aforementioned communication method, for example Figure 7 , Fig. 9 , Fig. 10A , Fig. 10B , Fig.11A , Fig. 11B , Fig. 12A ,or Fig. 12B The communication method shown is, for example, used to execute a method executed by a first management node, a second management node, a terminal node or a management node.

[0410] Optionally, the processor 1401 may be a processor specifically used to execute the aforementioned method (for convenience of distinction, referred to as a dedicated processor), or may be a processor that executes the aforementioned method by calling a computer program (for convenience of distinction, referred to as a dedicated processor). Optionally, the at least one processor may include both a dedicated processor and a general-purpose processor.

[0411] Optionally, in the case where the communication device 140 includes at least one memory 1403 , if the processor 1401 implements the aforementioned communication method by calling a computer program, the computer program may be stored in the memory 1403 .

[0412] The present application also provides a chip, which includes a logic circuit and a communication interface. The communication interface is used to receive a signal or send a signal; the logic circuit is used to receive a signal or send a signal through the communication interface. The chip is used to implement the aforementioned communication method, for example Figure 7 , Fig. 9 , Fig. 10A , Fig. 10B , Fig.11A , Fig. 11B , Fig. 12A ,or Fig. 12B The communication method shown.

[0413] The embodiment of the present application further provides a computer-readable storage medium, wherein the computer-readable storage medium stores instructions, and when the instructions are executed on at least one processor (or communication device), the aforementioned communication method is implemented, for example Figure 7 , Fig. 9 , Fig. 10A , Fig. 10B , Fig.11A , Fig. 11B , Fig. 12A ,or Fig. 12B The communication method shown.

[0414] The present application also provides a computer program product, which includes computer instructions, and the computer instructions are used to implement the aforementioned communication method, for example Figure 7 , Fig. 9 , Fig. 10A , Fig. 10B , Fig.11A , Fig. 11B , Fig. 12A ,or Fig. 12B The communication method shown.

[0415] The embodiment of the present application further provides a terminal, which includes the aforementioned communication device 130 and / or communication device 140.

[0416] As a possible implementation, the terminal includes a terminal node. Further, the terminal also includes a first management node and / or a second management node. Further, the terminal also includes a control node.

[0417] Exemplarily, the terminal may include intelligent terminals or vehicles such as vehicles, robots, drones, ships, and boats. Among them, the vehicle is a vehicle in a broad sense, which may be a vehicle (such as a commercial vehicle, a passenger car, a motorcycle, a flying car, a train, etc.), an industrial vehicle (such as a forklift, a trailer, a tractor, etc.), an engineering vehicle (such as an excavator, a bulldozer, a crane, etc.), an agricultural equipment (such as a mower, a harvester, etc.), etc. For another example, the robot may be an intelligent transport robot (automated guided vehicle, AGV), a walkable conversational robot, a service robot, and other robots.

[0418] It should be noted that in the embodiments of the present application, words such as "exemplarily" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplarily" or "for example" in the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplarily" or "for example" is intended to present related concepts in a specific way.

[0419] In the embodiments of the present application, "at least one" refers to one or more, and "more" refers to two or more. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items.

[0420] For example, at least one of a, b, or c can be represented by: a, b, c, (a and b), (a and c), (b and c), or (a and b and c), where a, b, c can be single or multiple. "And / or" describes the association relationship of the associated objects, indicating that there can be three relationships. For example, A and / or B can be represented by: A exists alone, A and B exist at the same time, and B exists alone, where A and B can be singular or plural. The character " / " generally indicates that the associated objects are in an "or" relationship.

[0421] Furthermore, unless otherwise specified, the ordinal numbers such as "first" and "second" used in the embodiments of the present application are used to distinguish multiple objects, and are not used to limit the order, timing, priority or importance of multiple objects. For example, the first node and the second node are only for the convenience of describing fresh parameters in different implementations, and do not indicate differences in their execution operations, importance, structure, etc.

[0422] In the above embodiments, the term "when..." can be interpreted as meaning "if..." or "after..." or "in response to determining..." or "in response to detecting...", depending on the context. The above description is only an optional embodiment of the present application and is not intended to limit the present application. Any modification, equivalent substitution, improvement, etc. made within the concept and principle of the present application shall be included in the protection scope of the present application.

[0423] A person skilled in the art will understand that all or part of the steps to implement the above embodiments may be accomplished by hardware or by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, and the above-mentioned storage medium may be a read-only memory, a disk or an optical disk, etc.

Claims

1. A communication method, characterized in that: Applied to the second management node (AP2), the method comprises: Receiving a security communication parameter from the first management node, the security communication parameter including a parameter used when the first management node communicates with the terminal node, the security communication parameter being associated with a security context of the terminal node; An association operation having a security context is performed with the terminal node according to the security communication parameter.

2. The method according to claim 1, characterized in that The security context of the terminal node includes one or more of the following parameters: A shared key, a first fresh parameter, a session key, information indicating a security algorithm, a first identity identifier of a terminal node, and a second fresh parameter; The first fresh parameter is used to derive a session key, and the second fresh parameter is used as a parameter used in communication encryption.

3. The method according to claim 2, characterized in that The secure communication parameters include a security context of the terminal node.

4. The method according to claim 1 or 2, characterized in that: The secure communication parameter includes a shared key, and the method further comprises: A session key is obtained according to the shared key, and the session key is included in the security context.

5. The method according to claim 4, characterized in that The secure communication parameter further includes an identifier of the shared key and a first freshness parameter, and obtaining a session key according to the shared key includes: The session key is determined according to the shared key, an identifier of the shared key, and the first fresh parameter.

6. The method according to any one of claims 4 or 5, characterized in that: The session key includes an integrity protection key; The performing an association operation with the terminal node having a security context according to the security communication parameter includes: receiving first information from the terminal node, the first information being integrity protected by the integrity protection key; checking the integrity of the first information according to the integrity protection key; In case the integrity of the first information is successfully checked, second information is sent to the terminal node, the second information is used for the terminal node to establish an association with the second management node, and the second information is integrity protected by the integrity protection key.

7. The method according to claim 4 or 5, characterized in that: The security context of the terminal node includes a second fresh parameter, and the method further includes: Determine a first number according to the number of the protocol data unit PDU from the terminal node; A second freshness parameter is determined according to a second number and the first number, wherein an initial value of the second number is predetermined and the second number is updated when the first number is flipped.

8. The method according to any one of claims 1 to 7, characterized in that: The method further comprises: Receiving parameter update information from the first management node; According to the parameter update information, some or all of the security communication parameters are updated.

9. The method according to claim 8, characterized in that The secure communication parameters of the terminal include a shared key, an identifier of the shared key, and a validity period of the shared key, and the parameter update information includes an updated shared key, a validity period of the updated shared key, and a validity period of the updated shared key; Alternatively, the secure communication parameter of the terminal includes a first freshness parameter, and the parameter update information includes an updated first freshness parameter; Alternatively, the secure communication parameter of the terminal includes a second fresh parameter, and the parameter update information includes the updated second fresh parameter; Alternatively, the secure communication parameter of the terminal includes a portion of the second fresh parameter, and the parameter update information includes an updated portion of the second fresh parameter.

10. The method according to any one of claims 1 to 9, characterized in that: The receiving of the security communication parameter from the first management node includes: The secure communication parameter forwarded via a control node is received, and the control node is communicatively connected with the first management node and the second management node.

11. The method according to any one of claims 1 to 10, characterized in that: The security communication parameters are transmitted via messages that meet the CAPWAP protocol.

12. The method according to any one of claims 1 to 11, characterized in that: The method further comprises: In case of association failure, an association operation without a security context is performed with the terminal node.

13. The method according to any one of claims 1 to 12, characterized in that: The second management node is a node that supports a fast connection establishment mode. The fast connection establishment method is a method that supports associating with the terminal node through security communication parameters from other nodes, and the other nodes include the first management node and / or the control node.

14. A communication method, characterized in that: Applied to a terminal node, the method comprises: Performing data transmission with a first management node, the first management node having a security context with the terminal node; When the connection establishment condition is met, an association operation with a security context is performed with a second management node, where the second management node has a security context with the terminal node.

15. The method according to claim 14, characterized in that The connection establishment conditions include: A roaming request is received from the first management node, where the roaming request instructs the terminal node to perform a connection switch.

16. The method according to claim 14, characterized in that The method further comprises: measuring the distances between the first management node and the second management node and the terminal node respectively, The connection establishment condition includes: a distance between the second management node and the terminal node is smaller than a distance between the first management node and the terminal node.

17. The method according to claim 16, characterized in that After performing an association operation with a security context with the second management node, the method further includes: Disconnect the data transmission with the first management node.

18. The method according to any one of claims 15 to 17, characterized in that The method further comprises: Receive switching indication information from the first management node, where the switching indication information includes information indicating the second management node.

19. The method according to any one of claims 15 to 18, characterized in that The second management node is a node that supports a fast connection establishment mode. The fast connection establishment method is a method that supports association with the terminal node through security communication parameters from other nodes, and the other nodes include the first management node.

20. The method according to any one of claims 15 to 17, characterized in that The security context of the terminal node includes an integrity protection key; The associating operation with the second management node having a security context includes: Sending first information to the second management node, where the first information is integrity protected by the integrity protection key; receiving second information from the second management node, where the second information is used for the terminal node to establish an association with the second management node, and the second information is integrity protected by the integrity protection key; checking the integrity of the first information according to the integrity protection key; In case the integrity check of the first information is successful, the association is completed.

21. The method according to any one of claims 1 to 11, characterized in that The method further comprises: In case of association failure, an association operation without a security context is performed with the terminal node.

22. A communication method, characterized in that: Applied to a first management node, the first management node having a security context of a terminal node, the method comprising: Performing data transmission with the terminal node; Sending to the second management node a security communication parameter between the second management node and the terminal node, wherein the security communication parameter is associated with a security context of the terminal node, and the security communication parameter is used for the second management node to perform an association process with the terminal node having a security context.

23. The method according to claim 22, characterized in that The security context of the terminal node includes one or more of the following: A shared key, a first fresh parameter, a session key, an identifier of a security algorithm, a first identity identifier of a terminal node, and a second fresh parameter; The first fresh parameter is used to derive a session key, and the second fresh parameter is used as an input of a cryptographic algorithm used in communication encryption.

24. The method according to claim 22 or 23, characterized in that The secure communication parameter is the security context of the terminal node, Alternatively, the secure communication parameter includes a shared key, and the shared key is used to derive a session key.

25. The method according to any one of claims 22 to 24, characterized in that The method further comprises: Send parameter update information to the second management node, where the parameter update information is used to update some or all of the security communication parameters.

26. The method according to any one of claims 22 to 25, characterized in that The method further comprises: Sending switching indication information to the terminal node, where the switching indication information includes information indicating the second management node.

27. The method according to any one of claims 22 to 26, characterized in that The second management node is connected to the control node, and the sending of the security communication parameter between the second management node and the terminal node to the second management node includes: The secure communication parameter between the control node and the terminal node is sent to the control node, and the control node is used to provide the secure communication parameter between the control node and the terminal node to the second management node.

28. The method according to claim 25, characterized in that The second management node is connected to the control node, and the sending of parameter update information to the second management node includes: The parameter update information is sent to the control node, and the control node is used to provide the parameter update information to the second management node.

29. The method according to claim 27 or 28, characterized in that The method further comprises: Receive third information from the control node, the third information is used to indicate a node that supports a fast connection establishment method, the node that supports the fast connection establishment method includes the second management node, and the fast connection establishment method is a method that supports association with a terminal node through security communication parameters from other nodes.

30. A communication method, characterized in that: Applied to a control node, the control node is connected to a first management node and a second management node, the method comprising: receiving, from the first management node, a security communication parameter between the first management node and the terminal node; The secure communication parameter is sent to the second management node, the secure communication parameter is associated with the security context of the terminal node, and the secure communication parameter is used for the second management node to perform an association process with the terminal node in a security context.

31. The method according to claim 30, characterized in that The security context of the terminal node includes one or more of the following: A shared key, a first fresh parameter, a session key, an identifier of a security algorithm, a first identity identifier of a terminal node, and a second fresh parameter; The first fresh parameter is used to derive a session key, and the second fresh parameter is used as an input of a cryptographic algorithm used in communication encryption.

32. The method according to claim 30 or 31, characterized in that The secure communication parameter is the security context of the terminal node, Alternatively, the secure communication parameter includes a shared key, and the shared key is used to derive a session key.

33. The method according to any one of claims 30 to 32, characterized in that The method comprises: receiving parameter update information from the first management node, where the parameter update information is used to update some or all of the security communication parameters; Send the parameter update information to the second management node.

34. The method according to any one of claims 30 to 33, characterized in that The method further comprises: Send third information to the first management node, where the third information is used to indicate nodes that support a fast connection establishment method, where the nodes that support a fast connection establishment method include the second management node, and the fast connection establishment method is a method that supports associating with a terminal node through secure communication parameters from other nodes.

35. The method according to claim 34, characterized in that The method comprises: According to the security requirements of multiple management nodes and / or the trust between the multiple management nodes and the first management node respectively, determine the nodes among the multiple nodes that support the fast connection establishment method. The multiple management nodes are connected to the control node, and the multiple management nodes include the second management node.

36. A communication device, characterized in that: The communication device comprises a communication unit and a processing unit, and the communication device is used to execute the method according to any one of claims 1 to 13, claims 14 to 21, claims 22 to 29, and claims 30 to 35.

37. A communication device, characterized in that: include: processor; When the processor calls the computer program or instruction in the memory, the method according to any one of claims 1 to 13, claims 14 to 21, claims 22 to 29, and claims 30 to 35 is executed.

38. A communication device, characterized in that: comprising a logic circuit and an interface, wherein the logic circuit and the interface are coupled; The interface is used to input data to be processed, the logic circuit processes the data to be processed according to the method described in any one of claims 1 to 13, claims 14 to 21, claims 22 to 29, and claims 30 to 35 to obtain processed data, and the interface is used to output the processed data.

39. A computer-readable storage medium, characterized in that: include: The computer-readable storage medium is used to store instructions or computer programs; when the instructions or the computer program are executed, the method according to any one of claims 1 to 13, claims 14 to 21, claims 22 to 29, and claims 30 to 35 is implemented.

40. A computer program product, characterized in that include: instructions or computer programs; When the instructions or the computer program are executed, the method according to any one of claims 1 to 13, claims 14 to 21, claims 22 to 29, and claims 30 to 35 is performed.

41. A vehicle, characterized in that: Comprising the communication device as claimed in claim 36, or the communication device as claimed in claim 37, or the communication device as claimed in claim 38.

42. A communication system, characterized in that: include: A second management node, a terminal node, and a first management node; The second management node is used to execute the method according to any one of claims 1 to 13, The terminal node is used to perform the method according to any one of claims 14 to 21, The first management node is used to execute the method according to any one of claims 22 to 29.

43. The communication system according to claim 41, characterized in that The communication system further comprises a control node, wherein the control node is configured to execute the method according to any one of claims 30 to 35.

Images