Communication method, communication device and communication system

Abstract

The invention provides a communication method, a communication device and a communication system. Based on the method, in a service flow shunting scene, a terminal device and a shunting node can obtain a first session key, and in a transmission process between the terminal device and the shunting node, first user plane data of a first session and second user plane data of the first session are protected based on the first session key. The first user plane data is transmitted to the first user plane anchor point through the shunting node, and the second user plane data is transmitted to the second user plane anchor point through the shunting node. According to the scheme, security protection can be performed on the user plane data between the terminal equipment and the plurality of user plane anchor points in a business flow distribution scene.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of communication technology, and in particular to a communication method, a communication device and a communication system. BACKGROUND

[0002] In the current mobile communication network, user plane data sent by a terminal device is sent to a user plane network element through an access network device, and the user plane data is protected by a hop-by-hop security mechanism during transmission. Specifically:

[0003] (1) For transmission of user plane data between a terminal device and an access network device, in the uplink direction, the terminal device sends user plane data that has been encrypted and / or integrity protected to the access network device, and the access network device decrypts and / or integrity checks the user plane data using a decryption key and / or an integrity protection key; in the downlink direction, the access network device sends user plane data that has been encrypted and / or integrity protected to the terminal device, and the terminal device decrypts and / or integrity checks the user plane data using a decryption key and / or an integrity protection key.

[0004] (2) For transmission of user plane data between an access network device and a user plane network element, the access network device and the user plane network element (or a front-end security gateway of the user plane network element) establish an internet protocol security (IPsec) tunnel to encrypt and / or integrity protect user plane data transmitted in a general packet radio service (GPRS) tunnelling protocol user plane (GTP-U) tunnel. In the uplink direction, the access network device sends user plane data that has been encrypted and / or integrity protected to the user plane network element, and the user plane network element decrypts and / or integrity checks the user plane data using a decryption key and / or an integrity protection key; in the downlink direction, the user plane network element sends user plane data that has been encrypted and / or integrity protected to the access network device, and the access network device decrypts and / or integrity checks the user plane data using a decryption key and / or an integrity protection key.

[0005] Therefore, the uplink user plane data transmitted by the terminal device needs to be decrypted and then encrypted by the access network device before being transmitted to the user plane network element, that is, the uplink user plane data transmitted by the terminal device appears in plaintext form at a certain stage in the access network device. Similarly, the downlink user plane data from the user plane network element needs to be decrypted and then encrypted by the access network device before being transmitted to the terminal device, that is, the downlink user plane data transmitted by the user plane network element appears in plaintext form at a certain stage in the access network device. Since the access network device is deployed in a lower position, that is, relative to the core network in the core room, the access network device is mainly deployed in the wild environment, and thus is more vulnerable to near-end probing and physical attacks.

[0006] In a fifth generation (5G) communication system and future communication systems, some traffic flows in a protocol data unit (PDU) session can be offloaded to a local route by offloading. This offloading can be implemented by inserting an offloading node on a user plane path of the PDU session, which is used to offload traffic flows between a terminal device and multiple user plane anchors. The offloading node can be a branching point (BP) or an uplink classifier (ULCL).

[0007] Security solutions in the offloading scenario are worth studying. SUMMARY

[0008] Embodiments of the present disclosure provide a communication method, a communication apparatus and a communication system for protecting user plane data between a terminal device and multiple user plane network elements in an offloading scenario.

[0009] In a first aspect, embodiments of the present disclosure provide a communication method, which can be applied to a network side, such as a session management network element, a module (such as a circuit, a chip or a chip system, etc.) in the session management network element, or a logic node, a logic module or software capable of realizing all or part of the functions of the session management network element. The method comprises: determining a first intermediate key according to a session root key of a first session of a terminal device, the first intermediate key being used to derive a first session key, the first session key being used to protect first user plane data of the first session and second user plane data of the first session in a transmission process between the terminal device and an offloading node, the first user plane data being transmitted to a first user plane anchor through the offloading node, and the second user plane data being transmitted to a second user plane anchor through the offloading node; and sending the first intermediate key or the first session key to the offloading node.

[0010] According to the scheme, in the offloading scenario of the service flow, the first session key or the first intermediate key used to determine the first session key is sent to the offloading node, so that the offloading node can obtain the first session key, and the first user plane data of the first session transmitted to the first user plane anchor point through the offloading node and the second user plane data of the first session transmitted to the second user plane anchor point are protected based on the first session key in the transmission process between the terminal device and the offloading node. That is, when the first user plane data of the first session is transmitted between the terminal device and the first user plane anchor point through the offloading node, the first user plane data is securely protected by the first session key when being transmitted between the terminal device and the offloading node, and when the second user plane data of the first session is transmitted between the terminal device and the second user plane anchor point through the offloading node, the second user plane data is securely protected by the first session key when being transmitted between the terminal device and the offloading node. Therefore, the scheme can securely protect the user plane data between the terminal device and multiple user plane anchor points in the offloading scenario of the service flow.

[0011] In a possible implementation method, the determining the first intermediate key according to the session root key of the first session of the terminal device comprises: determining the first intermediate key according to the session root key, a first counter and / or a second counter; wherein the first counter is used to record the number of times of deriving intermediate keys for the first session, and the second counter is used to record the number of data packets of the first session that have been transmitted.

[0012] According to the scheme, the first intermediate key is determined using the first counter and / or the second counter, which can accurately determine the intermediate key, and the method is simple and easy to implement, and has low complexity.

[0013] In a possible implementation method, the request message is sent to the first user plane anchor point, the request message is used to request to obtain the second counter, and the second counter is received from the first user plane anchor point.

[0014] According to the scheme, the second counter is maintained by the first user plane anchor point, which can accurately determine the value of the second counter, and helps to improve the accuracy of determining the intermediate key using the second counter.

[0015] In a possible implementation method, the first session key is derived according to the first intermediate key and a first security algorithm, and the first security algorithm comprises a first confidentiality protection algorithm and / or a first integrity protection algorithm.

[0016] In a possible implementation, a user plane security capability of the terminal device is acquired, where the user plane security capability is used to indicate a user plane security algorithm supported by the terminal device; and the first security algorithm is acquired according to the security capability of the terminal device.

[0017] The above scheme determines the first security algorithm based on the user plane security capability of the terminal device, which helps to accurately determine the security algorithm.

[0018] In a possible implementation, the acquiring the first security algorithm according to the security capability of the terminal device includes: sending the user plane security capability to the offloading node; and receiving the first security algorithm from the offloading node, where the user plane security algorithm supported by the terminal device includes the first security algorithm.

[0019] The above scheme determines the first security algorithm by the offloading node, which helps to select a suitable security algorithm for the offloading node.

[0020] In a possible implementation, the first security algorithm is determined according to a second security algorithm, where the second security algorithm is used to protect third user plane data of the first session between the terminal device and the first user plane anchor point.

[0021] The above scheme uses the second security algorithm that has been used as the first security algorithm, that is, the determined first security algorithm is the same as the used second security algorithm, which can reduce the complexity of determining the security algorithm and help to reduce the computing overhead.

[0022] In a possible implementation, a second intermediate key is determined according to the session root key, where the second intermediate key is used to derive a second session key, and the second session key is used to protect the third user plane data of the first session in a transmission process between the terminal device and the first user plane anchor point; and the second intermediate key or the second session key is sent to the first user plane anchor point.

[0023] The above scheme uses the second session key to protect the third user plane data of the first session in the transmission process between the terminal device and the first user plane anchor point before the offloading node is inserted, which can realize end-to-end security protection of the user plane data between the terminal device and the first user plane anchor point.

[0024] In a possible implementation, the second session key is derived according to the second intermediate key and a second security algorithm, where the second security algorithm includes a second confidentiality protection algorithm and / or a second integrity protection algorithm.

[0025] In a possible implementation, a user plane security capability of the terminal device is acquired, the user plane security capability being used to indicate a user plane security algorithm supported by the terminal device; and the second security algorithm is acquired according to the security capability of the terminal device.

[0026] The foregoing scheme is based on the user plane security capability of the terminal device to determine the second security algorithm, which helps to accurately determine the security algorithm.

[0027] In a possible implementation, the acquiring the second security algorithm according to the security capability of the terminal device includes: sending the user plane security capability to the first user plane anchor point; and receiving the second security algorithm from the first user plane anchor point, the user plane security algorithm supported by the terminal device including the second security algorithm.

[0028] The foregoing scheme is based on the user plane security capability of the terminal device to determine the second security algorithm, which helps to accurately determine the security algorithm.

[0029] In a possible implementation, the first indication information is sent to the first user plane anchor point, the first indication information being used to indicate that the downlink user plane data of the first session is not to be secured.

[0030] The foregoing scheme indicates, by the first indication information, the first user plane anchor point not to secure the downlink user plane data of the first session, which guarantees the security of the user plane data of the first session while saving resource overhead. This is because the deployment locations of the split node and the first user plane anchor point are generally in a core machine room, and the security is relatively high. Therefore, even if the data transmission between the first user plane anchor point and the split node is not secured, it is generally safe. Therefore, not securing the user plane data of the first session transmitted between the first user plane anchor point and the split node does not reduce the security, and saves the additional resource overhead due to security protection.

[0031] In a possible implementation, the second indication information is sent to the second user plane anchor point, the second indication information being used to indicate that the downlink user plane data of the first session is not to be secured.

[0032] The above scheme, by the second indication information indicating that the second user plane anchor does not protect the downlink user plane data of the first session, guarantees the safety of the user plane data of the first session while saving resource overhead. This is because the deployment positions of the split node and the second user plane anchor are generally in the core machine room, and the safety is high. Therefore, even if the data transmission between the second user plane anchor and the split node is not protected, it is generally safe. Therefore, the user plane data of the first session transmitted between the second user plane anchor and the split node is not protected, which does not reduce the safety, and saves the additional resource overhead caused by the safety protection.

[0033] In a possible implementation method, the determining, according to a session root key of a first session of the terminal device, of a first intermediate key comprises: determining that information of a home session management network element is not received, and then determining the first intermediate key according to the session root key.

[0034] In a possible implementation method, the determining, according to a session root key of a first session of the terminal device, of a first intermediate key comprises: in a case where it is determined that the user plane data of the first session is split, determining the first intermediate key according to the session root key.

[0035] The above scheme, in a case where it is determined that the user plane data of the first session is split, determines the first intermediate key according to the session root key, thereby avoiding the waste of computing resources caused by determining the first intermediate key when the split is not needed. Therefore, the method helps to reduce resource overhead.

[0036] In a second aspect, an embodiment of the present application provides a communication method, which can be applied to the terminal device side, for example, a terminal device or a communication module in the terminal device, or a circuit or chip responsible for the communication function in the terminal device (such as a modem chip, also known as a baseband chip, or a system on chip (SoC) chip or a system in package (SIP) chip containing a modem core). The method comprises: determining, according to a session root key of a first session of a terminal device, a first intermediate key; and deducing a first session key according to the first intermediate key, the first session key being used to protect first user plane data of the first session and second user plane data of the first session in a transmission process between the terminal device and a split node, the first user plane data being transmitted to a first user plane anchor through the split node, and the second user plane data being transmitted to a second user plane anchor through the split node.

[0037] In the above solution, in the offloading scenario of the service flow, the terminal device obtains the first session key, and protects the first user plane data of the first session and the second user plane data of the first session based on the first session key in the transmission process between the terminal device and the offloading node, the first user plane data being transmitted to the first user plane anchor point through the offloading node, and the second user plane data being transmitted to the second user plane anchor point through the offloading node. That is, when the terminal device and the first user plane anchor point transmit the first user plane data of the first session through the offloading node, the first user plane data is protected by the first session key in the transmission process between the terminal device and the offloading node, and when the terminal device and the second user plane anchor point transmit the second user plane data of the first session through the offloading node, the second user plane data is protected by the first session key in the transmission process between the terminal device and the offloading node. Therefore, the solution can protect the user plane data between the terminal device and the plurality of user plane anchor points in the offloading scenario of the service flow

[0038] In a possible implementation method, the determining the first intermediate key according to the session root key of the first session of the terminal device comprises: determining the first intermediate key according to the session root key, a first counter and / or a second counter; wherein the first counter is used to record the number of times of deriving intermediate keys for the first session, and the second counter is used to record the number of data packets of the first session that have been transmitted.

[0039] In the above solution, the first intermediate key is determined by using the first counter and / or the second counter, which can accurately determine the intermediate key, and the method is simple and easy to implement, and has low complexity.

[0040] In a possible implementation method, the deriving the first session key according to the first intermediate key comprises: deriving the first session key according to the first intermediate key and a first security algorithm, the first security algorithm comprising a first confidentiality protection algorithm and / or a first integrity protection algorithm.

[0041] In a possible implementation method, the first security algorithm is received from a session management network element, or the first security algorithm is received from the offloading node.

[0042] In the above solution, the first security algorithm used for deriving the first session key is indicated to the terminal device by the session management network element or the offloading node, so that the terminal device can accurately determine the first security algorithm used for deriving the first session key, which helps to ensure that the terminal device derives the same first session key as the network side, thereby helping to correctly perform security protection.

[0043] In a possible implementation, a second intermediate key is determined according to the session root key; and a second session key is derived according to the second intermediate key, the second session key being used to protect third user plane data of the first session in a transmission process between the terminal device and the first user plane anchor.

[0044] The above scheme can realize end-to-end security protection of user plane data between the terminal device and the first user plane anchor by using the second session key to protect the third user plane data of the first session in the transmission process between the terminal device and the first user plane anchor before the shunt node is inserted.

[0045] In a possible implementation, deriving the second session key according to the second intermediate key includes deriving the second session key according to the second intermediate key and a second security algorithm, the second security algorithm including a second confidentiality protection algorithm and / or a second integrity protection algorithm.

[0046] In a possible implementation, the second security algorithm is received from a session management network element, or the second security algorithm is received from the first user plane anchor.

[0047] The above scheme indicates the second security algorithm used to derive the second session key to the terminal device by the session management network element or the first user plane anchor, so that the terminal device can accurately determine the second security algorithm used to derive the second session key, which helps to ensure that the terminal device derives the same second session key as the network side, thereby helping to correctly perform security protection.

[0048] In a possible implementation, the first user plane data of the first session is subjected to security processing based on the first session key, and the first user plane data of the first session after security processing is transmitted, a packet header of the first user plane data of the first session after security processing carrying information of the first user plane anchor; and the second user plane data of the first session is subjected to security processing based on the first session key, and the second user plane data of the first session after security processing is transmitted, a packet header of the second user plane data of the first session after security processing carrying information of the second user plane anchor.

[0049] In the above solution, when the terminal device sends the first user plane data of the first session which is protected by security to the first user plane anchor point, the terminal device can carry information of the first user plane anchor point in the first user plane data, so that the offloading node can route the first user plane data to the first user plane anchor point according to the information of the first user plane anchor point. When the terminal device sends the second user plane data of the first session which is protected by security to the second user plane anchor point, the terminal device can carry information of the second user plane anchor point in the second user plane data, so that the offloading node can route the second user plane data to the second user plane anchor point according to the information of the second user plane anchor point. Therefore, based on the information of the first user plane anchor point and the information of the second user plane anchor point, the method can route the user plane data of the first session sent by the terminal device to the correct user plane anchor point.

[0050] In a third aspect, a communication apparatus is provided. The communication apparatus can implement the functions of the first aspect. For example, the communication apparatus can include modules, units or means corresponding to the operations of the first aspect. These modules, units or means can be implemented by software or by hardware, or by a combination of software and hardware.

[0051] In a fourth aspect, a communication apparatus is provided. The communication apparatus can implement the functions of the second aspect. For example, the communication apparatus can include modules, units or means corresponding to the operations of the second aspect. These modules, units or means can be implemented by software or by hardware, or by a combination of software and hardware.

[0052] In a fifth aspect, a communication apparatus is provided. The communication apparatus includes an interface circuit and one or more processors. The one or more processors are coupled to a memory. The memory is configured to store part or all of the computer programs or instructions necessary to implement the functions of the first aspect. The one or more processors can execute the computer programs or instructions, which when executed, cause the communication apparatus to implement the method in any possible design or implementation manner of the first aspect. The interface circuit is configured to implement the communication function within the communication apparatus and / or the communication function of the communication apparatus with other devices or components.

[0053] The communication apparatus can be a session management network element, a module (for example, a circuit, a chip or a chip system, etc.) in the session management network element, or a logic node, a logic module or software capable of implementing all or part of the functions of the session management network element.

[0054] In a sixth aspect, the present application provides a communication apparatus, comprising an interface circuit and one or more processors. The one or more processors are coupled with a memory. The memory is configured to store part or all of the computer programs or instructions necessary for implementing the functions related to the second aspect. The one or more processors can execute the computer programs or instructions, when the computer programs or instructions are executed, to cause the communication apparatus to implement the method in any possible design or implementation manner of the second aspect. The interface circuit is configured to implement the communication function within the communication apparatus and / or the communication function of the communication apparatus with other apparatuses or components.

[0055] In a possible design, the processor is configured to communicate with other apparatuses or components via the interface circuit.

[0056] In a possible design, the communication apparatus can further comprise the memory.

[0057] The communication apparatus can be a terminal device, a communication module in the terminal device, or a chip responsible for the communication function such as a modem chip (also referred to as a baseband chip) or a SoC or SIP chip containing a modem module in the terminal device.

[0058] In a seventh aspect, the present application provides a computer-readable storage medium, which stores computer programs or instructions, when the computer programs or instructions are executed, to implement the method in any possible design of the first aspect to the second aspect.

[0059] In an eighth aspect, the present application provides a computer program product, which comprises computer programs or instructions, when the computer programs or instructions are executed, to implement the method in any possible design of the first aspect to the second aspect.

[0060] In a ninth aspect, the present application provides a communication system, comprising at least two devices: a session management network element, a first user plane anchor, a second user plane anchor, a terminal device, and a split node.

[0061] The session management network element is configured to execute any possible implementation method of the first aspect.

[0062] The first user plane anchor is configured to send or receive user plane data of a first session between the terminal device and the first user plane anchor.

[0063] The second user plane anchor is configured to send or receive user plane data of the first session between the terminal device and the second user plane anchor.

[0064] The terminal device is configured to execute any possible implementation method of the second aspect.

[0065] The shunt node is configured to receive the first intermediate key or the first session key from the session management network element.

[0066] In a possible implementation method, the shunt node is further configured to, in a case where the first intermediate key is received, derive the first session key according to the first intermediate key and a first security algorithm. BRIEF DESCRIPTION OF DRAWINGS

[0067] Figure 1 FIG. 1 is a schematic diagram of a 5G network architecture based on a service-oriented architecture;

[0068] Figure 2 FIG. 2 is a schematic diagram of traffic flow splitting;

[0069] FIG. 3(a) is a flowchart of a communication method provided by an embodiment of the present application;

[0070] FIG. 3(b) is a flowchart of a communication method provided by an embodiment of the present application;

[0071] Figure 4 FIG. 4 is a flowchart of a communication method provided by an embodiment of the present application;

[0072] Figure 5 FIG. 5 is a flowchart of a communication method provided by an embodiment of the present application;

[0073] Figure 6 FIG. 6 is a possible exemplary block diagram of a communication device involved in an embodiment of the present application;

[0074] Figure 7 FIG. 7 is a schematic diagram of a structure of a terminal device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0075] To meet the challenges of wireless broadband technology, maintain the leading advantage of the 3rd generation partnership project (3GPP) network, the 3GPP standard group formulates a 5G network architecture. The architecture not only supports the wireless access technology defined by the 3GPP standard group (such as long term evolution (LTE) access technology, 5G radio access network (RAN) access technology, etc.) to access the 5G core network (CN), but also supports the use of non-3GPP (non-3GPP) access technology to access the core network through non-3GPP interworking function (N3IWF) or next generation packet data gateway (ngPDG).

[0076] Figure 1 A schematic diagram of a 5G network architecture based on a service-based architecture. Figure 1 The 5G network architecture shown can include access network devices and core network devices. A terminal device accesses a data network (DN) through the access network devices and the core network devices. The core network devices include, but are not limited to, some or all of the following network elements: an authentication server function (AUSF) network element, a unified data management (UDM) network element, a unified data repository (UDR) network element, a network repository function (NRF) network element, a network exposure function (NEF) network element, an application function (AF) network element, a policy control function (PCF) network element, an access and mobility management function (AMF) network element, a session management function (SMF) network element, and a user plane function (UPF) network element.

[0077] The access network device, which can also be referred to as a RAN node, a RAN entity, or an access node, etc., is used to help the terminal device to realize wireless access.

[0078] In a possible scenario, the access network device can be a base station, an evolved NodeB (eNodeB), an access point (AP), a transmission reception point (TRP), a next generation NodeB (gNB), a base station in a future mobile communication system, or an access node in a WiFi system, etc. The access network device can be a macro base station, a micro base station, or an indoor station, a relay node or a donor node. Optionally, the access network device can also be a server, a wearable device, a vehicle or a vehicle-mounted device, etc. For example, the access network device in vehicle to everything (V2X) technology can be a roadside unit (RSU). All or part of the functions of the access network device in the present application can also be implemented by software functions running on hardware, or by virtualized functions instantiated on a platform (such as a cloud platform). The access network device can also be provided with a communication module, circuit or chip for performing corresponding communication functions, and program instructions for performing corresponding communication functions. The access network device in the present application can also be a logic node, logic module or software that can implement all or part of the functions of the access network device.

[0079] In another possible scenario, multiple access network devices cooperate to assist a terminal device to implement wireless access, and different access network devices respectively implement part of the functions of a base station. For example, the access network device can be a central unit (CU), a distributed unit (DU), a CU-control plane (CP), a CU-user plane (UP), or a radio unit (RU), etc. The CU and the DU can be separately arranged, or can be included in the same network element, such as a baseband unit (BBU). The RU can be included in a radio frequency device or a radio frequency unit, such as a remote radio unit (RRU), an active antenna processing unit (AAU), or a remote radio head (RRH).

[0080] In different systems, the CU (or CU-CP and CU-UP), DU or RU can also have different names, but those skilled in the art can understand their meanings. For example, in an open radio access network (ORAN) system, the CU can also be referred to as an O-CU (open CU), the DU can also be referred to as an O-DU, the CU-CP can also be referred to as an O-CU-CP, the CU-UP can also be referred to as an O-CU-UP, and the RU can also be referred to as an O-RU. For the convenience of description, the CU, CU-CP, CU-UP, DU and RU are taken as examples for description in this application. Any one of the CU (or CU-CP, CU-UP), DU and RU in this application can be implemented by a software module, a hardware module, or a combination of a software module and a hardware module.

[0081] The terminal device can also be referred to as a terminal, user equipment (UE), mobile station, mobile terminal, etc. The terminal device can be widely applied to various scenarios, such as device-to-device (D2D), vehicle to everything (V2X) communication, machine-type communication (MTC), internet of things (IOT), virtual reality, augmented reality, industrial control, automatic driving, remote medical treatment, smart power grid, smart furniture, smart office, smart wear, smart transportation, smart city, etc. The terminal device can be a mobile phone, tablet computer, computer with wireless transceiver function, wearable device, vehicle, unmanned aerial vehicle, helicopter, airplane, ship, robot, mechanical arm, smart home device, wireless communication function transport vehicle, communication module, etc. Embodiments of the present application do not limit the device form of the terminal device. The terminal device is usually provided with a communication module, circuit or chip for executing corresponding communication functions. The terminal device is also configured with program instructions for executing corresponding communication functions.

[0082] The access network device and the terminal device can be fixed in position or movable. The access network device and the terminal device can be deployed on land, including indoors or outdoors, handheld or vehicle-mounted; can also be deployed on the water surface; can also be deployed on airplanes, balloons and artificial satellites in the air. Embodiments of the present application do not limit the application scenarios of the access network device and the terminal device.

[0083] The AMF network element contains functions such as performing mobility management, or access authentication / authorization. In addition, it is also responsible for transmitting user policies between the terminal device and the PCF network element.

[0084] SMF network element, containing functions such as performing session management, performing control policies issued by the PCF network element, selecting a UPF network element, or allocating an internet protocol (IP) address of a terminal device.

[0085] UPF network element, containing functions such as completing user plane data forwarding, session / stream level-based charging statistics, or bandwidth limitation.

[0086] UDM network element, containing functions such as performing management of subscription data or user access authorization.

[0087] UDR, containing access functions of types of data such as subscription data, policy data, or application data.

[0088] NEF network element, used to support the opening of capabilities and events, so that third parties can indirectly interact with some network elements inside the 3GPP network.

[0089] AF network element, delivering application-side requirements for the network side, such as quality of service (QoS) requirements or user state event subscriptions. The AF can be a third-party functional entity or an application service deployed by an operator, such as an IP Multimedia Subsystem (IMS) voice call service. The AF network element includes an AF network element in the core network (i.e., an operator's AF network element) and a third-party AF network element (such as an application server of a certain enterprise).

[0090] PCF network element, containing policy control functions such as charging, QoS bandwidth guarantee, and mobility management for sessions and service flow levels, or terminal device policy decision.

[0091] NRF network element, which can be used to provide network element discovery functions and provide network element information corresponding to a network element type based on requests from other network elements. The NRF network element also provides network element management services such as network element registration, update, deregistration, or network element state subscription and push.

[0092] AUSF network element, responsible for authenticating users to determine whether to allow the user or device to access the network.

[0093] DN is a network located outside the operator network, the operator network can access multiple DN, and multiple services can be deployed on the DN, which can provide data and / or voice services for terminal devices. For example, the DN is a private network of a certain intelligent factory, the sensors installed in the workshop of the intelligent factory can be terminal devices, and the control server of the sensors is deployed in the DN, which can provide services for the sensors. The sensors can communicate with the control server, obtain instructions from the control server, and transmit the collected sensor data to the control server according to the instructions, etc. For another example, the DN is an internal office network of a certain company, the mobile phones or computers of the employees of the company can be terminal devices, and the mobile phones or computers of the employees can access information and data resources on the internal office network of the company.

[0094] Figure 1 Nausf, Npcf, Nudr, Nudm, Naf, Namf, Nsmf, Nnef, and Nnrf are service-based interfaces (SBI) provided by the above-mentioned AUSF, PCF, UDR, UDM, AF, AMF, SMF, NEF, and NRF, respectively, for invoking corresponding service operations. N1, N2, N3, N4, and N6 are interface sequence numbers, and the meanings of these interface sequence numbers are as follows:

[0095] 1) N1: the interface between the AMF network element and the terminal device, which can be used to transmit non-access stratum (NAS) signaling (such as QoS rules from the AMF network element) to the terminal device, etc.

[0096] 2) N2: the interface between the AMF network element and the access network device, which can be used to transmit wireless bearer control information from the core network side to the access network device, etc.

[0097] 3) N3: the interface between the access network device and the UPF network element, which is mainly used to transmit uplink and downlink user plane data between the access network device and the UPF network element.

[0098] 4) N4: the interface between the SMF network element and the UPF network element, which can be used to transmit information between the control plane and the user plane, including the downlink of the control plane to the user plane forwarding rules, QoS rules, traffic statistics rules, etc. and the information reporting of the user plane.

[0099] 5) N6: the interface between the UPF network element and the DN, which is used to transmit uplink and downlink user data flow between the UPF network element and the DN.

[0100] Figure 1The various network function network elements in the illustrated architecture are connected through a service bus and interact through service interfaces. The service bus has the advantages of improving the flexibility, openness, scalability and intelligence of the network, and can support diversified business scenarios and needs. The service bus can be used to transmit various types of data and signaling, such as real-time signaling (e.g., service interface invocation signaling between network element function network elements) that is sensitive to latency, real-time data (e.g., real-time artificial intelligence inference data) that is sensitive to latency, and non-real-time data (e.g., data for offline artificial intelligence training). Moreover, when the service bus transmits these data or signaling, the data or signaling are coupled together, that is, the service bus can be used to transmit real-time signaling, real-time data and non-real-time data at the same time.

[0101] It should be noted that the above various network elements (e.g., SMF network element, UPF network element, etc.) can also omit the "network element" when described, for example, the SMF network element is simply referred to as SMF, the UPF network element is simply referred to as UPF, etc. Moreover, in Figure 1 , this brief description is also used.

[0102] It can be understood that the above network elements or functions can be network elements in hardware devices, or software functions running on dedicated hardware, or virtualized functions instantiated on a platform (e.g., a cloud platform). Optionally, the above network elements or functions can be implemented by one device, or by multiple devices together, or can be a functional module within a device, and the embodiments of the present application do not make specific limitations.

[0103] The user plane network element and the session management network element in the present application can be the UPF network element and the SMF network element in Figure 1 , or can be network elements having the functions of the above UPF network element and SMF network element in future communication networks, and the present application does not make limitations.

[0104] In the current mobile communication network, the user plane data sent by the terminal device is sent to the user plane network element through the access network device, and the user plane data is protected by a hop-by-hop security mechanism during transmission. Specifically:

[0105] (1) For the transmission of user plane data between the terminal device and the access network device, in the uplink direction, the terminal device sends user plane data that has been encrypted and / or integrity protected to the access network device, and the access network device decrypts and / or integrity checks the user plane data using a decryption key and / or an integrity protection key; in the downlink direction, the access network device sends user plane data that has been encrypted and / or integrity protected to the terminal device, and the terminal device decrypts and / or integrity checks the user plane data using a decryption key and / or an integrity protection key.

[0106] (2) For the transmission of user plane data between the access network device and the user plane network element, the access network device and the user plane network element (or the front security gateway of the user plane network element) establish IPsec between them to encrypt and / or integrity protect the user plane data transmitted in the GTP-U tunnel. In the uplink direction, the access network device sends the user plane data encrypted and / or integrity protected to the user plane network element, and the user plane network element decrypts and / or integrity checks the user plane data using the decryption key and / or integrity protection key; in the downlink direction, the user plane network element sends the user plane data encrypted and / or integrity protected to the access network device, and the access network device decrypts and / or integrity checks the user plane data using the decryption key and / or integrity protection key.

[0107] Therefore, the uplink user plane data sent by the terminal device needs to be decrypted and then encrypted at the access network device before being transmitted to the user plane network element, i.e., the uplink user plane data sent by the terminal device appears in plaintext form at the access network device at some stage. Similarly, the downlink user plane data from the user plane network element needs to be decrypted and then encrypted at the access network device before being transmitted to the terminal device, i.e., the downlink user plane data sent by the user plane network element appears in plaintext form at the access network device at some stage. Since the access network device is deployed in a lower position, i.e., relative to the core network in the core room, the access network device is mainly deployed in the wild environment, and thus is more vulnerable to near-end probing and physical attacks.

[0108] In future communications, in many scenarios, users and upper-layer services are more willing to be able to establish end-to-end security protection directly between the terminal device and the user plane network element, and the access network device can only forward the encrypted user plane data and cannot obtain the specific content of the transmitted user plane data.

[0109] In the 5G communication system and future communication systems, some traffic flows in a PDU session can be split to local routing by a split manner. This split manner can be implemented by inserting a split node on the user plane path of the PDU session, and the split node is used to split traffic flows between the terminal device and multiple user plane anchors. The split node can be a BP or a ULCL. The function of the split node can be performed by a user plane network element, i.e., the split node can be a user plane network element or a functional unit on the user plane network element.

[0110] The difference between ULCL and BP is that in the ULCL architecture, the terminal device is not aware of whether the PDU session is inserted with ULCL, or in other words, the terminal device is not aware of the anchor point switching of user plane data, that is, the address information (such as IP address and port number) in the uplink data packet and the downlink data packet in the PDU session of the terminal device remains unchanged before and after the insertion of ULCL; in the BP architecture, the terminal device is aware of whether the PDU session is inserted with BP, or in other words, the terminal device is aware of the anchor point switching of user plane data, that is, the address information in the uplink data packet and the downlink data packet in the PDU session of the terminal device will change before and after the insertion of BP, and the address information in the data packet from different user plane network elements is different.

[0111] Suppose that the user plane network element selected when establishing the PDU session of the terminal device is user plane network element #1, which is also called PDU session anchor (PSA), and is denoted as PSA#1 below. When there is a need for traffic splitting, the session management network element (which can be, for example, an SMF network element) inserts user plane network element #2 for the PDU session, which is denoted as PSA#2 below. Then the session management network element inserts a splitting node for the PDU session. At this time, one PDU session of the terminal device has two PSAs, namely PSA#1 and PSA#2, and the splitting node is used for splitting traffic between PSA#1 and PSA#2. In the uplink direction, the splitting node receives the uplink traffic from the terminal device and sends the uplink traffic to PSA#1 or PSA#2 according to the forwarding rule or the splitting rule. In the downlink direction, the splitting node receives the downlink traffic from PSA#1 and PSA#2 and sends the downlink traffic to the terminal device according to the forwarding rule or the splitting rule.

[0112] In this application, the PSA first selected for the PDU session of the terminal device is called the primary PSA, the primary user plane anchor or the primary anchor user plane network element, and the PSA inserted due to the need for splitting is called the secondary PSA, the secondary user plane anchor or the secondary anchor user plane network element. The primary PSA remains unchanged during the existence of the PDU session, and the secondary PSA can be switched.

[0113] Figure 2Fig. 1 is a schematic diagram of traffic splitting of a service flow. There are service flow #1 and service flow #2 between the terminal device and the DN. In the uplink direction, there is uplink service flow #1 between the terminal device and PSA #1, and there is uplink service flow #2 between the terminal device and PSA #2; in the downlink direction, there is downlink service flow #1 between the terminal device and PSA #1, and there is downlink service flow #2 between the terminal device and PSA #2. In the uplink direction, the traffic splitting node receives uplink service flow #1 and uplink service flow #2 from the terminal device, and sends uplink service flow #1 to PSA #1 and uplink service flow #2 to PSA #2. In the downlink direction, the traffic splitting node receives downlink service flow #1 from PSA #1 and downlink service flow #2 from PSA #2, aggregates downlink service flow #1 and downlink service flow #2 into an N3 tunnel between the traffic splitting node and the access network device, and sends to the access network device, which then sends to the terminal device.

[0114] According to the foregoing description, in transmitting user plane data of a service flow, the future communication network has a demand for establishing end-to-end security protection between a terminal device and a user plane network element for the user plane data. Based on this demand, in the traffic splitting scenario of the service flow, before inserting the traffic splitting node, when a PDU session is established, end-to-end security protection between the terminal device and PSA #1 is first established, and after inserting the traffic splitting node, if the transmitted user plane data still uses the end-to-end security protection between the terminal device and PSA #1, the traffic splitting node will not be able to obtain the address information of the user plane data, and thus the traffic splitting node cannot split the user plane data, resulting in the inability to implement traffic splitting of the service flow.

[0115] To solve the above problem, the present application provides a corresponding solution.

[0116] The communication method and the communication device will be further described below in conjunction with the drawings. It can be understood that the present application takes the session management network element and the terminal device as an example to illustrate the execution subject of the interaction, but the present application does not limit the execution subject of the interaction. For example, the method executed by the session management network element in the present application can also be implemented by a module (such as a circuit, a chip or a chip system, etc.) in the session management network element, or a logical node, a logical module or software capable of implementing all or part of the functions of the session management network element; the method executed by the terminal device in the present application can also be implemented by a communication module in the terminal device or a circuit or chip (such as a modem chip (also known as a baseband chip), or a SoC chip containing a modem core, or a SIP chip) responsible for communication functions in the terminal device.

[0117] Figure 3(a) is a flowchart illustrating a communication method provided in an embodiment of this application. This method is applicable to the traffic splitting scenario of the first session. Specifically, the first session established by the terminal device corresponds to two user plane anchor points (also known as user plane network elements, anchor user plane network elements, or user plane anchor network elements, etc.), namely the first user plane anchor point and the second user plane anchor point. The user plane data of the first session between the terminal device and the first user plane anchor point, as well as the user plane data of the first session between the terminal device and the second user plane anchor point, are all routed or split by the traffic splitting node of the first session (e.g., BP or UL CL, etc.).

[0118] The first user plane anchor point is the user plane network element selected by the session management network element when the terminal device establishes the first session. This first user plane anchor point can be referred to as the primary user plane anchor point (also called the primary user plane anchor point network element or primary anchor user plane network element). For example, refer to Figure 2 For example, the first user plane anchor point could be Figure 2 PSA#1 in the middle.

[0119] The second user plane anchor point is a new user plane network element inserted by the session management network element after the terminal device establishes the first session and the session management network element selects the first user plane anchor point, when there is a traffic splitting requirement in the first session's service flow. This second user plane anchor point can be called a secondary user plane anchor point (also known as a secondary user plane anchor point network element or secondary anchor user plane network element). Alternatively, the second user plane anchor point can also be a user plane anchor point obtained by replacing the primary user plane anchor point after selecting the primary user plane anchor point and initially inserting the secondary user plane anchor point. For example, refer to... Figure 2 For example, the first user plane anchor point could be Figure 2 In PSA#1, the second user plane anchor point can be Figure 2 The PSA#2 in the selection can be either a PSA that is inserted for the first time after selecting PSA#1, or a PSA that is not inserted for the first time after selecting PSA#1.

[0120] The method includes the following steps:

[0121] Step 301a: The session management network element determines the first intermediate key based on the session root key of the first session of the terminal device.

[0122] The first session can be a PDU session of the terminal device or other types of sessions. This application does not limit the type of the first session.

[0123] The first session's root key is a session-level root key, meaning that each session on the terminal device has a corresponding root key.

[0124] The application does not limit the way in which the session management network element obtains the session root key of the first session. For example, the session management network element can derive the session root key of the first session according to the identifier of the first session. For another example, the session management network element obtains the session root key of the first session from other network elements (such as a UDM network element, a NRF network element, or a UDR, etc.).

[0125] The first intermediate key is used to derive a first session key, and the first session key is used to protect first user plane data of the first session and second user plane data of the first session in a transmission process between the terminal device and the split node, the first user plane data being transmitted to the first user plane anchor point through the split node, and the second user plane data being transmitted to the second user plane anchor point through the split node.

[0126] For example, in the uplink direction, when the terminal device needs to send the first user plane data of the first session to the first user plane anchor point, the terminal device uses the first session key to perform security protection on the first user plane data, and the first user plane data is sent to the split node via the access network device. The access network device cannot analyze the first user plane data, but the split node can analyze the first user plane data according to the first session key, and can know that the first user plane data needs to be sent to the first user plane anchor point according to the information (such as a port number and / or an address) of the second user plane anchor point carried by the first user plane data, and then the split node sends the first user plane data to the first user plane anchor point. The first user plane data is protected when transmitted between the terminal device and the split node. The first user plane data can not be protected in the session granularity when transmitted between the split node and the first user plane anchor point, but directly depends on the node-level security protection between the first user plane anchor point and the split node, such as an IPsec or a transport layer security (TLS) security tunnel between the first user plane anchor point and the split node, because the deployment positions of the split node and the first user plane anchor point are generally in a core room, and the security is high.

[0127] For example, in the uplink direction, when the terminal device needs to send second user plane data of the first session to the second user plane anchor point, the terminal device uses the first session key to securely protect the second user plane data, and the second user plane data is sent to the split node via the access network device. The access network device cannot analyze the second user plane data, but the split node can analyze the second user plane data according to the first session key, and according to the information (such as the port number and / or address) of the second user plane anchor point carried by the second user plane data, it is known that the second user plane data needs to be sent to the second user plane anchor point, and then the split node sends the second user plane data to the second user plane anchor point. The second user plane data is securely protected when transmitted between the terminal device and the split node. The second user plane data can not be securely protected at the session granularity when transmitted between the split node and the second user plane anchor point, but directly relies on the node-level security protection between the second user plane anchor point and the split node, such as the IPsec or TLS security tunnel between the second user plane anchor point and the split node, because the deployment locations of the split node and the second user plane anchor point are generally in the core machine room, which is relatively safe.

[0128] For example, in the uplink direction, when the terminal device needs to send second user plane data of the first session to the second user plane anchor point, the terminal device uses the first session key to securely protect the second user plane data, and the second user plane data is sent to the split node via the access network device. The access network device cannot analyze the second user plane data, but the split node can analyze the second user plane data according to the first session key, and according to the information (such as the port number and / or address) of the second user plane anchor point carried by the second user plane data, it is known that the second user plane data needs to be sent to the second user plane anchor point, and then the split node sends the second user plane data to the second user plane anchor point. The second user plane data is securely protected when transmitted between the terminal device and the split node. The second user plane data can not be securely protected at the session granularity when transmitted between the split node and the second user plane anchor point, but directly relies on the node-level security protection between the second user plane anchor point and the split node, such as the IPsec or TLS security tunnel between the second user plane anchor point and the split node, because the deployment locations of the split node and the second user plane anchor point are generally in the core machine room, which is relatively safe.

[0129] For another example, in the downlink direction, when the second user plane anchor point needs to send fourth user plane data of the first session to the terminal device, the second user plane anchor point sends the fourth user plane data without security protection to the splitting node. The splitting node receives the fourth user plane data, performs security protection on the fourth user plane data using the first session key, and learns that the fourth user plane data needs to be sent to the terminal device according to the information (for example, a port number and / or an address) of the terminal device carried by the fourth user plane data, and then sends the fourth user plane data with security protection to the terminal device via the access network device, wherein the access network device cannot analyze the fourth user plane data. The fourth user plane data is protected by security when being transmitted between the splitting node and the terminal device. It should be noted that since the deployment positions of the splitting node and the second user plane anchor point are generally located in a core machine room, the security is high, and thus even if the data is not protected by the session granularity security when being transmitted between the second user plane anchor point and the splitting node, but directly depends on the node-level security protection between the second user plane anchor point and the splitting node, the security can also be ensured.

[0130] The first session key can be derived by the session management network element or the splitting node.

[0131] If the first session key is derived by the session management network element, the session management network element can derive the first session key according to the first intermediate key and the first security algorithm. The first security algorithm includes a first confidentiality protection algorithm and / or a first integrity protection algorithm. For example, if the first security algorithm includes the first confidentiality protection algorithm, the first session key derived by the session management network element includes a first session encryption and decryption key. For another example, if the first security algorithm includes the first integrity protection algorithm, the first session key derived by the session management network element includes a first session integrity protection key. For another example, if the first security algorithm includes the first confidentiality protection algorithm and the first integrity protection algorithm, the first session key derived by the session management network element includes the first session encryption and decryption key and the first session integrity protection key.

[0132] For example, the session management network element can determine the first security algorithm used to derive the first session key according to any one of the following methods 1 to 3:

[0133] Method 1: The session management network element obtains a user plane security capability of the terminal device, the user plane security capability being used to indicate a user plane security algorithm supported by the terminal device, and the session management network element determines the first security algorithm according to the user plane security capability of the terminal device. The user plane security algorithm supported by the terminal device includes the first security algorithm, and the splitting node supports the first security algorithm.

[0134] For example, the user plane security capability of the terminal device indicates that the terminal device supports confidentiality protection algorithm #1, confidentiality protection algorithm #2 and confidentiality protection algorithm #3, and supports integrity protection algorithm #1, integrity protection algorithm #2 and integrity protection algorithm #3. The session management network element selects confidentiality protection algorithm #1 and integrity protection algorithm #3, that is, the first security algorithm determined by the session management network element includes confidentiality protection algorithm #1 and integrity protection algorithm #3.

[0135] For example, the user plane security capability of the terminal device indicates that the terminal device supports confidentiality protection algorithm #1, confidentiality protection algorithm #2 and confidentiality protection algorithm #3, and supports integrity protection algorithm #1, integrity protection algorithm #2 and integrity protection algorithm #3. The session management network element selects confidentiality protection algorithm #1 and integrity protection algorithm #3, that is, the first security algorithm determined by the session management network element includes confidentiality protection algorithm #1 and integrity protection algorithm #3.

[0136] Method 2, the session management network element obtains the user plane security capability of the terminal device, the user plane security capability is used to indicate the user plane security algorithm supported by the terminal device, the session management network element sends the user plane security capability of the terminal device to the split node, and the split node determines the first security algorithm according to the user plane security capability of the terminal device and sends the first security algorithm to the session management network element. Wherein, the user plane security algorithm supported by the terminal device includes the first security algorithm, and the split node supports the first security algorithm.

[0137] For example, the user plane security capability of the terminal device indicates that the terminal device supports confidentiality protection algorithm #1, confidentiality protection algorithm #2 and confidentiality protection algorithm #3, and supports integrity protection algorithm #1, integrity protection algorithm #2 and integrity protection algorithm #3. The split node selects confidentiality protection algorithm #1 and integrity protection algorithm #3, that is, the first security algorithm includes confidentiality protection algorithm #1 and integrity protection algorithm #3. Then the split node sends the indication information for indicating the first security algorithm to the session management network element.

[0138] As an implementation method, the session management network element can obtain the user plane security capability of the terminal device from the terminal device, or obtain the user plane security capability of the terminal device from other network elements (such as UDM network element, NRF network element or UDR, etc.), and the application does not limit the implementation method of the session management network element obtaining the user plane security capability of the terminal device.

[0139] Method 3, the session management network element determines the first security algorithm according to the second security algorithm, and the second security algorithm is used to protect the third user plane data of the first session between the terminal device and the first user plane anchor point.

[0140] Optionally, the session management network element selects the offloading node according to a second security algorithm when selecting the offloading node. The session management network element selects the offloading node according to the second security algorithm specifically by selecting a user plane network element supporting the second security algorithm as the offloading node.

[0141] At step 302a, the session management network element sends the first intermediate key or the first session key to the offloading node. Correspondingly, the offloading node receives the first intermediate key or the first session key.

[0142] In one implementation method, if the first session key is determined by the session management network element, at step 302a, the session management network element sends the first session key to the first user plane anchor.

[0143] In another implementation method, if the first session key is determined by the offloading node, at step 302a, the session management network element sends the first intermediate key to the offloading node, and then the offloading node derives the first session key according to the first intermediate key.

[0144] Exemplarily, if the first session key is derived by the offloading node according to the first intermediate key, after receiving the first intermediate key from the session management network element, the offloading node can derive the first session key according to the first intermediate key and the first security algorithm. The meaning of the first security algorithm can be referred to the related description in step 301a.

[0145] In one implementation method, if the first session key is determined by the offloading node, when the session management network element sends the first intermediate key to the offloading node, the session management network element can also send the user plane security capability of the terminal device to the offloading node, the user plane security capability is used to indicate the user plane security algorithm supported by the terminal device, and the offloading node determines the first security algorithm according to the user plane security algorithm supported by the terminal device. The user plane security algorithm supported by the terminal device includes the first security algorithm, and the offloading node supports the first security algorithm. It should be noted that the first intermediate key and the user plane security capability of the terminal device sent by the session management network element to the offloading node can be carried in the same message, or can be carried in different messages respectively.

[0146] In another implementation method, if the first session key is determined by the offloading node, when the session management network element sends the first intermediate key to the offloading node, the session management network element can also send the first security algorithm to the offloading node, so that the offloading node can obtain the first security algorithm used to derive the first session key from the session management network element. It should be noted that the first intermediate key and the first security algorithm sent by the session management network element to the offloading node can be carried in the same message, or can be carried in different messages respectively.

[0147] Based on the above scheme, in the offloading scenario of the service flow, the offloading node obtains the first session key, and the terminal device also derives the first session key in the same way as the session management network element or the offloading node. When the terminal device and the first user plane anchor point transmit the first user plane data of the first session through the offloading node, the first user plane data is securely protected when transmitted between the terminal device and the offloading node, and when the terminal device and the second user plane anchor point transmit the second user plane data of the first session through the offloading node, the second user plane data is securely protected when transmitted between the terminal device and the offloading node. Therefore, the scheme can securely protect the user plane data between the terminal device and the plurality of user plane anchors in the offloading scenario of the service flow.

[0148] Since the user plane data of the first session is securely protected between the terminal device and the offloading node, the access network device can only forward the encrypted user plane data and cannot obtain the specific content of the transmitted user plane data, thereby reducing the security risk of user plane data leakage due to attacks on the access network device.

[0149] Some implementation details of the above embodiment of FIG. 3(a) are described below.

[0150] The specific implementation of the session management network element determining the first intermediate key in the above step 301a is introduced below. For example, the session management network element determines the first intermediate key according to the session root key of the first session and the first counter and / or the second counter. For example, the session management network element determines the first intermediate key according to the session root key of the first session and the first counter. For example, the session management network element determines the first intermediate key according to the session root key of the first session and the second counter. For example, the session management network element determines the first intermediate key according to the session root key of the first session, the first counter and the second counter.

[0151] The first counter is independently maintained by the session management network element and the terminal device, respectively. The first counter is a session granularity counter. Specifically, the first counter is a counter corresponding to the first session. The first counter is used to record the number of times of deriving an intermediate key for the first session, that is, to indicate the number of times the first counter is used to derive an intermediate key. The number of records can be recorded in an incremental manner or in a decremental manner. For example, the initial value of the first counter is set to 0, and the session management network element increments the record value of the first counter by 1 after deriving an intermediate key using the current record value of the first counter each time. For example, the first counter can also have other names, such as a session management counter (SM counter).

[0152] The second counter can be maintained independently by the first user plane anchor and the terminal device respectively. The second counter is a session granularity counter, and is used to record the number of data packets of the first session that have been transmitted. The data packets that have been transmitted include uplink data packets and / or downlink data packets. For example, the number of downlink data packets of the first session that have been transmitted to the terminal device is 100, and the number of uplink data packets of the first session that have been transmitted to the first user plane anchor and / or the second user plane anchor is 200, the value of the second counter can be 100, or 200, or 300. The second counter can also be referred to as a user plane counter (UP counter) for example. When the session management network element needs to derive the first intermediate key using the second counter, the session management network element can send a request message to the first user plane anchor, the request message being used to request the second counter, and then the first user plane anchor sends the second counter to the session management network element. It should be noted that if some data packets of the first session are retransmitted due to packet loss or the like, the retransmitted data packets can not be counted in the second counter.

[0153] In a possible implementation method, before step 301a, the terminal device and the first user plane anchor can use a second session key for end-to-end security protection without inserting the split node and the second user plane anchor, that is, the second session key is used to protect the third user plane data of the first session in the transmission process between the terminal device and the first user plane anchor. For example, in the uplink direction, when the terminal device needs to send user plane uplink data of the first session to the first user plane anchor, the second session key is used to protect the user plane uplink data, and the user plane uplink data protected by security is sent to the first user plane anchor via the access network device, at this time, the access network device cannot analyze the user plane uplink data, and the first user plane anchor can analyze the user plane uplink data based on the second session key. For another example, in the downlink direction, when the first user plane anchor needs to send user plane downlink data of the first session to the terminal device, the second session key is used to protect the user plane downlink data, and the user plane downlink data protected by security is sent to the terminal device via the access network device, at this time, the access network device cannot analyze the user plane downlink data, and the terminal device can analyze the user plane downlink data based on the second session key.

[0154] In an implementation method, the session management network element can determine a second intermediate key according to the session root key of the first session, and then the session management network element derives a second session key according to the second intermediate key and a second security algorithm, or the session management network element sends the second intermediate key to the first user plane anchor point, and then the first user plane anchor point derives the second session key according to the second intermediate key and the second security algorithm. The second session key is used to protect the third user plane data of the first session in the transmission process between the terminal device and the first user plane anchor point. Wherein, the second security algorithm includes a second confidentiality protection algorithm and / or a second integrity protection algorithm. For example, if the second security algorithm includes the second confidentiality protection algorithm, the second session key derived by the session management network element or the first user plane anchor point includes a second session encryption and decryption key. For another example, if the second security algorithm includes the second integrity protection algorithm, the second session key derived by the session management network element or the first user plane anchor point includes a second session integrity protection key. For another example, if the second security algorithm includes the second confidentiality protection algorithm and the second integrity protection algorithm, the second session key derived by the session management network element or the first user plane anchor point includes the second session encryption and decryption key and the second session integrity protection key.

[0155] Wherein, the way that the session management network element determines the second intermediate key is similar to the way that the session management network element determines the first intermediate key, that is, the session management network element can determine the second intermediate key according to the session root key of the first session, and the first counter and / or the second counter. For example, the session management network element determines the second intermediate key according to the session root key of the first session and the first counter. For another example, the session management network element determines the second intermediate key according to the session root key of the first session and the second counter. For another example, the session management network element determines the second intermediate key according to the session root key of the first session, the first counter and the second counter. But it should be noted that if the value of the first counter is used when determining the first intermediate key and the second intermediate key, the value of the first counter used for determining the first intermediate key is different from the value of the first counter used for determining the second intermediate key. If the value of the second counter is used when determining the first intermediate key and the second intermediate key, the value of the second counter used for determining the first intermediate key can be the same as or different from the value of the second counter used for determining the second intermediate key.

[0156] Exemplarily, if the session management network element derives the second session key according to the second intermediate key and the second security algorithm, the session management network element can determine the second security algorithm used to derive the second session key according to any one of the following method A to method B:

[0157] The method A comprises the following steps: a session management network element acquires a user plane security capability of a terminal device, the user plane security capability being used for indicating a user plane security algorithm supported by the terminal device; the session management network element determines a second security algorithm according to the user plane security capability of the terminal device. The user plane security algorithm supported by the terminal device comprises the second security algorithm, and the first user plane anchor point supports the second security algorithm.

[0158] For example, the user plane security capability of the terminal device indicates that the terminal device supports confidentiality protection algorithm #1, confidentiality protection algorithm #2 and confidentiality protection algorithm #3, and supports integrity protection algorithm #1, integrity protection algorithm #2 and integrity protection algorithm #3. The session management network element selects confidentiality protection algorithm #2 and integrity protection algorithm #1, that is, the second security algorithm determined by the session management network element comprises confidentiality protection algorithm #2 and integrity protection algorithm #1.

[0159] For example, the session management network element determines the second security algorithm according to the user plane security capability of the terminal device and the user plane security algorithm supported by the first user plane anchor point. The session management network element can be locally configured with the user plane security algorithm supported by the first user plane anchor point, or can acquire the user plane security algorithm supported by the first user plane anchor point from the first user plane anchor point.

[0160] The method B comprises the following steps: a session management network element acquires a user plane security capability of a terminal device, the user plane security capability being used for indicating a user plane security algorithm supported by the terminal device; the session management network element sends the user plane security capability of the terminal device to a first user plane anchor point; a split node determines a second security algorithm according to the user plane security capability of the terminal device and sends the second security algorithm to the session management network element. The user plane security algorithm supported by the terminal device comprises the second security algorithm, and the first user plane anchor point supports the second security algorithm.

[0161] For example, the user plane security capability of the terminal device indicates that the terminal device supports confidentiality protection algorithm #1, confidentiality protection algorithm #2 and confidentiality protection algorithm #3, and supports integrity protection algorithm #1, integrity protection algorithm #2 and integrity protection algorithm #3. The first user plane anchor point selects confidentiality protection algorithm #2 and integrity protection algorithm #1, that is, the second security algorithm comprises confidentiality protection algorithm #2 and integrity protection algorithm #1. Then the first user plane anchor point sends indication information used for indicating the second security algorithm to the session management network element.

[0162] For example, if the second session key is derived by the first user plane anchor point according to the second intermediate key and the second security algorithm, the first user plane anchor point can determine the second security algorithm used for deriving the second session key according to any one of the following methods a to b:

[0163] In a possible implementation, the first user plane anchor receives, from the session management network element, a second security algorithm, i.e., the second security algorithm is determined by the session management network element and sent to the first user plane anchor.

[0164] In a possible implementation, the first user plane anchor obtains a user plane security capability of the terminal device, where the user plane security capability is used to indicate a user plane security algorithm supported by the terminal device, and the first user plane anchor determines the second security algorithm according to the user plane security algorithm supported by the terminal device. The user plane security algorithm supported by the terminal device includes the second security algorithm, and the first user plane anchor supports the second security algorithm.

[0165] In a possible implementation, the session management network element further sends, to the first user plane anchor, first indication information used to indicate that the downlink user plane data of the first session is not to be protected by security. That is, when the first user plane anchor needs to send the downlink user plane data of the first session to the terminal device, the first user plane anchor does not protect the downlink user plane data of the first session by security, and the downlink user plane data of the first session is protected by the split node using the first session key after reaching the split node.

[0166] In a possible implementation, the session management network element further sends, to the second user plane anchor, second indication information used to indicate that the downlink user plane data of the first session is not to be protected by security. That is, when the second user plane anchor needs to send the downlink user plane data of the first session to the terminal device, the second user plane anchor does not protect the downlink user plane data of the first session by security, and the downlink user plane data of the first session is protected by the split node using the first session key after reaching the split node.

[0167] In a possible implementation, before the step 301a, the session management network element further determines to split the user plane data of the first session, i.e., the session management network element performs the step 301a and subsequent steps in the embodiment of FIG. 3(a) in a case where it is determined to split the user plane data of the first session. Exemplarily, the session management network element receives indication information from the terminal device or the AF network element, where the indication information is used to indicate to split the user plane data of the first session.

[0168] In a possible implementation, the session management network element for performing the method embodiment of FIG. 3(a) can be a visited session management network element (for example, a visited SMF (v-SMF)) or a home session management network element (for example, a home SMF (h-SMF)). For example, if the visited session management network element determines that the first session uses a home routing (HR) mode, the method embodiment of FIG. 3(a) is determined to be performed by the home session management network element, and a specific implementation can be that if the visited session management network element receives information of the home session management network element (for example, an identifier or an address of the home session management network element), the visited session management network element determines that the method embodiment of FIG. 3(a) is performed by the home session management network element; if the visited session management network element determines that the first session uses a local breakout (LBO) mode, the method embodiment of FIG. 3(a) is determined to be performed by the visited session management network element, and a specific implementation can be that if the visited session management network element does not receive information of the home session management network element (for example, an identifier or an address of the home session management network element), the visited session management network element determines that the method embodiment of FIG. 3(a) is performed by the visited session management network element.

[0169] FIG. 3(b) is a flowchart of a communication method according to an embodiment of the present application. The method is a terminal device-side execution method corresponding to the method embodiment of FIG. 3(a), and thus the method is applicable to the same scenario as the method embodiment of FIG. 3(a).

[0170] The method includes the following steps.

[0171] In step 301b, the terminal device determines a first intermediate key according to a session root key of a first session of the terminal device.

[0172] The session root key and the first intermediate key can refer to the description in the method embodiment of FIG. 3(a).

[0173] The method for the terminal device to determine the first intermediate key is the same as the method for the session management network element to determine the first intermediate key, and thus the first intermediate key determined by the terminal device is the same as the first intermediate key determined by the session management network element.

[0174] In step 302b, the terminal device derives a first session key according to the first intermediate key.

[0175] The first session key can refer to the description in the method embodiment of FIG. 3(a).

[0176] The terminal device determines the first session key according to the first intermediate key. The method for the terminal device to determine the first session key is the same as the method for the session management network element or the offloading node to determine the first session key, and thus the first session key determined by the terminal device and the first session key determined by the session management network element or the offloading node are the same session key.

[0177] Based on the above scheme, in the offloading scenario of the service flow, the terminal device obtains the first session key, the first user plane data of the first session is securely transmitted between the terminal device and the offloading node when the terminal device and the first user plane anchor transmit the first user plane data through the offloading node, and the second user plane data of the first session is securely transmitted between the terminal device and the offloading node when the terminal device and the second user plane anchor transmit the second user plane data through the offloading node, and thus the scheme can securely protect the user plane data between the terminal device and the multiple user plane anchors in the offloading scenario of the service flow.

[0178] In a possible implementation method, before the step 301b, before the insertion of the offloading node and the second user plane anchor, the terminal device also determines a second intermediate key in the same manner as the session management network element, and determines a second session key according to the second intermediate key, the second session key being used to protect the third user plane data of the first session in the transmission process between the terminal device and the first user plane anchor. The second session key determined by the terminal device and the second session key determined by the session management network element or the first user plane anchor are the same session key.

[0179] In a possible implementation method, before the step 301b, the terminal device also determines to offload the user plane data of the first session, that is, the terminal device executes the step 301b and the subsequent steps in the case of determining to offload the user plane data of the first session.

[0180] The embodiments of FIG. 3(a) and FIG. 3(b) can be combined, that is, at the network side, the session management network element or the splitting node determines a first session key for protecting the first user plane data of the first session and the second user plane data of the first session in the transmission process between the terminal device and the splitting node, the first user plane data is transmitted to the first user plane anchor point through the splitting node, and the second user plane data is transmitted to the second user plane anchor point through the splitting node, at the terminal side, the terminal device determines the first session key, and the network side determines that the first session key determined by the terminal device is the same as the first session key determined by the terminal device. When the terminal device and the first user plane anchor point transmit user plane data, the user plane data is routed through the splitting node, and the first session key is used for security protection in the transmission process between the terminal device and the splitting node. When the terminal device and the second user plane anchor point transmit user plane data, the user plane data is routed through the splitting node, and the first session key is also used for security protection in the transmission process between the terminal device and the splitting node. Therefore, the splitting node can obtain the specific data content of the user plane data of the first session, and can also obtain the packet header of the user plane data of the first session. In the uplink direction, if the terminal device sends the user plane data of the first session to the first user plane anchor point, the packet header carries the information of the first user plane anchor point, and if the terminal device sends the user plane data of the first session to the second user plane anchor point, the packet header carries the information of the second user plane anchor point. In the downlink direction, if the first user plane anchor point sends the user plane data of the first session to the terminal device, the packet header carries the information of the terminal device, and if the second user plane anchor point sends the user plane data of the first session to the terminal device, the packet header carries the information of the terminal device. For detailed description of the user plane data transmission, reference can be made to the related description in the embodiment of FIG. 3(a).

[0181] The following describes some specific examples of the embodiments of FIG. 3(a) and FIG. 3(b) in combination with Figure 4 to Figure 5 The following embodiments take the session management network element and the user plane network element as examples of SMF and UPF. In the following embodiments, PSA#1 is a specific example of the first user plane anchor point in the foregoing embodiments, PSA#2 is a specific example of the second user plane anchor point in the foregoing embodiments, and the first session is a PDU session.

[0182] Figure 4 A flowchart of a communication method according to an embodiment of the present application is provided. The method includes the following steps:

[0183] In step 400, the terminal device performs a registration process and registers to the network.

[0184] At step 401a, the terminal device sends a non-access stratum (NAS) message to the AMF. Accordingly, the AMF receives the NAS message.

[0185] The NAS message carries session-related information and a session establishment request. The session-related information includes, for example, single network slice selection assistance information (S-NSSAI) and a data network name (DNN). The session establishment request carries session establishment information, which includes, for example, S-NSSAI and DNN.

[0186] At step 401b, the AMF sends a session establishment request to the SMF. Accordingly, the SMF receives the session establishment request.

[0187] In an implementation method, after receiving the NAS message, the AMF obtains the session-related information in the NAS message, and sends the session-related information to a UDM network element. The UDM network element obtains routing indication information corresponding to the session-related information, and sends the routing indication information to the AMF. The routing indication information is used to indicate that the routing mode is HR or LBO.

[0188] In the LBO scenario, the AMF selects a v-SMF according to the session-related information, and sends the session establishment request to the v-SMF. That is, in the LBO scenario, in step 401b, the AMF sends the session establishment request to the v-SMF, and the SMF involved in the steps after step 401b is the v-SMF.

[0189] In the HR scenario, the AMF selects a v-SMF and an h-SMF according to the session-related information, and then sends the session establishment request to the v-SMF and the identification information of the h-SMF. After receiving the identification information of the h-SMF, the v-SMF determines not to perform the key derivation related operation, but to perform the key derivation related operation by the h-SMF, that is, the subsequent steps after step 401b are performed by the h-SMF, and the v-SMF further sends part or all of the parameters required for session establishment in the session establishment request to the h-SMF. That is, in the HR scenario, the SMF involved in the steps after step 401b is the h-SMF.

[0190] At step 402, the SMF obtains a session root key (denoted as K_PDU) of the first session, and derives a second intermediate key (denoted as K_UPF#2) corresponding to PSA#1 according to the session root key.

[0191] The session root key is a root key of a session granularity, that is, for each session, a session root key is correspondingly obtained.

[0192] The specific implementation method of deriving K_UPF#2 according to the session root key can refer to the description of the embodiment of FIG. 3(a) as described above.

[0193] At step 403a, the SMF sends a configuration request to PSA#1. Accordingly, PSA#1 receives the configuration request.

[0194] The user plane security capability of the terminal device is included in the configuration request. The user plane security capability is used to indicate the security algorithm supported by the terminal device in the user plane, and the security algorithm includes a confidentiality protection algorithm and / or an integrity protection algorithm.

[0195] Exemplarily, if the SMF is a v-SMF, the v-SMF can send the configuration request to PSA#1 through an interface between the v-SMF and PSA#1, or send the configuration request to PSA#1 via a h-SMF.

[0196] Exemplarily, if the SMF is a h-SMF, the h-SMF can send the configuration request to PSA#1 through an interface between the h-SMF and PSA#1, or send the configuration request to PSA#1 via a v-SMF.

[0197] At step 403b, PSA#1 sends a configuration response to the SMF. Accordingly, the SMF receives the configuration response.

[0198] The configuration response is used to indicate the second security algorithm selected by PSA#1 for end-to-end security protection between PSA#1 and the terminal device. The second security algorithm includes a second confidentiality protection algorithm and / or a second integrity protection algorithm.

[0199] For example, the configuration request indicates that the terminal device supports confidentiality protection algorithm #1, confidentiality protection algorithm #2 and confidentiality protection algorithm #3 in the user plane, PSA#1 selects confidentiality protection algorithm #1, and the configuration request indicates that the terminal device supports integrity protection algorithm #1, integrity protection algorithm #2 and integrity protection algorithm #3 in the user plane, and PSA#1 selects integrity protection algorithm #3. Accordingly, the second security algorithm is indicated in the configuration response, and the second security algorithm includes the confidentiality protection algorithm #1 and the integrity protection algorithm #3 selected by PSA#1.

[0200] The step 403a and the step 403b are optional steps.

[0201] At step 404, the SMF derives a second session key corresponding to PSA#1 according to K_UPF#2 and the second security algorithm.

[0202] The second session key comprises a second session ciphering key and / or a second session integrity key. The second session ciphering key is derived according to the K_UPF#2 and a second confidentiality protection algorithm, and is used for performing end-to-end confidentiality protection on user plane data of the first session between the PSA#1 and the terminal device. The second session integrity key is derived according to the K_UPF#2 and a second integrity protection algorithm, and is used for performing end-to-end integrity protection on user plane data of the first session between the PSA#1 and the terminal device.

[0203] For a specific implementation method of deriving the second session key according to the K_UPF#2, reference can be made to the description of the foregoing embodiment of FIG. 3(a).

[0204] In an implementation method, if the step 403a and the step 403b are performed, the second security algorithm used for deriving the second session key in the step 404 is indicated by the configuration response of the step 403b.

[0205] In another implementation method, if the step 403a and the step 403b are not performed, the second security algorithm used for deriving the second session key in the step 404 can be determined by the SMF. For example, the SMF selects the second security algorithm used for performing end-to-end security protection between the PSA#1 and the terminal device according to a user plane security capability of the terminal device.

[0206] The step 405: The SMF sends a first message to the terminal device. Correspondingly, the terminal device receives the first message.

[0207] The first message can be a security mode command (SMC) message or a security mode complete (SMP) message.

[0208] The first message is used for indicating the second security algorithm.

[0209] In an implementation method, if the second session integrity key corresponding to the PSA#1 is derived in the step 404, the first message can be integrity protected by using the second session integrity key.

[0210] The step 406: The terminal device obtains a session root key (namely, K_PDU) of the first session, derives a second intermediate key (namely, K_UPF#2) corresponding to the PSA#1 according to the session root key, and derives a second session key corresponding to the PSA#1 according to the K_UPF#2 and the second security algorithm.

[0211] The terminal device uses the same manner as the SMF to derive K_UPF#2 from K_PDU. The K_PDU used by the terminal device is the same as the K_PDU used by the SMF.

[0212] After the terminal device generates K_UPF#2, the terminal device uses the same manner as the SMF to derive a second session key corresponding to PSA#2, that is, to derive the second session key from K_UPF#2 and a second security algorithm. The second session key is used to protect the user plane data of the first session between the terminal device and PSA#1.

[0213] In step 407, the SMF sends a configuration request to PSA#1. Correspondingly, PSA#1 receives the configuration request.

[0214] The configuration request includes the second session key.

[0215] PSA#1 uses the second session key to protect the user plane data of the first session between PSA#1 and the terminal device.

[0216] The step 407 is executed after step 405, and the step 407 can be executed before or after step 406.

[0217] Optionally, after the terminal device and the SMF complete the user plane security activation process, the SMF can save the second security algorithm.

[0218] For example, if the SMF is a v-SMF, the v-SMF can send the configuration request to PSA#1 through an interface between the v-SMF and PSA#1, or send the configuration request to PSA#1 via a h-SMF.

[0219] For example, if the SMF is a h-SMF, the h-SMF can send the configuration request to PSA#1 through an interface between the h-SMF and PSA#1, or send the configuration request to PSA#1 via a v-SMF.

[0220] In step 408, the SMF inserts PSA#2 and a splitting node for the first session according to service requirements.

[0221] In one possible implementation method, if the second security algorithm is saved on the SMF, the SMF can select a UPF supporting the second security algorithm as a splitting node of the first session.

[0222] In step 409, the SMF sends a configuration request to PSA#2. Correspondingly, PSA#2 receives the configuration request.

[0223] The configuration request comprises second indication information, which is used to indicate that the PSA#2 does not perform security protection on the user plane downlink data of the first session.

[0224] Optionally, the SMF does not carry the second indication information in the configuration request message, but sends a stop security protection message, which is used to implicitly indicate that the PSA#2 does not perform security protection on the user plane downlink data of the first session.

[0225] Exemplarily, if the SMF is a v-SMF, the v-SMF can send the configuration request to the PSA#2 through an interface between the v-SMF and the PSA#2, or send the configuration request to the PSA#2 via the h-SMF.

[0226] Exemplarily, if the SMF is a h-SMF, the h-SMF can send the configuration request to the PSA#2 through an interface between the h-SMF and the PSA#2, or send the configuration request to the PSA#2 via the v-SMF.

[0227] Step 410, the SMF sends a configuration request to the PSA#1. Correspondingly, the PSA#1 receives the configuration request.

[0228] The configuration request carries a record value of a second counter. For the meaning and function of the second counter, refer to the description of the embodiment of FIG. 3(a) above.

[0229] Optionally, the configuration request also carries first indication information, which is used to indicate that the PSA#1 does not perform security protection on the user plane downlink data of the first session.

[0230] Alternatively, the configuration request does not carry the first indication information, but implicitly indicates that the PSA#1 does not perform security protection on the user plane downlink data of the first session, that is, the PSA#1 receives the configuration request for requesting the record value of the second counter, and determines not to perform security protection on the user plane downlink data of the first session.

[0231] Exemplarily, if the SMF is a v-SMF, the v-SMF can send the configuration request to the PSA#1 through an interface between the v-SMF and the PSA#1, or send the configuration request to the PSA#1 via the h-SMF.

[0232] Exemplarily, if the SMF is a h-SMF, the h-SMF can send the configuration request to the PSA#1 through an interface between the h-SMF and the PSA#1, or send the configuration request to the PSA#1 via the v-SMF.

[0233] Step 411, the PSA#1 stops sending downlink user plane data.

[0234] At step 412, the PSA#1 sends a configuration response to the SMF. Accordingly, the SMF receives the configuration response.

[0235] The configuration response includes the recorded value of the second counter.

[0236] The steps 410-412 are optional steps. If the SMF uses the recorded value of the second counter when deriving the first intermediate key corresponding to the split node, the steps 410-412 are performed, otherwise the steps 410-412 are not performed.

[0237] At step 413a, the SMF sends a configuration request to the split node. Accordingly, the split node receives the configuration request.

[0238] The configuration request includes a user plane security capability of the terminal device. The user plane security capability is used to indicate a security algorithm supported by the terminal device in the user plane.

[0239] Exemplarily, if the SMF is a v-SMF, the v-SMF can send the configuration request to the split node via an interface between the v-SMF and the split node, or send the configuration request to the split node via the h-SMF.

[0240] Exemplarily, if the SMF is a h-SMF, the h-SMF can send the configuration request to the split node via an interface between the h-SMF and the split node, or send the configuration request to the split node via the v-SMF.

[0241] At step 413b, the split node sends a configuration response to the SMF. Accordingly, the SMF receives the configuration response.

[0242] The configuration response is used to indicate a first security algorithm selected by the split node for performing end-to-end security protection between the split node and the terminal device. The first security algorithm includes a first confidentiality protection algorithm and / or a first integrity protection algorithm.

[0243] For example, the configuration request indicates that the terminal device supports a confidentiality protection algorithm #1, a confidentiality protection algorithm #2 and a confidentiality protection algorithm #3 in the user plane, the split node selects the confidentiality protection algorithm #1, and the configuration request further indicates that the terminal device supports an integrity protection algorithm #1, an integrity protection algorithm #2 and an integrity protection algorithm #3 in the user plane, the split node selects the integrity protection algorithm #3. Accordingly, the first security algorithm selected by the split node and indicated in the configuration response includes the confidentiality protection algorithm #1 and the integrity protection algorithm #3.

[0244] The steps 413a and 413b are optional steps.

[0245] Step 414, the SMF derives a first intermediate key (denoted as K_UPF#1) corresponding to the split node according to the session root key (i.e., K_PDU) of the first session, and derives a first session key corresponding to the split node according to the K_UPF#1 and a first security algorithm.

[0246] The session root key is the session root key used to derive the K_UPF#2 in the foregoing steps.

[0247] The SMF derives the first session key corresponding to the split node according to the first intermediate key (i.e., K_UPF#1) and the first security algorithm, and the first session key includes a first session encryption and decryption key and / or a first session integrity protection key. The first session encryption and decryption key is derived according to the K_UPF#1 and a first confidentiality protection algorithm, and is used for end-to-end confidentiality protection of user plane data between the split node and the terminal device. The first session integrity protection key is derived according to the K_UPF#1 and a first integrity protection algorithm, and is used for end-to-end integrity protection of user plane data between the split node and the terminal device.

[0248] In an implementation method, if the steps 413a and 413b are performed, the first security algorithm used to derive the first session key in the step 414 is indicated by the configuration response of the step 413b.

[0249] In another implementation method, if the steps 413a and 413b are not performed, the first security algorithm used to derive the first session key in the step 414 can be determined by the SMF. For example, after the step 404, the SMF locally stores the second security algorithm, and in the step 414, the SMF determines the second security algorithm as the first security algorithm used to derive the first session key. For another example, the SMF determines the first security algorithm according to the user plane security capability of the terminal device.

[0250] Step 415, the SMF sends a second message to the terminal device. Correspondingly, the terminal device receives the second message.

[0251] The second message is used to indicate the first security algorithm used for end-to-end security protection between the split node and the terminal device.

[0252] The second message can be an SMC message or an SMP message.

[0253] In an implementation method, if the first session integrity protection key corresponding to the split node is derived in the step 414, the second message can be integrity protected by using the first session integrity protection key.

[0254] At step 416, the terminal device acquires a session root key (i.e., K_PDU) of the first session, and derives a first intermediate key (i.e., K_UPF#1) corresponding to the split node from the session root key, and derives a session key corresponding to the split node from the K_UPF#1 and a first security algorithm.

[0255] The terminal device derives the K_UPF#1 from the K_PDU in the same manner as the SMF. The K_PDU used by the terminal device is the same as the K_PDU used by the SMF.

[0256] After the terminal device generates the K_UPF#1, the terminal device derives the first session key corresponding to the split node in the same manner as the SMF derives the first session key corresponding to the split node, i.e., derives the first session key from the K_UPF#1 and the first security algorithm.

[0257] At step 417, the SMF sends a configuration request to the split node. Correspondingly, the split node receives the configuration request.

[0258] The configuration request includes the first session key, and the first session key includes a first session encryption and decryption key and / or a first session integrity protection key.

[0259] The split node uses the first session key to protect user plane data of the first session between the split node and the terminal device.

[0260] The step 417 is performed after the step 415, and the step 417 can be performed before or after the step 416.

[0261] Exemplarily, if the SMF is a v-SMF, the v-SMF can send the configuration request to the split node through an interface between the v-SMF and the split node, or send the configuration request to the split node via the h-SMF.

[0262] Exemplarily, if the SMF is a h-SMF, the h-SMF can send the configuration request to the split node through an interface between the h-SMF and the split node, or send the configuration request to the split node via the v-SMF.

[0263] At step 418, the SMF sends a configuration request to the PSA#1. Correspondingly, the PSA#1 receives the configuration request.

[0264] Optionally, the configuration request includes first indication information, and the first indication information is used to indicate that the PSA#1 does not perform security protection on user plane downlink data of the first session.

[0265] In one implementation method, if the step 410 is not performed, or the step 410 is performed but the first indication information is not carried in the configuration request of the step 410, the first indication information can be carried in the configuration request of the step 418.

[0266] In another implementation method, if the step 410 is performed and the first indication information is carried in the configuration request of the step 410, the first indication information can not be carried in the configuration request of the step 418.

[0267] After the PSA#1 receives the first indication information from the SMF, the PSA#1 stops performing security protection on the user plane downlink data of the first session.

[0268] Exemplarily, if the SMF is a v-SMF, the v-SMF can send the configuration request to the PSA#1 through an interface between the v-SMF and the PSA#1, or send the configuration request to the PSA#1 via the h-SMF.

[0269] Exemplarily, if the SMF is a h-SMF, the h-SMF can send the configuration request to the PSA#1 through an interface between the h-SMF and the PSA#1, or send the configuration request to the PSA#1 via the v-SMF.

[0270] In the step 419, the SMF configures an uplink tunnel of the access network device, and continues a subsequent session process.

[0271] For example, the SMF configures, through the AMF, a receiving port of the uplink tunnel of the access network device as a port of the splitting node, and the like.

[0272] Based on the above scheme, after the splitting node is inserted for the session of the terminal device, the end-to-end security channel between the terminal device and the PSA#1 is changed to an end-to-end security channel between the terminal device and the splitting node, and the user plane data between the terminal device and the plurality of PSAs is protected by the end-to-end security channel between the terminal device and the splitting node, so that the scheme can protect the user plane data between the terminal device and the plurality of PSAs in the service flow splitting scenario. In addition, in the process, the terminal device updates the session key by using the key update process, so that the terminal device cannot distinguish whether the key update is caused by the insertion or switching of the security anchor point, that is, the terminal device does not perceive the insertion or switching of the security anchor point.

[0273] Figure 5 A flowchart of a communication method provided by an embodiment of the present application is shown. The method includes the following steps:

[0274] The step 500 is the same as the step 400 in the embodiment. Figure 4 The step 500 is the same as the step 400 in the embodiment.

[0275] Step 501a, same as Figure 4 Step 401a in the embodiment of FIG. 4.

[0276] Step 501b, same as Figure 4 Step 401b in the embodiment of FIG. 4.

[0277] Step 502, same as Figure 4 Step 402 in the embodiment of FIG. 4.

[0278] Step 503a, same as Figure 4 Step 403a in the embodiment of FIG. 4.

[0279] Step 503b, same as Figure 4 Step 403b in the embodiment of FIG. 4.

[0280] Step 504, the SMF sends a configuration request to PSA#1. Accordingly, PSA#1 receives the configuration request.

[0281] The configuration request includes K_UPF#2.

[0282] Exemplarily, if the SMF is a v-SMF, the v-SMF can send the configuration request to PSA#1 through an interface between the v-SMF and PSA#1, or send the configuration request to PSA#1 via a h-SMF.

[0283] Exemplarily, if the SMF is a h-SMF, the h-SMF can send the configuration request to PSA#1 through an interface between the h-SMF and PSA#1, or send the configuration request to PSA#1 via a v-SMF.

[0284] Step 505, PSA#1 derives a second session key corresponding to PSA#1 according to K_UPF#2 and a second security algorithm.

[0285] The second security algorithm includes a second confidentiality protection algorithm and / or a second integrity protection algorithm. The second session key includes a second session encryption and decryption key and / or a second session integrity key. The second session encryption and decryption key is derived according to K_UPF#2 and the second confidentiality protection algorithm, and is used for end-to-end confidentiality protection of user plane data of the first session between PSA#1 and the terminal device. The second session integrity key is derived according to K_UPF#2 and the second integrity protection algorithm, and is used for end-to-end integrity protection of user plane data of the first session between PSA#1 and the terminal device.

[0286] For a specific implementation method of deriving the second session key according to K_UPF#2, reference can be made to the description of the embodiment of FIG. 3(a) above.

[0287] In an implementation method, if the steps 503a and 503b are performed, the second security algorithm used for deriving the second session key in the step 505 is indicated by the configuration response of the step 503b, that is, the second security algorithm is carried in the configuration request of the step 504.

[0288] In another implementation method, if the steps 503a and 503b are not performed, the second security algorithm used for deriving the second session key in the step 505 can be determined by the SMF, such as that the SMF selects the second security algorithm used for the end-to-end security protection between the PSA#1 and the terminal device according to the user plane security capability of the terminal device, and then carries the second security algorithm in the configuration request of the step 504.

[0289] In another implementation method, if the steps 503a and 503b are not performed, the SMF can carry the user plane security capability of the terminal device in the configuration request of the step 504, and the PSA#1 determines the second security algorithm according to the user plane security capability of the terminal device.

[0290] In the step 506, the PSA#1 sends a first message to the terminal device. Correspondingly, the terminal device receives the first message.

[0291] For example, the PSA#1 can send the first message to the terminal device through the control plane via the forwarding of the SMF and the AMF. Alternatively, the PSA#1 sends the first message to the terminal device through the user plane.

[0292] The first message can be an SMC message or an SMP message.

[0293] The first message is used to indicate the second security algorithm used for the end-to-end security protection between the PSA#1 and the terminal device.

[0294] In an implementation method, if the second session key corresponding to the PSA#1 is determined in the step 505, the first message can be integrity protected by using the second session key.

[0295] In the step 507, the terminal device obtains the session root key (that is, K_PDU) of the first session, derives the second intermediate key (that is, K_UPF#2) corresponding to the PSA#1 according to the session root key, and derives the second session key corresponding to the PSA#1 according to the K_UPF#2 and the second security algorithm.

[0296] The terminal device uses the same manner as the SMF to derive K_UPF#2 from K_PDU. The K_PDU used by the terminal device is the same as the K_PDU used by the SMF.

[0297] After the terminal device generates K_UPF#2, the terminal device uses the same manner as the SMF to derive a second session key corresponding to PSA#2, that is, to derive the second session key from K_UPF#2 and a second security algorithm. The second session key is used to protect the user plane data of the first session between the terminal device and PSA#1.

[0298] Steps 508 to 512 are the same as steps 408 to 412 in the embodiment of the SMF. Figure 4

[0299] Steps 510 to 512 are optional steps.

[0300] Step 513a is the same as step 413a in the embodiment of the SMF. Figure 4 Step 513b is the same as step 413b in the embodiment of the SMF.

[0301] Figure 4

[0302] Step 514: The SMF derives a first intermediate key (denoted as K_UPF#1) corresponding to the split node from a session root key (i.e., K_PDU) of the first session.

[0303] The session root key is the session root key used to derive K_UPF#2 in the foregoing steps.

[0304] Step 515: The SMF sends a configuration request to the split node. Correspondingly, the split node receives the configuration request.

[0305] The configuration request includes K_UPF#1.

[0306] Exemplarily, if the SMF is a v-SMF, the v-SMF can send the configuration request to the split node through an interface between the v-SMF and the split node, or send the configuration request to the split node via the h-SMF.

[0307] Exemplarily, if the SMF is a h-SMF, the h-SMF can send the configuration request to the split node through an interface between the h-SMF and the split node, or send the configuration request to the split node via the v-SMF.

[0308] Step 516: The split node derives a first session key corresponding to the split node from K_UPF#1 and a first security algorithm.

[0309] ​​​The offloading node derives a first session key corresponding to the offloading node according to the first intermediate key (i.e., K_UPF#1) and a first security algorithm, and the first session key includes a first session encryption and decryption key and / or a first session integrity protection key. The first session encryption and decryption key is derived according to K_UPF#1 and a first confidentiality protection algorithm, and is used for end-to-end confidentiality protection of user plane data between the offloading node and the terminal device. The first session integrity protection key is derived according to K_UPF#1 and a first integrity protection algorithm, and is used for end-to-end integrity protection of user plane data between the offloading node and the terminal device.

[0310] In an implementation method, if the steps 513a and 513b are performed, the first security algorithm used to derive the first session key in the step 516 is indicated by the configuration response of the step 513b, that is, the first security algorithm is carried in the configuration request of the step 515.

[0311] In another implementation method, if the steps 513a and 513b are not performed, the first security algorithm used to derive the first session key in the step 516 can be determined by the SMF, such as the SMF selecting the first security algorithm according to the user plane security capability of the terminal device, and then carrying the first security algorithm in the configuration request of the step 515.

[0312] In another implementation method, if the steps 513a and 513b are not performed, the SMF can carry the user plane security capability of the terminal device in the configuration request of the step 515, and the PSA#1 determines the first security algorithm according to the user plane security capability of the terminal device.

[0313] In the step 517, the offloading node sends a second message to the terminal device. Correspondingly, the terminal device receives the second message.

[0314] For example, the offloading node can send the second message to the terminal device through the control plane via the forwarding of the SMF and the AMF. Alternatively, the offloading node sends the second message to the terminal device through the user plane.

[0315] The second message can be an SMC message or an SMP message.

[0316] The second message is used to indicate the first security algorithm used for end-to-end security protection between the offloading node and the terminal device.

[0317] In an implementation method, if the first session integrity protection key corresponding to the offloading node is determined in the step 516, the second message can be integrity protected using the first session integrity protection key.

[0318] Step 518: The terminal device obtains the session root key (i.e., K_PDU) of the first session, and derives the first intermediate key (i.e., K_UPF#1) corresponding to the splitter node based on the session root key, and derives the first session key corresponding to the splitter node based on K_UPF#1 and the first security algorithm.

[0319] The terminal device uses the same method as SMF to derive K_UPF#1 from K_PDU. The K_PDU used by the terminal device is the same as the K_PDU used by SMF.

[0320] After generating K_UPF#1, the terminal device uses the same method as the SMF to deduce the first session key corresponding to the split node, and deduces the first session key corresponding to the split node. That is, the first session key is deduced based on K_UPF#1 and the first security algorithm.

[0321] Steps 519 to 520 are the same. Figure 4 Steps 418 to 419 in the embodiments.

[0322] Based on the above scheme, after inserting a traffic splitter node into the terminal device's session, the establishment of an end-to-end secure channel between the terminal device and PSA#1 is changed to the establishment of an end-to-end secure channel between the terminal device and the traffic splitter node. This end-to-end secure channel between the terminal device and the traffic splitter node provides security protection for user plane data between the terminal device and multiple PSAs. Therefore, this scheme can achieve security protection for user plane data between the terminal device and multiple PSAs in a traffic splitting scenario. Furthermore, during this process, the terminal device updates the session key using a key update procedure. Therefore, the terminal device cannot distinguish between a regular key update and a key update caused by the insertion or switching of a security anchor; that is, the terminal device is unaware of the insertion or switching of a security anchor.

[0323] Should Figure 5 The embodiments are the same as those described above. Figure 4 The main difference in the embodiments is: Figure 4 In one embodiment, a second session key is derived from SMF and a first message is sent to the terminal device; and a first session key is derived from SMF and a second message is sent to the terminal device. Figure 5 In one embodiment, the second session key is derived from PSA#1 and a first message is sent to the terminal device, and the first session key is derived from the splitter node and a second message is sent to the terminal device.

[0324] Figure 6 A possible exemplary block diagram of the communication device involved in an embodiment of this application is shown. For example... Figure 6As shown, the communication device 600 may include modules or units for implementing the methods described in the embodiments above. In one possible design, the communication device 600 includes a processing unit 602 and a communication unit 603. Optionally, the communication device 600 may further include a storage unit 601 for storing device program code and / or data.

[0325] The communication device 600 can also be a network-side device in the above embodiments, such as a session management network element on the network side, a module (e.g., a circuit, chip, or chip system) in the session management network element, or a logical node, logical module, or software that can implement all or part of the functions of the session management network element.

[0326] For example, in one embodiment, processing unit 602 is configured to determine a first intermediate key based on the session root key of the first session of the terminal device. The first intermediate key is used to deduce the first session key. The first session key is used to protect the first user plane data and the second user plane data of the first session during transmission between the terminal device and the splitter node. The first user plane data is transmitted to the first user plane anchor point through the splitter node, and the second user plane data is transmitted to the second user plane anchor point through the splitter node. Communication unit 603 is configured to send the first intermediate key or the first session key to the splitter node.

[0327] In one possible implementation, the processing unit 602 is configured to determine a first intermediate key based on the session root key of a first session of the terminal device, including: determining the first intermediate key based on the session root key, and a first counter and / or a second counter; wherein the first counter is used to record the number of times the intermediate key is derived for the first session, and the second counter is used to record the number of data packets that have been transmitted in the first session.

[0328] In one possible implementation, the communication unit 603 is further configured to send a request message to the first user plane anchor point, the request message being used to request the acquisition of the second counter; and to receive the second counter from the first user plane anchor point.

[0329] In one possible implementation, the first session key is derived from the first intermediate key and a first security algorithm, the first security algorithm including a first confidentiality protection algorithm and / or a first integrity protection algorithm.

[0330] In one possible implementation, the processing unit 602 is further configured to obtain the user plane security capabilities of the terminal device, the user plane security capabilities being used to indicate the user plane security algorithms supported by the terminal device; and to obtain the first security algorithm based on the security capabilities of the terminal device.

[0331] In one possible implementation, the processing unit 602 is configured to obtain the first security algorithm based on the security capabilities of the terminal device, including: sending the user plane security capabilities to the traffic splitting node via the communication unit 603; and receiving the first security algorithm from the traffic splitting node, wherein the user plane security algorithms supported by the terminal device include the first security algorithm.

[0332] In one possible implementation, the processing unit 602 is further configured to determine the first security algorithm according to the second security algorithm, wherein the second security algorithm is used to protect the third user plane data of the first session between the terminal device and the first user plane anchor point.

[0333] In one possible implementation, the processing unit 602 is further configured to determine a second intermediate key based on the session root key, the second intermediate key being used to deduce a second session key, and the second session key being used to protect the third user plane data of the first session during transmission between the terminal device and the first user plane anchor point; the communication unit 603 is further configured to send the second intermediate key or the second session key to the first user plane anchor point.

[0334] In one possible implementation, the second session key is derived from the second intermediate key and the second security algorithm, which includes a second confidentiality protection algorithm and / or a second integrity protection algorithm.

[0335] In one possible implementation, the processing unit 602 is further configured to obtain the user plane security capabilities of the terminal device, the user plane security capabilities being used to indicate the user plane security algorithms supported by the terminal device; and to obtain the second security algorithm based on the security capabilities of the terminal device.

[0336] In one possible implementation, the processing unit 602 is configured to obtain the second security algorithm based on the security capabilities of the terminal device, including: sending the user plane security capabilities to the first user plane anchor point via the communication unit 603; and receiving the second security algorithm from the first user plane anchor point, wherein the user plane security algorithms supported by the terminal device include the second security algorithm.

[0337] In one possible implementation, the communication unit 603 is further configured to send a first indication message to the first user plane anchor point, the first indication message being used to indicate that the downlink user plane data of the first session is not subject to security protection.

[0338] In one possible implementation, the communication unit 603 is further configured to send a second indication message to the second user plane anchor point, the second indication message being used to indicate that the downlink user plane data of the first session is not subject to security protection.

[0339] In one possible implementation, the processing unit 602 is configured to determine a first intermediate key based on the session root key of the first session of the terminal device, including: determining the first intermediate key based on the session root key if it is determined that no information from the home session management network element has been received.

[0340] In one possible implementation, the processing unit 602 is configured to determine a first intermediate key based on the session root key of the first session of the terminal device, including: determining the first intermediate key based on the session root key when it is determined that user plane data of the first session will be split.

[0341] The communication device 600 can be a terminal device-side device in the above embodiments, such as a terminal device or a communication module in a terminal device, or a circuit or chip in a terminal device that is responsible for communication functions.

[0342] For example, in one embodiment, the processing unit 602 is configured to determine a first intermediate key based on the session root key of the first session of the terminal device; and to deduce a first session key based on the first intermediate key. The first session key is used to protect the first user plane data and the second user plane data of the first session during transmission between the terminal device and the splitter node. The first user plane data is transmitted to the first user plane anchor point through the splitter node, and the second user plane data is transmitted to the second user plane anchor point through the splitter node.

[0343] In one possible implementation, the processing unit 602 is configured to determine a first intermediate key based on the session root key of a first session of the terminal device, including: determining the first intermediate key based on the session root key, and a first counter and / or a second counter; wherein the first counter is used to record the number of times the intermediate key is derived for the first session, and the second counter is used to record the number of data packets that have been transmitted in the first session.

[0344] In one possible implementation, the processing unit 602 is configured to deduce a first session key based on the first intermediate key, including: deduce the first session key based on the first intermediate key and a first security algorithm, wherein the first security algorithm includes a first confidentiality protection algorithm and / or a first integrity protection algorithm.

[0345] In one possible implementation, the communication unit 603 is configured to receive the first security algorithm from the session management network element; or, to receive the first security algorithm from the traffic splitting node.

[0346] In one possible implementation, the processing unit 602 is further configured to determine a second intermediate key based on the session root key; and to deduce a second session key based on the second intermediate key, the second session key being used to protect the third user plane data of the first session during transmission between the terminal device and the first user plane anchor point.

[0347] In one possible implementation, the processing unit 602 is configured to deduce a second session key based on the second intermediate key, including: deduce the second session key based on the second intermediate key and a second security algorithm, wherein the second security algorithm includes a second confidentiality protection algorithm and / or a second integrity protection algorithm.

[0348] In one possible implementation, the communication unit 603 is configured to receive the second security algorithm from the session management network element; or, to receive the second security algorithm from the first user plane anchor point.

[0349] In one possible implementation, the processing unit 602 is further configured to perform security processing on the first user plane data of the first session based on the first session key, and send the security-processed first user plane data of the first session through the communication unit 603, wherein the packet header of the security-processed first user plane data of the first session carries information of the first user plane anchor point; the processing unit 602 is further configured to perform security processing on the second user plane data of the first session based on the first session key, and send the security-processed second user plane data of the first session through the communication unit 603, wherein the packet header of the security-processed second user plane data of the first session carries information of the second user plane anchor point.

[0350] In one possible design, when the communication device 600 is a terminal device or a communication module within a terminal device, the function of the processing unit 602 can be implemented by one or more processors. Specifically, the processor may include a modem chip, or a system-on-a-chip (SoC) chip or a SIP chip containing a modem core. The function of the communication unit 603 can be implemented by transceiver circuitry.

[0351] In one possible design, when the communication device 600 is a circuit or chip responsible for communication functions in a terminal device, such as a modem chip or a system-on-a-chip (SoC) or SIP chip containing a modem core, the function of the processing unit 602 can be implemented by a circuit system in the aforementioned chip that includes one or more processors or processor cores. The function of the communication unit 603 can be implemented by an interface circuit or data transceiver circuit on the aforementioned chip.

[0352] It is understood that the division of units in the above-described device is merely a logical functional division. One function can correspond to one functional unit, or two or more functions can be integrated into one functional unit. In actual implementation, all or some units can be integrated onto a single physical entity, or distributed across different physical entities. Furthermore, the aforementioned functional units can be implemented in hardware, software, or a combination of both. Whether a function is executed in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for specific applications, but such implementations should not be considered beyond the scope of this application.

[0353] In one example, the functional unit in any of the above devices may be one or more integrated circuits configured to implement the above methods, such as: one or more application-specific integrated circuits (ASICs), or one or more central processing units (CPUs), one or more microcontroller units (MCUs), one or more digital signal processors (DSPs), or one or more field-programmable gate arrays (FPGAs), or a combination of at least two of these integrated circuit forms.

[0354] In one example, storage unit 601 may include random access memory, flash memory, read-only memory, programmable read-only memory or electrically erasable programmable memory and / or registers, etc.

[0355] Figure 7 This is a schematic diagram of the structure of a terminal device 700 provided in an embodiment of this application. The terminal device 700 can correspond to… Figure 1 or Figure 2 The terminal device shown is used to implement the operation of the terminal device in the above embodiments. Figure 7As shown, the terminal device includes: one or more antennas 710, a radio frequency processing system 720, and a processor system 730.

[0356] In the downlink or sidelink direction, the RF processing system 720 receives RF signals through the antenna 710 and sends the RF-processed signals to the processor system 730 for further processing. In the uplink or sidelink direction, the processor system 730 processes the information from the terminal device side and sends it to the RF processing system 720, which then processes the signal and transmits it through the antenna 710.

[0357] In one example, the radio frequency (RF) processing system 720 serves as the communication interface for external communication of the terminal device and may include a radio frequency frontend (RFFE) 721 and an RF transceiver 722. The RFFE 721 is primarily used for one or more processing operations, such as shaping, passband selection, or gain adjustment, on the RF signals received by the antenna or those to be transmitted through the antenna. It may include one or more components such as RF switches, duplexers, filters, power amplifiers, antenna tuners, and low-noise amplifiers. The RFFE 721 can be a circuit system composed of multiple discrete components or integrated into one or more chips. The RF transceiver 722 processes the RF signals received by the RFFE into baseband / IF signals for further processing by the processor system 730, and processes the baseband / IF signals provided by the processor system 730 into RF signals for transmission to the RFFE 721. The baseband / IF signals transmitted between the RF transceiver 722 and the processor system 730 can be digital or analog signals. The RF transceiver 722 can be implemented by one or more chips, which are commonly referred to as RF ICs.

[0358] In one example, the processor system 730 may include one or more processors for processing signals and executing one or more communication protocols. Optionally, the processor system 730 may also include a memory 736. In one example, the one or more processors include at least one baseband processor 731 (also known as a modem processor). The memory 736 is used to store data and / or computer program instructions. Optionally, the processor system 730 may also include one or more application processors 732 for implementing processing of the terminal device's operating system and application layer. Optionally, the processor system 730 may also include one or more of a voice subsystem 733, a multimedia subsystem 734, or an interface circuit 735. The voice subsystem 733 is used to process voice signals, the multimedia subsystem 734 is used to handle multimedia-related operations, such as video encoding / decoding, image processing, etc., and the interface circuit 735 is used to enable communication with other terminal device components, such as a display 740, an input device 750, a memory 760, etc. The above-mentioned components in the processor system 730 can communicate with each other via a bus or communication interface circuit.

[0359] In one example, the processor system 730 can be packaged as a single processor chip, such as a SoC chip or a SIP chip. In another example, the processor system 730 can be a system composed of multiple chips; for example, the baseband processor 731 can be packaged as a single chip, or packaged with part or all of the circuitry of the radio frequency processing system into a single chip.

[0360] In one example, memory 736 can be on-chip memory, i.e., located on the processor system 730 chip. In another example, memory 760 can be off-chip memory, i.e. located outside the processor system 730 chip.

[0361] In one example, the baseband processor 731 may include one or more processor cores 7311 and interface circuitry 7314. The one or more processor cores 7311 are used to process signals and execute one or more communication protocols. Optionally, the baseband processor 731 may also include a memory 7312 for storing at least a portion of the corresponding computer program instructions and / or data. In one example, the one or more processor cores 7311 execute the computer program instructions stored in the memory 7312 to implement the relevant operations in the above method embodiments. In this disclosure, the memory 7312 storing the corresponding computer program instructions and / or data may mean that the memory 7312 stores all the corresponding computer program instructions and / or data for the processor core 7311 to execute; or it may mean that the memory 7312 stores a portion of the corresponding computer program instructions and / or data, which includes the computer program instructions and / or data currently needed to be executed by the processor core 7311. The memory 7312 can store different portions of computer program instructions and / or data multiple times for the processor core 7311 to execute in order to implement the relevant operations in the above method embodiments. Interface circuit 7314 serves as a communication interface for communication with other components, such as transmitting signals with RF processing system 720, communicating with other subsystems and related components of processor system 730 via bus, such as transmitting data control signals with application processor 732, and transmitting data or computer program instructions with memory 736 or memory 760. Optionally, to reduce the load on the processor core, baseband signal processing circuit 7313 can also be provided to perform at least some baseband signal processing, including one or more of signal demodulation, modulation, encoding, or decoding.

[0362] In one example, the communication device provided in this application may be a terminal device 700, including a communication module comprising a processor system 730 and a radio frequency system 720, or a baseband processor 731.

[0363] The processor, processor system, application processor, baseband processor, processor circuit, or processor core mentioned above can be collectively referred to as a processor. The processor may include one or more of the following: central processing unit (CPU), digital signal processor (DSP), microprocessor unit (MPU), microcontroller unit (MCU), graphics processing unit (GPU), field programmable gate array (FPGA), artificial intelligence processor (AI processor), or neural processing unit (NPU).

[0364] The aforementioned memory may include one or more of the following storage media: random access memory (RAM), static random access memory (SRAM), dynamic random access memory (DRAM), phase-change memory (PCM), resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), cache, register, read-only memory (ROM), flash memory, erasable programmable read-only memory (EPROM), hard disk, etc. In one example, computer program instructions for executing the above embodiments may be stored on non-volatile memory, such as at least a portion of the aforementioned memory 760 (e.g., one or more of ROM, flash memory, EPROM, or hard disk). When the terminal device is running, the corresponding computer program instructions may be partially or wholly loaded onto a memory with a faster transfer speed than the processor, such as at least a portion of the memory 736 and / or memory 7312 described above (e.g., one or more of RAM, SRAM, DRAM, PCM, RERAM, MRAM, FRAM, cache, or register), for the processor to execute in order to implement the steps in the above method embodiments.

[0365] In one example, the RF transceiver 722 and the RF front-end 721 can also be packaged in a single chip. In another example, the RF transceiver 722, the RF front-end 721, and the baseband processor 731 can also be packaged in a single chip.

[0366] The terms "system" and "network" in this application embodiment are used interchangeably. "At least one" refers to one or more, and "multiple" refers to two or more. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, or B alone, where A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. "At least one of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, "at least one of A, B, or C" includes A, B, C, AB, AC, BC, or ABC; "at least one of A, B, and C" can also be understood as including A, B, C, AB, AC, BC, or ABC. Furthermore, unless otherwise specified, the ordinal numbers such as "first" and "second" mentioned in this application embodiment are used to distinguish multiple objects and are not used to limit the order, sequence, priority, or importance of multiple objects.

[0367] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, optical storage, etc.) containing computer-usable program code.

[0368] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to this application. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0369] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0370] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0371] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A communication method characterized by comprising: Comprising: determining a first intermediate key according to a session root key of a first session of a terminal device, the first intermediate key being used to derive a first session key, the first session key being used to protect first user plane data of the first session and second user plane data of the first session in a transmission process between the terminal device and a split node, the first user plane data being transmitted to a first user plane anchor point through the split node, the second user plane data being transmitted to a second user plane anchor point through the split node; sending the first intermediate key or the first session key to the split node.

2. The method of claim 1, wherein, The determining a first intermediate key according to a session root key of a first session of a terminal device comprises: determining the first intermediate key according to the session root key, and a first counter and / or a second counter; wherein the first counter is used to record a number of times of deriving intermediate keys for the first session, and the second counter is used to record a number of data packets of the first session that have been transmitted.

3. The method of claim 2, wherein, Further comprising: sending a request message to the first user plane anchor point, the request message being used to request to obtain the second counter; receiving the second counter from the first user plane anchor point.

4. The method of any one of claims 1 to 3, wherein, The first session key is derived according to the first intermediate key and a first security algorithm, the first security algorithm comprising a first confidentiality protection algorithm and / or a first integrity protection algorithm.

5. The method of claim 4, wherein, Further comprising: obtaining a user plane security capability of the terminal device, the user plane security capability being used to indicate user plane security algorithms supported by the terminal device; obtaining the first security algorithm according to the security capability of the terminal device.

6. The method of claim 5, wherein, The obtaining the first security algorithm according to the security capability of the terminal device comprises: sending the user plane security capability to the split node; receiving the first security algorithm from the split node, the user plane security algorithms supported by the terminal device comprising the first security algorithm.

7. The method of claim 4, wherein, Further comprising: determining the first security algorithm according to a second security algorithm, the second security algorithm being used to protect third user plane data of the first session between the terminal device and the first user plane anchor point.

8. The method of any one of claims 1 to 6, wherein, Further comprising: determining a second intermediate key according to the session root key, the second intermediate key being used to derive a second session key, the second session key being used to protect the third user plane data of the first session in a transmission process between the terminal device and the first user plane anchor point; sending the second intermediate key or the second session key to the first user plane anchor point.

9. The method of claim 8, wherein, The second session key is derived according to the second intermediate key and a second security algorithm, the second security algorithm comprising a second confidentiality protection algorithm and / or a second integrity protection algorithm.

10. The method of claim 9, wherein, Further comprising: obtaining a user plane security capability of the terminal device, the user plane security capability being used to indicate user plane security algorithms supported by the terminal device; obtaining the second security algorithm according to the security capability of the terminal device.

11. The method of claim 10, wherein, The obtaining the second security algorithm according to the security capability of the terminal device comprises: sending, to the first user plane anchor point, the user plane security capability; receiving, from the first user plane anchor point, the second security algorithm, the user plane security algorithm supported by the terminal device including the second security algorithm.

12. The method of any one of claims 1 to 11, wherein, Further comprising: sending, to the first user plane anchor point, first indication information, the first indication information being used to indicate that the downlink user plane data of the first session is not to be protected by security.

13. The method of any one of claims 1 to 12, wherein, Further comprising: sending, to the second user plane anchor point, second indication information, the second indication information being used to indicate that the downlink user plane data of the first session is not to be protected by security.

14. The method of any one of claims 1 to 13, wherein, The determining, according to a session root key of a first session of a terminal device, of a first intermediate key comprises: In a case where it is determined to split the user plane data of the first session, determining, according to the session root key, the first intermediate key.

15. A method of communication, comprising: Comprise: determining, according to a session root key of a first session of a terminal device, a first intermediate key; deriving, according to the first intermediate key, a first session key, the first session key being used to protect first user plane data of the first session and second user plane data of the first session in a transmission process between the terminal device and a split node, the first user plane data being transmitted to a first user plane anchor point through the split node, and the second user plane data being transmitted to a second user plane anchor point through the split node.

16. The method of claim 15, wherein, The determining, according to a session root key of a first session of a terminal device, of a first intermediate key comprises: determining, according to the session root key and a first counter and / or a second counter, the first intermediate key; The first counter is used to record a number of times of deriving intermediate keys for the first session, and the second counter is used to record a number of data packets of the first session that have been transmitted.

17. The method of claim 15 or 16, wherein, The deriving, according to the first intermediate key, of a first session key comprises: deriving, according to the first intermediate key and a first security algorithm, the first session key, the first security algorithm including a first confidentiality protection algorithm and / or a first integrity protection algorithm.

18. The method of claim 17, wherein, Further comprising: receiving, from a session management network element, the first security algorithm; or receiving, from the split node, the first security algorithm.

19. The method of any one of claims 15 to 18, wherein, Further comprising: determining, according to the session root key, a second intermediate key; deriving, according to the second intermediate key, a second session key, the second session key being used to protect third user plane data of the first session in a transmission process between the terminal device and the first user plane anchor point.

20. The method of claim 19, wherein, The deriving, according to the second intermediate key, of a second session key comprises: deriving, according to the second intermediate key and a second security algorithm, the second session key, the second security algorithm including a second confidentiality protection algorithm and / or a second integrity protection algorithm.

21. The method of claim 20, wherein, Further comprising: receiving, from a session management network element, the second security algorithm; or receiving, from the first user plane anchor point, the second security algorithm.

22. The method of any one of claims 15 to 21, wherein, Further comprising: security processing the first user plane data of the first session based on the first session key, and sending the security processed first user plane data of the first session, wherein a packet header of the security processed first user plane data of the first session carries information of the first user plane anchor point; security processing the second user plane data of the first session based on the first session key, and sending the security processed second user plane data of the first session, wherein a packet header of the security processed second user plane data of the first session carries information of the second user plane anchor point.

23. A communications device, characterized by A module for performing the method of any one of claims 1 to 14, or the method of any one of claims 15 to 22.

24. A communications device, characterized by A processor and an interface circuit, wherein the processor is configured to communicate with other devices via the interface circuit to implement the method of any one of claims 1 to 14, or implement the method of any one of claims 15 to 22.

25. A computer program product, characterised in that, The computer program product comprises instructions which, when executed, implement the method of any one of claims 1 to 14, or implement the method of any one of claims 15 to 22.

26. A computer-readable storage medium, characterized in that, The storage medium stores a computer program or instructions which, when executed, implement the method of any one of claims 1 to 14, or implement the method of any one of claims 15 to 22.

27. A communication system, characterized by comprising: a session management network element configured to implement the method of any one of claims 1 to 14; a split node configured to receive a first intermediate key or a first session key from the session management network element.

28. The system of claim 27, wherein, Further comprising: the split node is further configured to, in a case where the first intermediate key is received, derive the first session key based on the first intermediate key and a first security algorithm.

29. The system of claim 27 or 28, wherein, The system further comprises a terminal device configured to implement the method of any one of claims 15 to 22.

30. The system of any one of claims 27 to 29, wherein, The system further comprises a first user plane anchor point and a second user plane anchor point; the first user plane anchor point is configured to send or receive first user plane data of the first session between the terminal device and the first user plane anchor point; the second user plane anchor point is configured to send or receive second user plane data of the first session between the terminal device and the second user plane anchor point.

Images