Communication method and device

Abstract

The invention discloses a communication method and device. A first network device obtains a first key of a terminal. And the first network equipment verifies a first data packet from the terminal based on the first secret key, wherein the first data packet is received through the satellite. And if the verification is successful, the first network device sends a second data packet to a second network device, the second data packet being determined according to the first data packet, and the second data packet being used for the second network device to execute verification. In the embodiment of the invention, the second network equipment can execute verification, and the first network equipment can also execute verification, which is equivalent to realizing a double-layer verification mechanism, and the system security is improved.

Description

Technical Field

[0001] This application relates to the field of communication technology, and in particular to a communication method and apparatus. Background Technology

[0002] In satellite systems with transient connectivity, key negotiation cannot be achieved by establishing a connection; therefore, the key negotiation process must take place over a terrestrial network. For example, in a terrestrial network, the terminal negotiates the key with a gateway. In satellite communication, the terminal can send information using this key, which travels via satellite to the gateway. The gateway can then authenticate the terminal based on the received information and the key. Current authentication mechanisms are overly simplistic and lack sufficient security. Summary of the Invention

[0003] This application provides a communication method and apparatus to improve system security.

[0004] Firstly, a first communication method is provided, which can be applied to a first device. The first device is, for example, a network-side device, also referred to as a network device. The network device is, for example, a network equipment, or other equipment including network equipment functions, or a circuit, or a system-on-a-chip (or chip), or other functional module capable of implementing the functions of the network equipment, and is, for example, disposed within the network equipment. The network equipment can be a non-ORAN architecture or an ORAN architecture; or, the network equipment can be a CU, DU, or RU under an ORAN architecture. The network equipment is, for example, located on the ground, or the network equipment is, for example, a satellite, or located on a satellite. The network equipment is, for example, referred to as a first network device. The method includes: obtaining a first key from a terminal; verifying a first data packet from the terminal based on the first key, the first data packet being received via a satellite; if the verification is successful, sending a second data packet to a second network device, the second data packet being determined based on the first data packet, the second data packet being used by the second network device to perform the verification.

[0005] In this embodiment, in addition to the second network device performing verification, the first network device can also perform verification, which is equivalent to implementing a two-layer verification mechanism and improving system security.

[0006] In one optional implementation, there is no Radio Resource Control (RRC) connection between the first network device and the terminal. Because there is no RRC connection between the first network device and the terminal, the first network device cannot currently obtain the terminal's key, and therefore lacks verification functionality. However, this embodiment enables the first network device to obtain the terminal's key, thereby allowing the first network device to perform verification based on that key, thus improving system security.

[0007] In one optional implementation, obtaining the first key of the terminal includes: receiving the first key from the second network device or the terminal; or, negotiating the first key with the terminal. For example, the terminal can negotiate the first key with the second network device, and the terminal or the second network device can send the negotiated first key to the first network device. Alternatively, the terminal can also negotiate the first key with the first network device. Therefore, the method of obtaining the first key is quite flexible.

[0008] In an optional implementation, after negotiating the first key with the terminal, the method further includes sending the first key to the second network device. If the terminal negotiates the first key with the first network device, either the terminal or the first network device can send the first key to the second network device, enabling both the first and second network devices to perform verification based on the first key.

[0009] In an optional implementation, the method further includes: receiving M third data packets from the terminal, where M is a positive integer; and obtaining the first data packet based on the M third data packets. For example, in the case of limited transmission resources, the terminal can split the first data packet into M third data packets for transmission. After receiving the M third data packets, the first network device can obtain the first data packet based on the M third data packets, thereby verifying the first data packet.

[0010] In one optional implementation, the first key includes a second key and a third key. Verifying the first data packet based on the first key includes: decrypting the first data packet based on the second key to obtain a first application verification code and first data, wherein the first data is plaintext or ciphertext data; obtaining a second application verification code based on the first data and the third key; and verifying the first data packet based on the first application verification code and the second application verification code. The first network device can verify the first data packet based on the application verification code, which provides an optional verification method. Furthermore, the first data can be ciphertext data, and the first network device can choose not to decrypt the first data, thereby achieving data isolation and improving data security.

[0011] In one optional implementation, the first key includes a second key and a third key. Verifying the first data packet based on the first key includes: decrypting the first data packet based on the second key to obtain a first application verification code and first information, wherein the first information is obtained by encrypting the first data and the third application verification code using a sixth key; obtaining a second application verification code based on the first information and the third key; and verifying the first data packet based on the first application verification code and the second application verification code. The first network device can verify the first data packet based on the application verification code, which provides an optional verification method. Furthermore, the first network device may not have a sixth key and therefore cannot decrypt the first information, thereby achieving data isolation and improving data security.

[0012] In one optional implementation, the first information is obtained by encrypting the first data and the third application verification code using a sixth key. The second data packet includes the first information but does not include the first application verification code. The first application verification code is used for verification by the first network device. The second network device can perform verification based on the third application verification code without needing to perform verification based on the first application verification code. Therefore, the first network device does not need to send the first application verification code to the second network device, thereby reducing the transmission of redundant information and saving transmission overhead.

[0013] In one optional implementation, obtaining the second application verification code based on the first information and the third key includes: obtaining the second application verification code based on the first information, first time information, and the third key, wherein the first time information is used to indicate the time when the first network device receives the first data packet in the first data packet from the terminal. Obtaining the second application verification code can be based on the first time information or not, offering flexibility.

[0014] In one optional implementation, the first data packet includes second time information, which indicates the time when the terminal generates the first application verification code.

[0015] In an optional implementation, before obtaining the second application verification code based on the first information and the third key, the method further includes: determining whether to verify the first data packet based on the first key, based on the first time information and the second time information. For example, this can be understood as the first network device performing a simple verification based on the first and second time information; if the verification passes, then verifying the first data packet based on the first key. Compared to verifying the first data packet based on the first key, the verification process based on time information is simpler. If the verification based on time information fails, it is unnecessary to verify the first data packet based on the first key again, thus simplifying the verification process of the first network device.

[0016] In one optional implementation, the first key includes a second key and a third key. Verifying the first data packet based on the first key includes: decrypting the encrypted first application verification code within the first data packet using the second key to obtain the first application verification code; obtaining a second application verification code based on first data included in the first data packet and the third key, wherein the first data is ciphertext data; and verifying the first data packet based on the first application verification code and the second application verification code. In this verification method, the second key is used to encrypt the first application verification code but not the first data, simplifying the encryption process for the terminal and the decryption process for the first network device.

[0017] In one optional implementation, sending a second data packet to a second network device includes: sending the second data packet and first time information to the second network device, wherein the first time information indicates the time at which the first network device receives the first data packet within the first data packet from the terminal. The first network device may send the first time information to the second network device. Optionally, the first data packet may also include second time information, allowing the second network device to perform a simple verification based on the first and second time information. If the verification passes, the second network device then verifies the first data packet based on a first key, thereby simplifying the verification process for the second network device.

[0018] Secondly, a second communication method is provided, which can be applied to a second device. The second device is, for example, a network-side device, also referred to as a network device. A description of the network device can be found in the first aspect. This network device is referred to, for example, as a second network device. The method includes: obtaining a first key or a fourth key of a terminal; verifying a second data packet from the terminal based on the first key or the fourth key, wherein the second data packet is forwarded via the first network device and is received by the first network device via satellite.

[0019] In one alternative implementation, there is no radio resource control connection between the first network device and the terminal.

[0020] In one optional implementation, obtaining the first key or the fourth key of the terminal includes: receiving the first key or the fourth key from the first network device or the terminal; or, negotiating the first key or the fourth key with the terminal.

[0021] In one alternative implementation, after negotiating the first key with the terminal, the method further includes sending the first key to the first network device.

[0022] In one optional implementation, the first key includes a second key and a third key, wherein verifying the second data packet based on the first key includes: decrypting the second data packet based on the second key to obtain a first application verification code and first data, wherein the first data is plaintext data or ciphertext data; obtaining a second application verification code based on the first data and the third key; and verifying the second data packet based on the first application verification code and the second application verification code.

[0023] In one optional implementation, the second data packet includes first time information and second time information. The first time information is used to indicate the time when the first network device receives the first data packet in the first data packet, the first data packet is used to determine the second data packet, and the second time information is used to indicate the time when the terminal generates the first application verification code.

[0024] In an optional implementation, before obtaining the second application verification code based on the first data and the third key, the method further includes: determining whether to verify the second data packet from the terminal based on the first time information and the second time information, based on the first time information and the second time information.

[0025] In one optional implementation, the first data is encrypted data, and the method further includes: if the verification is successful, decrypting the first data based on the fifth key to obtain the second data.

[0026] In one optional implementation, the fourth key includes a sixth key and a seventh key, wherein verifying the second data packet based on the fourth key includes: decrypting the second data packet based on the sixth key to obtain a third application verification code and first data; obtaining a fourth application verification code based on the first data and the seventh key; and verifying the first data packet based on the third application verification code and the fourth application verification code.

[0027] For the technical effects of the second aspect or its various alternative implementations, please refer to the description of the technical effects of the first aspect or its corresponding implementations.

[0028] Thirdly, a third communication method is provided, which can be applied to a third device. The third device is, for example, a terminal-side device, also referred to as a terminal device. This terminal device is, for example, a terminal equipment, or other equipment including terminal equipment functions, or a circuit, or a system-on-a-chip (or chip, such as a modem chip, also known as a baseband chip, or a system-on-a-chip (SoC) chip containing a modem core, or a system-in-package (SIP) chip) or other functional module, which can implement the functions of the terminal equipment, and is, for example, disposed in the terminal equipment. The method includes: encrypting first data and a third application verification code based on a sixth key to obtain first information, wherein the third application verification code is obtained based on the first data and a seventh key; obtaining a first application verification code based on the first information and the third key; generating a first data packet based on a second key, the first information, and the first application verification code; and sending the first data packet.

[0029] For example, the third application checksum can be used for verification by the second network device, and the first application checksum can be used for verification by the first network device. This means that different network devices can use different checksums for verification, and thus different network devices can maintain different keys. For example, the first network device and the second network device do not need to exchange keys, thereby improving system security.

[0030] In one alternative implementation, sending the first data packet includes: sending the first data packet to a satellite, the first data packet being transmitted via the satellite to a first network device.

[0031] In one alternative implementation, there is no radio resource control connection between the terminal and the first network device.

[0032] In an optional implementation, the method further includes: negotiating the second key and the third key with the first network device; and negotiating the sixth key and the seventh key with the second network device. The terminal can negotiate its own keys with different network devices separately, eliminating the need for different network devices to exchange keys, thereby improving system security.

[0033] Regarding the technical effects of the optional implementations of the third aspect, refer to the description of the technical effects of the first aspect or corresponding implementations, and / or refer to the description of the technical effects of the second aspect or corresponding implementations.

[0034] Fourthly, a fourth communication method is provided, which can be applied to a fourth device. The fourth device is, for example, a terminal-side device, also referred to as a terminal device. For a description of the terminal device, please refer to the third aspect. The method includes: negotiating a first key with a first network device or a second network device, the first key being used to verify data packets of the terminal.

[0035] In one alternative implementation, the first key is negotiated with the first network device, and the method further includes: negotiating a fourth key with the second network device.

[0036] Regarding the technical effects of the fourth aspect or various optional implementations of the fourth aspect, reference may be made to one or more of the following: a description of the technical effects of the first aspect or corresponding implementation, a description of the technical effects of the second aspect or corresponding implementation, or a description of the technical effects of the third aspect or corresponding implementation.

[0037] Fifthly, an apparatus is provided. The apparatus can be a network-side device as described in the first or second aspect above. The apparatus possesses the functions of the aforementioned network-side device. For example, the apparatus is capable of implementing the functions described in the first or second aspect above. For instance, the apparatus includes modules, units, or means corresponding to performing the operations involved in the first or second aspect above. These modules, units, or means can be implemented through software, hardware, or a combination of software and hardware. The apparatus is, for example, a network device, or other device including network device functions, or a chip system (or chip or circuit) or other functional module capable of implementing the functions of a network device. This chip system or functional module is, for example, disposed within a network device. In one optional implementation, the apparatus includes a baseband device and a radio frequency device. In another optional implementation, the apparatus includes a processing unit (sometimes also called a processing module) and a transceiver unit (sometimes also called a transceiver module). A transceiver unit can perform both sending and receiving functions. When the transceiver unit performs the sending function, it can be called a sending unit (sometimes also called a sending module), and when it performs the receiving function, it can be called a receiving unit (sometimes also called a receiving module). The sending unit and the receiving unit can be the same functional module, which is called the transceiver unit and can perform both sending and receiving functions; or, the sending unit and the receiving unit can be different functional modules, and the transceiver unit is a collective term for these functional modules.

[0038] In one optional implementation, the processing unit is configured to obtain a first key of the terminal; the processing unit is further configured to verify a first data packet from the terminal based on the first key, the first data packet being received via satellite; the transceiver unit (or the sending unit) is configured to send a second data packet to a second network device if the verification is successful, the second data packet being determined based on the first data packet, the second data packet being used by the second network device to perform verification.

[0039] In one optional implementation, the processing unit is configured to obtain a first key or a fourth key of the terminal; the processing unit is further configured to verify a second data packet from the terminal based on the first key or the fourth key, wherein the second data packet is forwarded via a first network device and is received by the first network device via a satellite.

[0040] In an alternative embodiment, the device further includes a storage unit (sometimes also called a storage module), the processing unit being coupled to the storage unit and executing programs or instructions in the storage unit to enable the device to perform the functions of the network-side device described in the first or second aspect above.

[0041] Sixthly, an apparatus is provided. The apparatus can be a terminal-side device as described in the third or fourth aspect above. The apparatus possesses the functions of the aforementioned terminal-side device. For example, the apparatus is capable of implementing the functions described in the third or fourth aspect above. For instance, the apparatus includes modules, units, or means corresponding to performing the operations involved in the third or fourth aspect above. These modules, units, or means can be implemented through software, hardware, or a combination of software and hardware. The apparatus is, for example, a terminal device, or other device including terminal device functions, or a chip system (or chip or circuit) or other functional module capable of implementing the functions of a terminal device. This chip system or functional module is, for example, disposed within a terminal device. In one optional implementation, the apparatus includes a baseband device and a radio frequency device. In another optional implementation, the apparatus includes a processing unit (sometimes also called a processing module) and a transceiver unit (sometimes also called a transceiver module). For details on the implementation of the transceiver unit, please refer to the description in the fifth aspect.

[0042] In one optional implementation, the processing unit is configured to encrypt the first data and the third application verification code based on the sixth key to obtain the first information, wherein the third application verification code is obtained based on the first data and the seventh key; the processing unit is further configured to obtain the first application verification code based on the first information and the third key; the processing unit is further configured to generate a first data packet based on the second key, the first information, and the first application verification code; the transceiver unit (or the sending unit) is configured to send the first data packet.

[0043] In one optional implementation, the processing unit is configured to negotiate a first key with a first network device or a second network device, the first key being used to verify data packets of the terminal.

[0044] In an alternative embodiment, the device further includes a storage unit (sometimes also called a storage module), the processing unit being coupled to the storage unit and executing programs or instructions in the storage unit to enable the device to perform the functions of the terminal-side device described in the third or fourth aspect above.

[0045] A seventh aspect provides an apparatus comprising a memory and one or more processors. The memory is used to store part or all of a computer program or instructions necessary for implementing the functions described in the first or second aspect. The one or more processors are executable to carry out the computer program or instructions, such that, when executed, the apparatus implements the methods in any possible design or implementation of the first or second aspect.

[0046] In one possible design, the device may further include interface circuitry, wherein the processor is configured to communicate with other devices or components via the interface circuitry.

[0047] In one possible design, the device may also include the memory.

[0048] The aforementioned device may be a network device, a communication module in a network device, or a chip in a network device that is responsible for communication functions, such as a modem chip (also known as a baseband chip) or a SoC or SIP chip that contains a modem module.

[0049] Eighthly, an apparatus is provided, the apparatus comprising a memory and one or more processors. The memory is used to store part or all of a computer program or instructions necessary for implementing the functions involved in the third or fourth aspect described above. The one or more processors are executable to carry out the computer program or instructions, such that, when executed, the apparatus implements the methods in any possible design or implementation of the third or fourth aspect described above.

[0050] In one possible design, the device may further include interface circuitry, wherein the processor is configured to communicate with other devices or components via the interface circuitry.

[0051] In one possible design, the device may also include the memory.

[0052] The aforementioned device may be a terminal, or a communication module in the terminal, or a chip in the terminal responsible for communication functions such as a modem chip (also known as a baseband chip) or a SoC or SIP chip containing a modem module.

[0053] A ninth aspect provides a communication system including a first network device, wherein the first network device is configured to perform the method described in the first aspect, which is executed by a network-side device. For example, the network-side device may be implemented using the apparatus described in the fifth or seventh aspect.

[0054] Optionally, the communication system further includes a second network device, wherein the second network device is used to perform the method described in the second aspect and executed by the network-side device. For example, the network-side device can be implemented using the apparatus described in the fifth or seventh aspect.

[0055] Optionally, the communication system further includes a terminal device, wherein the terminal device is used to perform the method executed by the terminal apparatus as described in the third or fourth aspect above. For example, the terminal device can be implemented using the apparatus described in the sixth or eighth aspect.

[0056] A tenth aspect provides a communication system including a second network device, wherein the second network device is configured to perform the method described in the second aspect, which is executed by a network-side device. For example, the network-side device may be implemented using the apparatus described in the fifth or seventh aspect.

[0057] Optionally, the communication system further includes a first network device for performing the method described in the first aspect, which is executed by the network-side device. For example, the network-side device can be implemented using the apparatus described in the fifth or seventh aspect.

[0058] Optionally, the communication system further includes a terminal device, wherein the terminal device is used to perform the method executed by the terminal apparatus as described in the third or fourth aspect above. For example, the terminal device can be implemented using the apparatus described in the sixth or eighth aspect.

[0059] Eleventhly, a computer-readable storage medium is provided for storing a computer program or instructions that, when executed, cause the methods performed by the network-side device or terminal-side device in the above aspects to be implemented.

[0060] In a twelfth aspect, a computer program product containing instructions is provided, which, when the computer program or instructions are run on a computer, causes the methods described in the above aspects to be implemented.

[0061] In a thirteenth aspect, a chip system is provided, including a processor and an interface, the processor being configured to call and execute instructions from the interface to enable the chip system to implement the methods described above. Attached Figure Description

[0062] Figure 1A and Figure 1B These are schematic diagrams illustrating two application scenarios of embodiments of this application;

[0063] Figure 2 , Figure 4 , Figure 6 Flowcharts of several communication methods provided in the embodiments of this application;

[0064] Figure 3 , Figure 5A , Figure 5B , Figure 7 These are several schematic diagrams illustrating how the UE determines the first data packet in embodiments of this application;

[0065] Figure 8 A schematic diagram of an apparatus provided in an embodiment of this application;

[0066] Figure 9 This is a schematic diagram of another device provided in an embodiment of this application. Detailed Implementation

[0067] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the embodiments of this application will be further described in detail below with reference to the accompanying drawings.

[0068] In this application embodiment, the number of nouns, unless otherwise specified, refers to "singular nouns or plural nouns," that is, "one or more." "At least one" means one or more, and "more than one" means two or more. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can mean: A exists alone, A and B exist simultaneously, or B exists alone, where A and B can be singular or plural. The character " / " generally indicates that the related objects before and after are in an "or" relationship. For example, A / B means: A or B. "At least one of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one of a, b, or c means: a, b, c, a and b, a and c, b and c, or a and b and c, where a, b, and c can be single or multiple.

[0069] The ordinal numbers such as "first" and "second" mentioned in the embodiments of this application are used to distinguish multiple objects, and are not used to limit the size, content, order, timing, priority, or importance of the multiple objects. The numbering of steps in the various embodiments described in this application is only to distinguish different steps, and is not used to limit the order of steps.

[0070] The following explanations of some terms or concepts used in the embodiments of this application are provided to facilitate understanding by those skilled in the art.

[0071] In this embodiment of the application, the terminal device is a device with wireless transceiver function, which may be a fixed device, a mobile device, a handheld device (e.g., a mobile phone), a wearable device, an in-vehicle device, or a wireless device (e.g., a communication module, a modem, or a chip system, etc.) built into the above devices. The terminal devices are used to connect people, objects, and machines, and can be widely used in various scenarios, including but not limited to the following: satellite communication, sensing scenarios, cellular communication, device-to-device (D2D) communication, vehicle-to-everything (V2X) communication, machine-to-machine / machine-type communications (M1M / MTC) communication, internet of things (IoT), virtual reality (VR), augmented reality (AR), industrial control, self-driving, remote medical care, smart grid, smart furniture, smart office, smart wearables, smart transportation, smart city, drones, robots, and terminal devices for indoor commercial scenarios (such as mobile phone screen mirroring, file sharing, and mobile phone to VR glasses). When the terminal equipment is applied to V2X, it can also be called a V2X device, such as a smart car, digital car, unmanned car, driverless car, pilotless car, or automobile, self-driving car, or autonomous car, pure electric vehicle (EV), hybrid electric vehicle (HEV), range-extended electric vehicle (REEV), plug-in hybrid electric vehicle (PHEV), new energy vehicle, or roadside unit (RSU). The terminal equipment can also be a device used in D2D communication, such as an electricity meter or water meter.

[0072] Furthermore, in this embodiment of the application, the terminal device can also be a terminal device in an Internet of Things (IoT) system. IoT is an important component of the future development of information technology. Its main technical feature is to connect objects to the network through communication technology, thereby realizing an intelligent network of human-machine interconnection and object-to-object interconnection.

[0073] The various terminal devices described above, if located in a vehicle (e.g., placed inside or installed inside a vehicle), can all be considered in-vehicle terminal devices, also known as on-board units (OBUs). The terminal device of this application can also be an in-vehicle module, in-vehicle component, in-vehicle chip, or in-vehicle unit built into a vehicle as one or more components or units. The vehicle can implement the methods of this application through the built-in in-vehicle module, in-vehicle component, in-vehicle chip, or in-vehicle unit.

[0074] The terminal equipment may sometimes be referred to as user equipment (UE), terminal, access station, UE station, remote station, wireless communication equipment, or user device, etc.

[0075] In this application embodiment, the communication device used to implement the terminal device function can be a terminal device, which can be a terminal device or a device capable of supporting the terminal device to implement the function, such as a chip system. This device can be installed in the terminal device. In the technical solutions provided in this application embodiment, the example of a terminal device being used to implement the terminal device function is used to describe the technical solutions provided in this application embodiment.

[0076] The network devices in this application embodiment include, for example, access network devices (or access network elements) and / or core network devices (or core network elements). The access network devices are devices with wireless transceiver capabilities, used to communicate with the terminal devices. The access network devices include, but are not limited to, base stations (base transceiver stations (BTS), Node B, evolved Node B (eNodeB) / eNB, or the next generation Node B (gNodeB) / gNB), transmission reception points (TRPs), base stations evolved from the 3rd generation partnership project (3GPP), access nodes in wireless fidelity (Wi-Fi) systems, wireless relay nodes, wireless backhaul nodes, etc. The base stations can be: macro base stations, micro base stations, pico base stations, small cells, relay stations, etc. Multiple base stations can support networks using the same access technology or networks using different access technologies. A base station can contain one or more co-located or non-co-located transmission and reception points. The access network equipment can also be a radio controller, centralized unit (CU), and / or distributed unit (DU) in a cloud radioaccess network (CRAN) scenario. The access network equipment can also be a server, etc. For example, the network equipment in V2X technology can be a roadside unit (RSU). The following description uses a base station as an example to illustrate the access network equipment. A base station can communicate with a terminal device, or it can communicate with a terminal device through a relay station. A terminal device can communicate with multiple base stations in different access technologies. The core network equipment is used to implement functions such as mobility management, data processing, session management, policy and billing. The names of the equipment implementing core network functions may differ in systems using different access technologies; this application does not limit this.Taking the 5th generation (5G) mobile communication technology system as an example, the core network equipment includes, for example, access and mobility management function (AMF), session management function (SMF), policy control function (PCF), or user plane function (UPF), etc.

[0077] In a CU-DU architecture, or in an open RAN (ORAN) system, access network equipment may include one or more logical network elements such as a central unit (CU), a distributed unit (DU), a CU-control plane (CP), a CU-user plane (UP), or a radio unit (RU). CUs and DUs can be separate entities or included in the same network element, such as a baseband unit (BBU). RUs may be included in radio equipment or radio units, such as remote radio units (RRUs), active antenna units (AAUs), or remote radio heads (RRHs).

[0078] In different systems, CU (or CU-CP and CU-UP), DU, or RU may have different names, but those skilled in the art will understand their meaning. For example, in an ORAN system, CU can also be called an open CU (O-CU), DU can also be called an open DU (O-DU), CU-CP can also be called an open CU-CP (O-CU-CP), CU-UP can also be called an open CU-UP (O-CU-CP), and RU can also be called an open RU (O-RU). For ease of description, this application uses CU, CU-CP, CU-UP, DU, and RU as examples in its embodiments. Any of the units among CU (or CU-CP, CU-UP), DU, and RU in the embodiments of this application can be implemented through software modules, hardware modules, or a combination of software modules and hardware modules.

[0079] The CU and DU can be configured according to the protocol layer functions of the wireless network they implement. For example, the CU can be configured to implement the functions of the Packet Data Convergence Protocol (PDCP) layer and above (such as the Radio Resource Control (RRC) layer and / or the Service Data Adaptation Protocol (SDAP) layer); the DU can be configured to implement the functions of protocol layers below the PDCP layer (such as one or more of the Radio Link Control (RLC) layer, Media Access Control (MAC) layer, or Physical (PHY) layer). As another example, the CU can be configured to implement the functions of protocol layers above the PDCP layer (such as the RRC and / or SDAP layers), and the DU can be configured to implement the functions of protocol layers below the PDCP layer (such as one or more of the RLC, MAC, or PHY layers).

[0080] The above CU and DU configurations are merely examples; the functions of the CU and DU can be configured as needed. For instance, the CU or DU can be configured to have more protocol layer functions, or only some protocol layer processing functions. For example, some RLC layer functions and protocol layer functions above the RLC layer can be placed in the CU, while the remaining RLC layer functions and protocol layer functions below the RLC layer can be placed in the DU. Furthermore, the functions of the CU or DU can be divided according to service type or other system requirements, such as by latency. Functions that require low latency can be placed in the DU, while functions that do not require low latency can be placed in the CU.

[0081] DU and RU can cooperate to implement the functions of the PHY layer. A DU can be connected to one or more RUs. The functions of DU and RU can be configured in various ways depending on the design. For example, a DU can be configured to implement baseband functions, and an RU can be configured to implement mid-RF functions. Another example is that a DU can be configured to implement higher-level functions in the PHY layer, and an RU can be configured to implement lower-level functions in the PHY layer, or to implement both lower-level and RF functions. Higher-level functions in the physical layer can include a portion of the physical layer's functions that are closer to the MAC layer, while lower-level functions in the physical layer can include another portion of the physical layer's functions that are closer to the mid-RF side.

[0082] In this application embodiment, the communication device used to implement the functions of a network device can be called a network device. This network device can be a network element, a network device, or a device capable of supporting the network device or network element to implement the function, such as a chip system. This device can be installed in the network device. In the technical solutions provided in this application embodiment, the device used to implement the functions of a network device is described as a network device (for example, the device used to implement the functions of an access network device is an access network device, and the device used to implement the functions of a core network device is a core network device).

[0083] The technical features involved in the embodiments of this application are described below.

[0084] In transient satellite systems, there is no radio resource control (RRC) connection between the UE and the satellite. Therefore, the UE and network devices cannot negotiate keys by establishing a connection, and the key negotiation process must be performed on the terrestrial network. For example, in the terrestrial network, the terminal negotiates the key with the gateway. In satellite communication, the terminal can send information based on this key, and the information reaches the gateway via the satellite; the gateway can then authenticate the terminal based on the received information and the key. Current authentication mechanisms are too simplistic and have low security.

[0085] Therefore, in this embodiment of the application, in addition to the second network device being able to perform verification, the first network device can also perform verification, which is equivalent to implementing a two-layer verification mechanism and improving system security.

[0086] The communication method provided in this application can be applied to fourth-generation (4G) communication systems, such as long-term evolution (LTE) systems, and also to fifth-generation (5G) communication systems, such as 5G new radio (NR) systems, or to various communication systems evolving after 5G, such as future communication systems and 6G systems. The method provided in this application can also be applied to Bluetooth systems, wireless fidelity (Wi-Fi) systems, long-range radio (LoRa) systems, or vehicle-to-everything (V2X) systems. The method provided in this application can also be applied to terrestrial networks (TN) and non-terrestrial networks (NTN). NTN can refer to a network device located at a high altitude relative to the terminal. A typical application scenario in NTN is a satellite communication system. For example, this satellite communication system can be a system with instantaneous connection, without limitation.

[0087] Please refer to Figure 1A This is a schematic diagram of an application scenario according to an embodiment of this application. Figure 1A This includes a UE, a first network device, and a second network device. The first and second network devices can be located on the ground, and the first network device is capable of communicating with a satellite. The UE can communicate with the satellite, but there is no persistent radio resource control (RRC) connection between the UE and the satellite or the network devices behind the satellite; instead, it is a transient connection (i.e., no satellite transmission is required based on establishing a connection between the UE and other devices). Figure 1A The satellite communication system shown can also be considered a satellite communication system with instantaneous connectivity. Optionally, the first network device may also be called a central station or ground station, or may have other names. Optionally, the first network device may be an access network-side device. Optionally, the first network device may be a core network-side device. The second network device may be, for example, a gateway, such as a converged gateway, or other gateways, or may be other core network devices besides gateways.

[0088] Please refer to Figure 1B This is a schematic diagram of another application scenario of this application embodiment. Figure 1BIt includes a UE, a first network device, and a second network device. The first and second network devices can be located on the ground, and the first network device can communicate with the UE. Optionally, the first network device is, for example, an access network-side device, such as a base station or other access network device. The second network device is, for example, a core network-side device, such as a gateway or other core network device. Figure 1B The communication system shown can be a terrestrial cellular communication system.

[0089] The method provided in the embodiments of this application is described below with reference to the accompanying drawings. In various embodiments of this application, "secret key" can also be replaced with "key". In various embodiments of this application, "verification" can also be replaced with or understood as "authentication", for example, verification or authentication can determine the legitimacy of the UE, or determine whether the data packet comes from a subscribed UE, or determine the reliability of the data packet, etc. In the accompanying drawings corresponding to the various embodiments of this application, all steps indicated by dashed lines are optional steps. The various embodiments of this document can be applied to Figure 1A or Figure 1B The network architecture is shown. For example, the UE described in the various embodiments of this document can be... Figure 1A or Figure 1B The UE shown, and the first network device described in the various embodiments of this document, can be... Figure 1A or Figure 1B The first network device shown herein, and the second network device described in the various embodiments herein, may be... Figure 1A or Figure 1B The second network device shown.

[0090] This application provides a first communication method, please refer to... Figure 2 Here is a flowchart of the method.

[0091] S201, The first network device obtains the UE's first key.

[0092] Optionally, the first key may include a second key and a third key. Figure 2 Taking this as an example, the third key is used to determine the application checksum (which will be discussed later); the second key is used to encrypt data packets. The second and third keys can be the same or different.

[0093] Optionally, the second key can correspond to the first validity period, and the third key can correspond to the second validity period. For example, in addition to obtaining the first key, the first validity period and / or the second validity period can also be obtained. Optionally, the first validity period can be determined when negotiating the second key; the second validity period can be determined when negotiating the third key. The first validity period can indicate the effective time of the second key, or indicate the time when the second key is invalid (or expires). For example, when the first validity period arrives, the UE can renegotiate with the first network device and / or the second network device to update the second key. The second validity period can indicate the effective time of the third key, or indicate the time when the third key is invalid (or expires). For example, when the second validity period arrives, the UE can renegotiate with the first network device and / or the second network device to update the third key.

[0094] The first validity period and the second validity period can be the same or different. If the first validity period and the second validity period are the same, it facilitates the UE or corresponding network devices (e.g., the first network device and / or the second network device) in maintaining the second and third keys. For example, the second and third keys can be effective and expire simultaneously, simplifying the key maintenance process for the UE or corresponding network devices. If the first validity period and the second validity period are different, the UE or corresponding network devices can negotiate the first and second validity periods separately during negotiation, allowing the validity periods of different keys to correspond to the purpose of the key, thus providing greater flexibility.

[0095] Optionally, the first network device can negotiate and determine a first key with the UE, in which case both the first network device and the UE can obtain the first key. In this approach, it can be assumed that both the UE and the first network device can obtain the first key in S201. Optionally, in addition to negotiating the first key with the UE, the first network device can also negotiate the validity period corresponding to the first key. For example, negotiating a first validity period and / or a second validity period.

[0096] Alternatively, the UE can negotiate and determine a first key with a second network device. The UE or the second network device can then send the negotiated first key to the first network device, allowing the first network device to obtain the first key. In this approach, it can be assumed that the UE obtains the first key before S201, and the first network device obtains the first key in S201. Optionally, in addition to sending the first key to the first network device, the UE or the second network device can also send the UE's identifier and / or the validity period corresponding to the first key (e.g., a first validity period and / or a second validity period). The UE's identifier enables the first network device to determine that the first key corresponds to that UE; the validity period enables the first network device to determine the valid usage time of the first key. As an optional implementation whereby the UE or the second network device sends the UE's identifier and the first key, the UE or the second network device can send the correspondence between the first key and the UE's identifier.

[0097] Alternatively, the UE can negotiate with the first network device to determine a portion of the first key, and with the second network device to determine the remaining key. The second network device or the UE can then send the remaining key to the first network device, allowing the first network device to obtain the complete first key. In this approach, it can be assumed that the UE obtains the first key before S201, and the first network device obtains the first key in S201. Optionally, in addition to sending the remaining key to the first network device, the UE or the second network device can also send the UE's identifier and / or the validity period corresponding to the remaining key (e.g., a first validity period or a second validity period). The UE's identifier allows the first network device to determine that the remaining key corresponds to the UE; the validity period allows the first network device to determine the valid usage time of the remaining key. As an optional implementation whereby the UE or the second network device sends the UE's identifier and the remaining key, the UE or the second network device can send the correspondence between the remaining key and the UE's identifier.

[0098] Optionally, in various embodiments of this application, if the UE and the first network device negotiate and determine a corresponding key, the UE can negotiate with the first network device in a terrestrial network. That is, the UE and the first network device can communicate without satellite to improve negotiation reliability. The UE and the first network device can negotiate and determine the corresponding key, for example, directly with the first network device in a terrestrial network, or through forwarding by other network devices (e.g., forwarding by the second network device). In various embodiments of this application, if the UE and the second network device negotiate and determine a corresponding key, the UE can negotiate with the second network device in a terrestrial network. That is, the UE and the second network device can communicate without satellite to improve negotiation reliability. The terrestrial communication between the UE and the second network device can be forwarded by other network devices (e.g., forwarded by the first network device), or they can communicate directly.

[0099] Optionally, the UE identifier may include, for example, the UE's telephone (TEL) Uniform Resource Identifier (URI), or the UE's TEL URI and its device identity (ID). In simpler terms, a UE's TEL URI can be its telephone number, such as "Tel:+8613904710100". For instance, if a telephone number corresponds to multiple UEs (e.g., a telephone number can correspond to a mobile phone and a smartwatch), the different UEs can be distinguished by their device ID.

[0100] The UE may obtain the first key before S201, or it may obtain the first key in S201. Figure 2 The example given is that the UE obtains the first key in S201.

[0101] S202, the first network device sends a first key to the second network device. Correspondingly, the second network device receives the first key from the first network device.

[0102] If the UE negotiates the first key with the first network device, then S202 can be executed. Alternatively, even if the UE negotiates the first key with the first network device, S202 can be omitted. Instead, S202 can be replaced by the UE sending the first key to the second network device, in which case the second network device can receive the first key from the UE. Alternatively, if the UE negotiates the first key with the second network device, then S202 can be omitted. Therefore, S202 is an optional step.

[0103] If the UE and the first network device have negotiated all the keys in the first key (e.g., negotiated the second and third keys), then in S202, the first network device can send all the keys in the first key (e.g., send the second and third keys). Alternatively, if the UE and the first network device have negotiated only some of the keys in the first key (e.g., negotiated the second or third key), then in S202, the first network device can send only some of the keys in the first key (e.g., send the second or third key). Therefore, in S202, the first network device can send the second key and / or the third key to the second network device.

[0104] Optionally, in addition to sending the first key (e.g., all or part of the first key) to the second network device, the first network device may also send the UE's identifier and / or the validity period corresponding to the first key. The UE's identifier enables the second network device to determine that the first key corresponds to the UE; the validity period enables the second network device to determine the valid usage time of the first key. As an optional implementation whereby the first network device sends the UE's identifier and the first key, the first network device may send the correspondence between the first key and the UE's identifier.

[0105] S203, the UE sends M third data packets. Correspondingly, the first network device receives these M third data packets. M is a positive integer.

[0106] If the embodiments of this application are applied to Figure 1A In the scenario shown, the M third data packets can be received by the satellite, which then transmits them to the first network device, thus enabling the first network device to receive the M third data packets. Alternatively, if the embodiments of this application are applied to... Figure 1B In the scenario shown, the M third data packets can directly reach the first network device without needing to be forwarded by other devices. Alternatively, if the embodiments of this application are applied to... Figure 1B In the scenario shown, the M third data packets can also reach the first network device via forwarding through one or more ground relay devices. There are no restrictions on this.

[0107] The UE can obtain the first data packet based on the first key. The process of the UE obtaining the first data packet based on the first key includes, for example, the following steps: the UE obtains the first application verification code based on the first data and the third key, and then obtains the first data packet based on the second key, the first data, and the first application verification code. (See reference for details.) Figure 3 The first data is, for example, the data to be transmitted by the UE, which can also be called raw data. In this embodiment of the application, the first data is plaintext data, or it can be understood as the first data not being encrypted.

[0108] Optionally, the UE obtains the first application verification code based on the first data and the third key. For example, the UE obtains the first application verification code based on the first data, the second time information, and the third key. Figure 3 Taking this as an example, the second time information may indicate the time when the UE generates the first application verification code, and the time indicated by the second time information may be, for example, Universal Time Coordinated (UTC). Optionally, the first data packet may include the second time information; that is, the UE may carry the second time information in the first data packet, and the second time information may be used by the first network device and / or the second network device to perform verification.

[0109] The UE obtains the first data packet based on the second key, the first data, and the first application verification code. For example, the UE encrypts the first data and the first application verification code based on the second key to obtain the payload of the first data packet; the UE then adds an application layer (AP) header to the payload to obtain the first data packet. The AP header may not be encrypted.

[0110] If the UE can directly send the first data packet, then S203 can be replaced with "UE sends the first data packet"; or, if transmission resources are limited, the first data packet may be segmented and sent, for example, the UE may segment the first data packet into M third data packets for transmission. Figure 2 Taking this as an example, the first data packet may include the UE's device ID, for example, the device ID may be included in the header of the first data packet (e.g., the AP header); or, the first data packet may not include the UE's device ID. Each of the M third data packets may include the UE's TEL URI, which may be included in the header of the third data packet, for example. The first data packet, for example, may not include the UE's TEL URI.

[0111] S204. The first network device verifies the first data packet based on the first key.

[0112] If the UE sends a first data packet in S203, the first network device can verify the first data packet based on the first key after receiving it. Alternatively, if the UE sends M third data packets in S203, and the first network device receives the M third data packets, it can obtain the first data packet based on these M third data packets and then verify the first data packet based on the first key. For example, the first network device can assemble the M third data packets to obtain the first data packet. For example, each of the M third data packets may include the UE's TEL URI, and the first network device can assemble the M third data packets according to the TEL URI to obtain the first data packet. The first network device can determine the first key corresponding to the first data packet based on the TEL URI in the third data packet, or the first network device can determine the first key corresponding to the first data packet based on the TEL URI and the device ID in the assembled first data packet.

[0113] The first network device verifies the first data packet based on the first key, for example, by the following process: the first network device decrypts the first data packet based on the second key to obtain the first application verification code and the first data; the first network device obtains the second application verification code based on the first data and the third key; the first network device verifies the first data packet based on the first application verification code and the second application verification code.

[0114] The first network device obtains the second application verification code based on the first data and the third key. For example, the first network device obtains the second application verification code based on the first data, first time information, and the third key. The first time information may be, for example, the time when the first network device receives the first third data packet out of the M third data packets, or the arrival time of the first third data packet arriving at the first network device out of the M third data packets, or the time when the first network device receives the first data packet (e.g., the first data packet has not been segmented). If the UE obtains the first application verification code based on the first data and the third key, the first network device can obtain the second application verification code based on the first data and the third key; or, if the UE obtains the first application verification code based on the first data, the second time information, and the third key, the first network device can obtain the second application verification code based on the first data, the first time information, and the third key. That is, the information used by the UE and the first network device to obtain the application verification code can be consistent, enabling the application verification codes to match.

[0115] The first network device performs verification based on a first application verification code and a second application verification code. For example, the first network device compares the first application verification code and the second application verification code. If the first application verification code and the second application verification code are the same or identical, the UE is considered legitimate or the first data packet is legitimate, or a second data packet can be sent to the second network device. Alternatively, if the first application verification code and the second application verification code are inconsistent or different, the UE is considered illegitimate or the first data packet is illegitimate, or a second data packet is not sent to the second network device.

[0116] If the first data packet includes second time information, optionally, before executing S204, the first network device can perform a preliminary verification of the first data packet based on the first and second time information. For example, the first network device can determine whether to execute S204 based on the first and second time information. This is equivalent to adding a verification mechanism to the first network device; if the verification passes, S204 is executed; if the verification fails, S204 is not executed, further enhancing security. Furthermore, the verification process based on time information is relatively simple; if the verification fails, S204 is not executed, simplifying the verification process and improving efficiency.

[0117] For example, if the time interval between the time indicated by the second time information and the time indicated by the first time information is greater than or equal to a first threshold, it may indicate that the first data packet is a replay attack, and the verification fails; or, if the time interval between the time indicated by the second time information and the time indicated by the first time information is less than the first threshold, the verification succeeds. The first threshold can be configured by the first network device or the second network device, or pre-configured in the first network device and / or the second network device, or predefined by the protocol. The first threshold is, for example, 5 minutes, or it could be any other value.

[0118] S205, the first network device sends a second data packet to the second network device. Correspondingly, the second network device receives the second data packet.

[0119] The second data packet can be obtained based on the first data packet. For example, the second data packet is the first data packet; or, the second data packet and the first data packet are not the same data packet, but the second data packet is determined based on the first data packet. For example, in the embodiments of this application, the second data packet can be the first data packet, that is, the first network device can forward the first data packet to the second network device without modifying the first data packet, which simplifies the processing of the first network device. Alternatively, the second data packet and the first data packet may not be the same data packet. For example, the first network device can add first time information to the first data packet to obtain the second data packet, then the second data packet has more first time information than the first data packet. Alternatively, the first network device can send the first time information to the second network device, but the first time information may not be carried in the second data packet, but sent separately. Alternatively, the first network device may not send the first time information to the second network device.

[0120] For example, the first network device can send the identifier of the UE corresponding to the second data packet, such as the UE's TELURI, to the second network device to indicate the identifier of the UE corresponding to the second data packet. The UE's identifier can be used by the second network device to determine the first key corresponding to the second data packet.

[0121] Optionally, in S205, in addition to sending the second data packet to the second network device, the first network device may also send the TEL URI corresponding to the UE, which, for example, is not included in the second data packet. This TEL URI allows the second network device to clearly identify that the second data packet originates from the UE.

[0122] If the first network device successfully completes the verification in S204, then S205 can be executed; or, if the first network device fails the verification in S204, then S205 can be omitted. Optionally, if the first network device fails the verification in S204, it can send a failure indication to the second network device and / or the UE, which may indicate the verification failure or indicate the verification failure and the reason for the failure; or, if the first network device fails the verification in S204, it may also choose not to send information to the second network device and / or the UE.

[0123] S206. The second network device verifies the second data packet based on the first key.

[0124] The verification process of the second network device can be similar to that of the first network device. Therefore, the process by which the second network device verifies the second data packet based on the first key can be found in the description of the process by which the first network device verifies the first data packet based on the first key in S204. For example, how the second network device verifies the second data packet based on the first key, optionally, the first network device can also perform preliminary verification based on the first time information and the second time information, etc., all of which can be found in the relevant description in S204.

[0125] S207. The second network device sends an application receipt to the UE. This application receipt may indicate, for example, whether the verification was successful or failed.

[0126] The application receipt is forwarded to the UE, for example, via the first network device. Alternatively, the second network device may not send the application receipt to the UE, so step S207 is optional.

[0127] This application provides a method for a first network device to obtain a key for verification. The first network device can also obtain a key for verification through this method. Therefore, in addition to the second network device performing verification, the first network device can also perform verification, which is equivalent to implementing a two-layer verification mechanism, improving system security. Furthermore, in this application embodiment, both the first and second network devices can perform verification based on a first application checksum, without needing to use excessive checksums, thus saving transmission overhead.

[0128] This application provides a second communication method, please refer to the embodiments therein. Figure 4 Here is a flowchart of the method.

[0129] S401, The first network device obtains the UE's first key.

[0130] Optionally, the first key may include a second key, a third key, and a fifth key. However, the first network device obtains only the second and third keys, and not the fifth key. Therefore, S401 can also be understood as the first network device obtaining a portion of the first key. Specifically, the third key can be used to determine the application checksum; the second key can be used for encrypting data packets; and the fifth key can be used for encrypting the original data (e.g., the first data). The second and third keys may be the same or different. The second and fifth keys may be the same or different. The third and fifth keys may be the same or different.

[0131] Optionally, the second key can correspond to the first validity period, the third key can correspond to the second validity period, and the fifth key can correspond to the third validity period. The first and second validity periods can be the same or different; the first and third validity periods can be the same or different; the second and third validity periods can be the same or different. If the validity periods corresponding to different keys are the same, it facilitates the UE or the corresponding network device (e.g., the first network device and / or the second network device) in maintaining these different keys. For example, these different keys can be valid and invalidated simultaneously, simplifying the key maintenance process for the UE or the corresponding network device. If the validity periods corresponding to different keys are different, the UE or the corresponding network device can negotiate the validity periods of different keys separately during negotiation, allowing the validity periods of different keys to correspond to the purpose of the key, thus achieving greater flexibility.

[0132] For example, in addition to obtaining the first key, the first network device can also obtain one or more of the following: a first validity period, a second validity period, or a third validity period. Optionally, the first validity period can be determined when negotiating the second key; the second validity period can be determined when negotiating the third key; and the third validity period can be determined when negotiating the fifth key. The first validity period can indicate the effective time of the second key, or the time when the second key is invalid (or expires). For example, when the first validity period arrives, the UE can renegotiate with the first network device and / or the second network device to update the second key. The second validity period can indicate the effective time of the third key, or the time when the third key is invalid (or expires). For example, when the second validity period arrives, the UE can renegotiate with the first network device and / or the second network device to update the third key. The third validity period can indicate the effective time of the fifth key, or the time when the fifth key is invalid (or expires). For example, when the third validity period arrives, the UE can renegotiate with the first network device and / or the second network device to update the fifth key.

[0133] Optionally, the first network device can negotiate and determine a second key and a third key with the UE. The first network device can then obtain the second and third keys, and the UE can also obtain them. In this approach, it can be assumed that both the UE and the first network device can obtain the second and third keys in S201. Optionally, in addition to negotiating the second and third keys with the UE, the first network device can also negotiate the validity period corresponding to the second and / or third keys. For example, negotiating a first validity period and / or a second validity period. If the first network device negotiates the second and third keys with the UE, the UE can optionally also negotiate and determine a fifth key with the second network device. Furthermore, the UE or the first network device can send the second and third keys to the second network device, enabling the second network device to obtain the second, third, and fifth keys.

[0134] Alternatively, the UE can negotiate and determine a first key with a second network device (e.g., negotiate a second, third, and fifth key). The UE or the second network device can then send the negotiated second and third keys to the first network device, allowing the first network device to obtain the second and third keys. The UE or the second network device may choose not to send the fifth key to the first network device. In this approach, it can be assumed that the UE obtains the second, third, and fifth keys before S201, and the first network device obtains the second and third keys in S201. Optionally, in addition to sending the second and third keys to the first network device, the UE or the second network device may also send one or more of the following: the UE's identifier, a first validity period, or a second validity period. The UE's identifier enables the first network device to determine that the first key corresponds to that UE; the first validity period enables the first network device to determine the valid usage time of the second key; the first validity period enables the first network device to determine the valid usage time of the second key. As an optional implementation method, the UE or the second network device may send the UE's identifier, second key, and third key, and the UE or the second network device may send the correspondence between the second key and the third key and the UE's identifier.

[0135] Alternatively, the UE can negotiate with the first network device to determine a portion of the first key, and with the second network device to determine the remaining key. For example, the UE can negotiate a second and third key with the first network device, and a fifth key with the second network device. The first network device can then send the second and third keys to the second network device. As another example, the UE can negotiate a second key with the first network device, and a third and fifth key with the second network device. The second network device or the UE can send the third key to the first network device, allowing the first network device to obtain the second and third keys. In this approach, the UE can obtain the first key before S201, and the first network device can obtain the first key in S201; or both the UE and the first network device can obtain the first key in S201. Optionally, if the UE or the second network device wants to send a key (e.g., the second and / or third key) to the first network device, in addition to the first network device sending the key, it can also send the UE's identifier and / or the validity period corresponding to the key (e.g., the first validity period and / or the second validity period). As an optional implementation whereby the UE or the second network device sends the UE's identifier and a second key, the UE or the second network device may send the mapping relationship between the second key and the UE's identifier. As an optional implementation whereby the UE or the second network device sends the UE's identifier and a third key, the UE or the second network device may send the mapping relationship between the third key and the UE's identifier.

[0136] For information on UE identification, please refer to [link / reference]. Figure 2 The following is a description of S201 in the illustrated embodiment.

[0137] Because the UE may obtain the first key before S401, or it may obtain the first key in S401, Figure 4 The example given is that the UE obtains the first key in S201.

[0138] S402, the first network device sends a first key to the second network device. Correspondingly, the second network device receives the first key from the first network device.

[0139] For more information about the S402, please refer to [link / reference]. Figure 2 S202 in the illustrated embodiment.

[0140] S403, the UE sends M third data packets. Correspondingly, the first network device receives these M third data packets. M is a positive integer.

[0141] If the embodiments of this application are applied to Figure 1AIn the scenario shown, the M third data packets can be received by the satellite, which then transmits them to the first network device, thus enabling the first network device to receive the M third data packets. Alternatively, if the embodiments of this application are applied to... Figure 1B In the scenario shown, the M third data packets can directly reach the first network device without needing to be forwarded by other devices. Alternatively, if the embodiments of this application are applied to... Figure 1B In the scenario shown, the M third data packets can also reach the first network device via forwarding through one or more ground relay devices. There are no restrictions on this.

[0142] The UE can obtain the first data packet based on the first key. There are different ways for the UE to obtain the first data packet based on the first key, as illustrated in the following examples.

[0143] 1. A first optional implementation method for the UE to obtain the first data packet based on the first key.

[0144] The UE obtains the first application verification code based on the first data and the third key, and then obtains the first data packet based on the second key, the first data, and the first application verification code. (See reference for details.) Figure 5A The first data is, for example, the data to be sent by the UE, also known as the raw data. In this embodiment, the first data is encrypted data, or can be understood as encrypted data, for example, the UE encrypts the first data using a fifth key. Optionally, the UE obtains a first application verification code based on the first data and a third key, for example, the UE obtains the first application verification code based on the first data, second time information, and the third key. Figure 5A Taking this as an example, the second time information may indicate the time when the UE generates the first application verification code, and the time indicated by the second time information may be, for example, UTC. Optionally, the first data packet may include the second time information, that is, the UE may carry the second time information in the first data packet, and the second time information may be used by the first network device and / or the second network device to perform verification.

[0145] The UE obtains the first data packet based on the second key, the first data, and the first application verification code. For example, the UE encrypts the first data and the first application verification code using the second key to obtain the payload of the first data packet; the UE then adds an AP header to this payload to obtain the first data packet. The AP header may not be encrypted. In this method, the first data undergoes two layers of encryption using the fifth key and the second key, which improves the security of the first data transmission.

[0146] 2. A second optional implementation method for the UE to obtain the first data packet based on the first key.

[0147] The UE obtains the first application verification code based on the first data and the third key, and then obtains the first data packet based on the second key, the first data, and the first application verification code. (See reference for details.) Figure 5B The first data is, for example, the data to be sent by the UE, also known as the raw data. In this embodiment, the first data is encrypted data, or can be understood as encrypted data, for example, the UE encrypts the first data using a fifth key. Optionally, the UE obtains a first application verification code based on the first data and a third key, for example, the UE obtains the first application verification code based on the first data, second time information, and the third key. Figure 5B Taking this as an example, the second time information may indicate the time when the UE generates the first application verification code, and the time indicated by the second time information may be, for example, UTC. Optionally, the first data packet may include the second time information, that is, the UE may carry the second time information in the first data packet, and the second time information may be used by the first network device and / or the second network device to perform verification.

[0148] The UE obtains a first data packet based on a second key, first data, and a first application verification code. For example, the UE encrypts the first application verification code using the second key to obtain an encrypted first application verification code. The UE can use the encrypted first application verification code and the first data as the payload of the first data packet. The first data is encrypted with a fifth key but not with the second key. The UE then adds an AP header to this payload to obtain the first data packet. This AP header may not be encrypted. In this method, the first data is not encrypted with the second key, which simplifies the UE's encryption process and also simplifies the processing of the first network device and / or the second network device.

[0149] If the UE can directly send the first data packet, then S403 can be replaced with "UE sends the first data packet"; or, if transmission resources are limited, the first data packet may be segmented and sent, for example, the UE may segment the first data packet into M third data packets for transmission. Figure 4 Taking this as an example, the first data packet may include the UE's device ID, for example, the device ID may be included in the header of the first data packet (e.g., the AP header); or, the first data packet may not include the UE's device ID. Each of the M third data packets may include the UE's TEL URI, which may be included in the header of the third data packet, for example. The first data packet, for example, may not include the UE's TEL URI.

[0150] S404. The first network device verifies the first data packet based on the first key. For example, the first network device verifies the first data packet based on the second key and the third key.

[0151] If the UE sends a first data packet in S403, the first network device can verify the first data packet based on the first key after receiving it. Alternatively, if the UE sends M third data packets in S403, and the first network device receives the M third data packets, it can obtain the first data packet based on these M third data packets and then verify the first data packet based on the first key. For example, the first network device can assemble the M third data packets to obtain the first data packet. For example, each of the M third data packets may include the UE's TEL URI, and the first network device can assemble the M third data packets according to the TEL URI to obtain the first data packet. The first network device can determine the first key corresponding to the first data packet based on the TEL URI in the third data packet, or the first network device can determine the first key corresponding to the first data packet based on the TEL URI and the device ID in the assembled first data packet.

[0152] The UE can obtain the first data packet using the various methods described in S403, and the first network device can also use different verification methods accordingly, as illustrated in the following examples.

[0153] 1. A first verification method for the first network device. For example, if the UE obtains the first data packet using the first optional implementation method in S403, the first network device may perform verification using the first verification method.

[0154] The first network device verifies the first data packet based on the first key, for example, by the following process: the first network device decrypts the first data packet based on the second key to obtain the first application verification code and the first data; the first network device obtains the second application verification code based on the first data and the third key; the first network device verifies the first data packet based on the first application verification code and the second application verification code.

[0155] For more information on this verification method, please refer to [link / reference]. Figure 2 S204 in the illustrated embodiment. (And...) Figure 2 Unlike the embodiments shown, in this embodiment, the first data obtained by the first network device decrypting the first data packet based on the second key can be encrypted data (encrypted by the UE using the fifth key). Since the first network device does not know the fifth key, it cannot decrypt the first data, thereby improving data security.

[0156] 2. A second verification method for the first network device. For example, if the UE obtains the first data packet using the second optional implementation method in S403, the first network device can perform verification using the second verification method.

[0157] The first network device verifies the first data packet based on the first key, for example, by the following process: the first network device decrypts the encrypted first application verification code included in the first data packet based on the second key to obtain the first application verification code; the first network device obtains the second application verification code based on the third key and the first data included in the first data packet; the first network device verifies the first data packet based on the first application verification code and the second application verification code.

[0158] Since the UE did not encrypt the first data packet using the second key when it received the first data packet, the first network device does not need to decrypt the entire payload of the first data packet using the second key. Instead, it only needs to decrypt the encrypted first application verification code included in the first data packet using the second key. When generating the second application verification code, the first network device can obtain the second application verification code using the third key and the first data included in the first data packet.

[0159] For details regarding how the first network device obtains the second application verification code, and the specific verification method used by the first network device, please refer to [link / reference needed]. Figure 2 The following is a description of S204 of the illustrated embodiment.

[0160] If the first data packet includes second time information, optionally, the first network device can perform a preliminary verification of the first data packet based on the first and second time information before executing S404. For details, please refer to... Figure 2 The following is a description of S204 of the illustrated embodiment.

[0161] S405. The first network device sends a second data packet to the second network device. Correspondingly, the second network device receives the second data packet.

[0162] The second data packet can be obtained based on the first data packet. For example, the second data packet is the first data packet; or, the second data packet is not the same data packet as the first data packet, but the second data packet is determined based on the first data packet. For example, in the embodiments of this application, the second data packet can be the first data packet, that is, the first network device can forward the first data packet to the second network device without modifying the first data packet, which simplifies the processing of the first network device.

[0163] Alternatively, the second data packet and the first data packet may not be the same data packet. For example, the first network device can add first time information to the first data packet to obtain the second data packet, in which case the second data packet contains the first time information more than the first data packet. Alternatively, the first network device can send the first time information to the second network device, but the first time information may not be carried in the second data packet, but sent separately. Alternatively, the first network device may not send the first time information to the second network device.

[0164] Alternatively, the second data packet may not be the same as the first data packet. For example, if the first network device decrypts the first application verification code and the first data (corresponding to the first verification method in S404) using the second key, then the second data packet may include the first application verification code and the first data. Or, if the first network device decrypts the first application verification code (corresponding to the second verification method in S404) using the second key, then the second data packet may include the first application verification code and the first data contained in the first data packet. That is, the first network device does not need to send the information encrypted with the second key to the second network device again; instead, it can send the information decrypted with the second key, reducing the decryption process for the second network device. Since the first data is already encrypted, the security of its transmission is also guaranteed.

[0165] For example, the first network device can send the identifier of the UE corresponding to the second data packet, such as the UE's TELURI, to the second network device to indicate the identifier of the UE corresponding to the second data packet. The UE's identifier can be used by the second network device to determine the first key corresponding to the second data packet.

[0166] For more information about S405, please refer to [link / reference]. Figure 2 S205 of the illustrated embodiment.

[0167] S406. The second network device verifies the second data packet based on the first key. For example, the second network device verifies the second data packet based on the second key and the third key.

[0168] The verification process of the second network device can be similar to that of the first network device. Therefore, regarding the process by which the second network device verifies the second data packet based on the first key, refer to the description of the process by which the first network device verifies the first data packet based on the first key in S404. For example, regarding how the second network device verifies the second data packet based on the first key, optionally, the first network device can also perform preliminary verification based on the first time information and the second time information, etc., which can be found in [reference needed]. Figure 2 The following is a description of S204 of the illustrated embodiment.

[0169] If the second network device successfully verifies the data, it may optionally use the fifth key to decrypt the first data, obtaining the first data as plaintext. If the second network device fails to verify the data, it may choose not to use the fifth key to decrypt the first data.

[0170] S407. The second network device sends an application receipt to the UE. This application receipt may indicate, for example, that the verification was successful or failed.

[0171] The application receipt is forwarded to the UE, for example, via the first network device. Alternatively, the second network device may not send the application receipt to the UE, so step S207 is optional.

[0172] This application provides a method for a first network device to obtain a key for verification. The first network device can also obtain a key for verification through this method. Therefore, in addition to the second network device performing verification, the first network device can also perform verification, which is equivalent to implementing a two-layer verification mechanism, improving system security. Furthermore, in this application embodiment, the first data obtained by the first network device can be encrypted data. Since the first network device has not obtained the fifth key, it cannot decrypt the first data, thus improving the transmission security of the first data. Additionally, in this application embodiment, both the first and second network devices can perform verification based on a first application checksum, without needing to use excessive checksums, which saves transmission overhead.

[0173] This application provides a third communication method, please refer to the embodiments therein. Figure 6 Here is a flowchart of the method.

[0174] S601, The first network device obtains the first key of the UE.

[0175] Optionally, the first key may include a second key and a third key. The third key can be used to determine the application checksum; the second key can be used to encrypt data packets. The second key and the third key may be the same or different.

[0176] Optionally, the second key can correspond to the first validity period, and the third key can correspond to the second validity period. For more information, please refer to [link / reference needed]. Figure 2 S201 of the illustrated embodiment.

[0177] Optionally, the first network device may negotiate and determine a second key and a third key with the UE. Figure 6Taking this as an example, the first network device can obtain the second and third keys, and the UE can also obtain the second and third keys. In this approach, it can be assumed that both the UE and the first network device can obtain the second and third keys in S201. Optionally, in addition to negotiating the second and third keys with the UE, the first network device can also negotiate the validity period corresponding to the second and / or third keys. For example, negotiating the first validity period and / or the second validity period.

[0178] S602, The second network device obtains the UE's fourth key.

[0179] Optionally, the fourth key may include the sixth and seventh keys. The seventh key can be used to determine the application checksum; the sixth key can be used to encrypt data packets. The sixth and seventh keys may be the same or different. Additionally, the second and sixth keys may be the same or different. The third and seventh keys may be the same or different.

[0180] Optionally, the sixth key can correspond to the fourth validity period, and the seventh key can correspond to the fifth validity period. The fourth and fifth validity periods can be the same or different. If the fourth and fifth validity periods are the same, it facilitates the maintenance of the sixth and seventh keys by the UE or the corresponding network device (e.g., the first network device and / or the second network device). For example, the sixth and seventh keys can be valid and invalidated simultaneously, simplifying the key maintenance process for the UE or the corresponding network device. If the fourth and fifth validity periods are different, the UE or the corresponding network device can negotiate the fourth and fifth validity periods separately during negotiation, allowing the validity periods of different keys to correspond to the purpose of the key, thus providing greater flexibility.

[0181] For example, in addition to obtaining the sixth key, the second network device can also obtain the fourth validity time and / or the fifth validity time. Optionally, the fourth validity time can be determined during the negotiation of the sixth key; the fifth validity time can be determined during the negotiation of the seventh key. The fourth validity time can indicate the effective time of the sixth key, or indicate the time when the sixth key is invalid (or expired). For example, when the fourth validity time arrives, the UE can renegotiate with the first network device and / or the second network device to update the sixth key. The fifth validity time can indicate the effective time of the seventh key, or indicate the time when the seventh key is invalid (or expired). For example, when the fifth validity time arrives, the UE can renegotiate with the first network device and / or the second network device to update the seventh key.

[0182] Optionally, the second network device can negotiate and determine a fourth key with the UE. Figure 6Taking this as an example, the second network device can obtain the fourth key, and the UE can also obtain the fourth key. In this way, it can be considered that both the UE and the second network device can obtain the fourth key in S601. Optionally, in addition to negotiating the fourth key with the UE, the second network device can also negotiate the validity period corresponding to the sixth key and / or the seventh key. For example, negotiating the fourth validity period and / or the fifth validity period.

[0183] S601 can occur before S602, or after S602, or simultaneously with S602.

[0184] In this embodiment of the application, the first network device and the second network device can maintain their own keys respectively, and the two network devices do not need to exchange keys, which can improve transmission security.

[0185] S603, the UE sends M third data packets. Correspondingly, the first network device receives these M third data packets. M is a positive integer.

[0186] If the embodiments of this application are applied to Figure 1A In the scenario shown, the M third data packets can be received by the satellite, which then transmits them to the first network device, thus enabling the first network device to receive the M third data packets. Alternatively, if the embodiments of this application are applied to... Figure 1B In the scenario shown, the M third data packets can directly reach the first network device without needing to be forwarded by other devices. Alternatively, if the embodiments of this application are applied to... Figure 1B In the scenario shown, the M third data packets can also reach the first network device via forwarding through one or more ground relay devices. There are no restrictions on this.

[0187] The UE can obtain the first data packet based on the first key and the fourth key. The process of the UE obtaining the first data packet based on the first key and the fourth key includes, for example, the following steps: The UE obtains the third application verification code based on the first data using the seventh key; based on the sixth key, the first data, and the third application verification code, the UE can obtain the first information; based on the first information and the third key, the UE can obtain the first application verification code; and then based on the second key, the first information, and the first application verification code, the UE obtains the first data packet. (See reference for further details.) Figure 7 The first data is, for example, the data to be transmitted by the UE, which can also be called raw data. In this embodiment of the application, the first data is plaintext data, or it can be understood as the first data not being encrypted.

[0188] Optionally, the UE obtains the first application verification code based on the first data and the third key. For example, the UE obtains the first application verification code based on the first data, the second time information, and the third key. Figure 7Taking this as an example, the second time information indicates, for example, the time when the UE generates the first application verification code, and the time indicated by the second time information is, for example, UTC. Optionally, the UE obtains the third application verification code based on the first data and the seventh key, for example, including the UE obtaining the third application verification code based on the first data, the second time information, and the seventh key. Figure 7 Take this as an example.

[0189] Optionally, the first data packet may include second time information, that is, the UE may carry the second time information in the first data packet, and the second time information may be used by the first network device and / or the second network device to perform verification.

[0190] The UE obtains the first information based on the sixth key, the first data, and the third application verification code. For example, the UE encrypts the first data and the third application verification code based on the sixth key to obtain the first information.

[0191] The UE obtains the first data packet based on the second key, the first information, and the first application verification code. For example, the UE encrypts the first information and the first application verification code based on the second key to obtain the payload of the first data packet; the UE then adds an AP header to the payload to obtain the first data packet. The AP header may not be encrypted.

[0192] If the UE can directly send the first data packet, then S603 can be replaced with the UE sending the first data packet; or, if transmission resources are limited, the first data packet may be segmented and sent, for example, the UE may segment the first data packet into M third data packets for transmission. Figure 6 Taking this as an example, the first data packet may include the UE's device ID, for example, the device ID may be included in the header of the first data packet (e.g., the AP header); or, the first data packet may not include the UE's device ID. Each of the M third data packets may include the UE's TEL URI, which may be included in the header of the third data packet, for example. The first data packet, for example, may not include the UE's TEL URI.

[0193] S604. The first network device verifies the first data packet based on the first key.

[0194] If the UE sends a first data packet in S603, the first network device can verify the first data packet based on the first key after receiving it. Alternatively, if the UE sends M third data packets in S603, and the first network device receives the M third data packets, it can obtain the first data packet based on these M third data packets and then verify the first data packet based on the first key. For example, the first network device can assemble the M third data packets to obtain the first data packet. For example, each of the M third data packets may include the UE's TEL URI, and the first network device can assemble the M third data packets according to the TEL URI to obtain the first data packet. The first network device can determine the first key corresponding to the first data packet based on the TEL URI in the third data packet.

[0195] The first network device verifies the first data packet based on the first key, for example, by the following process: the first network device decrypts the first data packet based on the second key to obtain the first application verification code and the first information; the first network device obtains the second application verification code based on the first information and the third key; the first network device verifies the first data packet based on the first application verification code and the second application verification code.

[0196] For more information on this verification process, please refer to [link / reference]. Figure 2 S204 in the illustrated embodiment. (And...) Figure 2 Unlike the embodiments shown, in this application embodiment, the first network device decrypts the first data packet based on the second key to obtain first information instead of first data. The first information is encrypted information (obtained by the UE using the sixth key). Since the first network device does not know the sixth key, it cannot decrypt the first information, thereby improving data security.

[0197] If the first data packet includes second time information, optionally, the first network device can perform a preliminary verification of the first data packet based on the first and second time information before executing S604. For details, please refer to... Figure 2 The following is a description of S204 of the illustrated embodiment.

[0198] S605, The first network device sends a second data packet to the second network device. Correspondingly, the second network device receives the second data packet.

[0199] The second data packet can be obtained from the first data packet. For example, if the first network device decrypts the first application verification code and the first information using the second key, the second data packet can include the first information. That is, the first network device does not need to send the information encrypted with the second key to the second network device again, but can send the information decrypted with the second key, which reduces the decryption process for the second network device. Since the first information is already encrypted, the security of the first data transmission is also guaranteed. In addition, since the second network device does not know the second key, the first network device can send the information decrypted with the second key to the second network device, reducing the probability of the second network device failing to recognize it.

[0200] Optionally, the second data packet may or may not include the first application verification code. Since the first application verification code is obtained using a third key, which is unknown to the second network device, and the first application verification code is information used by the first network device for verification, the first network device may choose not to send the first application verification code to the second network device. This reduces redundant information, saves transmission overhead, and also reduces the probability of the second network device failing to recognize the verification code.

[0201] Optionally, in S605, in addition to sending the second data packet to the second network device, the first network device may also send the TEL URI corresponding to the UE, which, for example, is not included in the second data packet. This TEL URI allows the second network device to determine which UE the second data packet originated from.

[0202] If the first network device successfully completes the verification in S604, then S605 can be executed; or, if the first network device fails the verification in S204, then S605 can be omitted. If the first network device fails the verification in S604, optionally, the first network device can send a failure indication to the second network device and / or the UE; or, optionally, if the first network device fails the verification in S604, the first network device may also choose not to send information to the second network device and / or the UE.

[0203] S606, The second network device verifies the second data packet based on the fourth key.

[0204] The second network device verifies the second data packet based on the fourth key, for example, by the following process: the second network device decrypts the first information in the second data packet based on the sixth key to obtain the third application verification code and the first data; the first network device obtains the fourth application verification code based on the first data and the seventh key; and the second network device verifies the second data packet based on the first application verification code and the fourth application verification code.

[0205] For more information on this process, please refer to [link / reference]. Figure 2 The following is a description of S204 of the illustrated embodiment.

[0206] If the first data packet includes second time information, optionally, before executing S606, the first network device can also perform a preliminary verification of the first data packet based on the first and second time information. This can also be referred to... Figure 2 The following is a description of S204 of the illustrated embodiment.

[0207] S607. The second network device sends an application receipt to the UE. This application receipt may indicate, for example, that the verification was successful or failed.

[0208] The application receipt is forwarded to the UE, for example, via the first network device. Alternatively, the second network device may not send the application receipt to the UE, therefore step S607 is optional.

[0209] This application provides a method for a first network device to obtain a key for verification. The first network device can also obtain a key for verification through this method. Therefore, in addition to the second network device performing verification, the first network device can also perform verification, which is equivalent to implementing a two-layer verification mechanism, improving system security. Furthermore, in this application embodiment, the first and second network devices can use their respective keys without needing to know each other's keys, thereby achieving data isolation and improving data transmission security.

[0210] Figure 8 A schematic diagram of a device provided in an embodiment of this application is given. The device 800 may be... Figure 2 , Figure 4 or Figure 6 The first network device or its circuitry, as shown in any of the accompanying drawings, is used to implement the method corresponding to the first network device in the above method embodiments. Alternatively, the apparatus 800 may be... Figure 2 , Figure 4 or Figure 6 The second network device or its circuitry, as shown in any of the accompanying drawings, is used to implement the method corresponding to the second network device in the above method embodiments. Alternatively, the apparatus 800 may be... Figure 2 , Figure 4 or Figure 6 The UE or circuit system of any of the embodiments shown in the accompanying drawings is used to implement the method corresponding to the UE in the above method embodiments. For example, one type of circuit system is a chip system.

[0211] The device 800 includes at least one processor 801. The processor 801 can be used for internal processing within the device to implement certain control processing functions. Optionally, the processor 801 includes instructions. Optionally, the processor 801 can store data. Optionally, different processors can be independent devices, located in different physical locations, or located on different integrated circuits. Optionally, different processors can be integrated into one or more processors, for example, integrated on one or more integrated circuits.

[0212] Optionally, the device 800 includes one or more memories 803 for storing instructions. Optionally, the memories 803 may also store data. The processor and the memories may be separate or integrated together.

[0213] Optionally, the device 800 includes a communication line 802 and at least one communication interface 804. Since the memory 803, communication line 802, and communication interface 804 are all optional, therefore... Figure 8 All are represented by dashed lines.

[0214] Optionally, device 800 may further include a transceiver and / or an antenna. The transceiver can be used to send information to or receive information from other devices. The transceiver may be referred to as a transceiver unit, transceiver circuit, input / output interface, etc., and is used to implement the transmission and reception functions of device 800 via the antenna. Optionally, the transceiver includes a transmitter and a receiver. For example, the transmitter can be used to generate a radio frequency (RF) signal from a baseband signal, and the receiver can be used to convert the RF signal back into a baseband signal.

[0215] The processor 801 may include a general-purpose central processing unit (CPU), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits for controlling the execution of programs according to the present application.

[0216] Communication line 802 may include a path for transmitting information between the aforementioned components.

[0217] The communication interface 804 uses any transceiver-like device for communicating with other devices or communication networks, such as Ethernet, radio access network (RAN), wireless local area network (WLAN), wired access network, etc.

[0218] The memory 803 may be a read-only memory (ROM) or other type of static storage device capable of storing static information and instructions, random access memory (RAM) or other type of dynamic storage device capable of storing information and instructions, or electrically erasable programmable read-only memory (EEPROM), compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical discs, laser discs, optical discs, digital universal optical discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but not limited thereto. The memory 803 may exist independently and be connected to the processor 801 via communication line 802. Alternatively, the memory 803 may be integrated with the processor 801.

[0219] The memory 803 stores computer execution instructions for implementing the scheme of this application, and its execution is controlled by the processor 801. The processor 801 executes the computer execution instructions stored in the memory 803, thereby realizing... Figure 2 , Figure 4 or Figure 6 The steps performed by the first network device or the second network device or the UE as shown in any of the accompanying drawings.

[0220] Optionally, the computer execution instructions in the embodiments of this application may also be referred to as application code, and the embodiments of this application do not specifically limit this.

[0221] In a specific implementation, as one example, the processor 801 may include one or more CPUs, for example... Figure 8 CPU0 and CPU1 in the CPU.

[0222] In a specific implementation, as one example, device 800 may include multiple processors, for example... Figure 8 Processors 801 and 805 are mentioned. Each of these processors can be a single-core (single-CPU) processor or a multi-core (multi-CPU) processor. A processor here can refer to one or more devices, circuits, and / or processing cores used to process data (such as computer program instructions).

[0223] when Figure 8When the device shown is a chip, such as the chip of a first network device, a second network device, or a UE chip, the chip includes a processor 801 (and may also include a processor 805), a communication line 802, and a communication interface 804. Optionally, it may include a memory 803. Specifically, the communication interface 804 may be an input interface, pins, or circuits, etc. The memory 803 may be a register, cache, etc. The processor 801 and processor 805 may be a general-purpose CPU, microprocessor, ASIC, or one or more integrated circuits for controlling the execution of a program that controls the communication method of any of the above embodiments.

[0224] This application embodiment can divide the device into functional modules according to the above method embodiment. For example, each function can be divided into its own functional modules, or two or more functions can be integrated into one processing module. The integrated modules can be implemented in hardware or as software functional modules. It should be noted that the module division in this application embodiment is illustrative and only represents one logical functional division. In actual implementation, there may be other division methods. For example, in the case of dividing each functional module according to its own function, Figure 9 This is a schematic diagram of an apparatus. The apparatus 900 may be the first network device, the second network device, or the UE involved in the above-described method embodiments, or it may be a chip in the first network device, the second network device, or the UE. The apparatus 900 includes a processing unit 902 and a transceiver unit 901.

[0225] It should be understood that the device 900 can be used to implement the steps performed by the first network device, the second network device, or the UE in the communication method of the embodiments of this application, and the relevant features can be referred to above. Figure 2 , Figure 4 or Figure 6 The embodiments shown in any of the accompanying drawings are not described in detail here.

[0226] Optional, Figure 9 The functions / implementation process of the transceiver unit 901 and the processing unit 902 can be obtained through Figure 8 The processor 801 in the memory calls computer execution instructions stored in memory 803 to implement the function. Alternatively, Figure 9 The function / implementation process of the processing unit 902 in the middle can be achieved through Figure 8 The processor 801 in the memory calls computer execution instructions stored in the memory 803 to implement this. Figure 9 The function / implementation process of the transceiver unit 901 in the middle can be obtained through Figure 8 It is implemented using the 804 communication interface.

[0227] Optionally, when the device 900 is a chip or circuit, the function / implementation process of the transceiver unit 901 can also be implemented through pins or circuits. Optionally, the transceiver unit 901 may include a transmitting unit and / or a receiving unit, whereby the transmitting unit implements the transmitting function and the receiving unit implements the receiving function; or, the transceiver unit 901 may be an integral module capable of implementing both transmitting and / or receiving functions. Optionally, the transceiver unit 901 can be implemented using a transceiver.

[0228] This application also provides a computer-readable storage medium storing a computer program or instructions. When the computer program or instructions are executed, they implement the methods performed by the first network device, the second network device, or the UE in the aforementioned method embodiments. Thus, the functions described in the above embodiments can be implemented as software functional units and sold or used as independent products. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to it, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, ROM, RAM, magnetic disks, or optical disks.

[0229] This application also provides a computer program product comprising: computer program code, which, when run on a computer, causes the computer to perform the method executed by the first network device, the second network device, or the UE in any of the foregoing method embodiments.

[0230] This application also provides a processing apparatus, including a processor and an interface; the processor is used to execute the method executed by the first network device or the second network device or the UE involved in any of the above method embodiments.

[0231] In the above embodiments, implementation can be achieved entirely or partially through software, hardware, firmware, or any combination thereof. When implemented using software, it can be implemented entirely or partially in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that integrates one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid-state disk (SSD)).

[0232] The various illustrative logic units and circuits described in the embodiments of this application can be implemented or operate the described functions using a general-purpose processor, digital signal processor (DSP), ASIC, field-programmable gate array (FPGA), or other programmable logic device, discrete gate or transistor logic, discrete hardware components, or any combination thereof. The general-purpose processor can be a microprocessor; alternatively, it can be any conventional processor, controller, microcontroller, or state machine. The processor can also be implemented using a combination of computing devices, such as a digital signal processor and a microprocessor, multiple microprocessors, one or more microprocessors combined with a digital signal processor core, or any other similar configuration.

[0233] The steps of the methods or algorithms described in the embodiments of this application can be directly embedded in hardware, software units executed by a processor, or a combination of both. The software units can be stored in RAM, flash memory, ROM, erasable programmable read-only memory (EPROM), EEPROM, registers, hard disks, removable disks, CD-ROMs, or any other form of storage medium in the art. Exemplarily, the storage medium can be connected to the processor so that the processor can read information from the storage medium and write information to the storage medium. Optionally, the storage medium can also be integrated into the processor. The processor and storage medium can be disposed in an ASIC, which can be disposed in the terminal device. Optionally, the processor and storage medium can also be disposed in different components of the terminal device.

[0234] These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process, such that the instructions, which execute on the computer or other programmable apparatus, provide steps for implementing the functions specified in one or more flowcharts and / or one or more block diagrams.

[0235] The contents of the various embodiments of this application can be referenced to each other. Unless otherwise specified or there is a logical conflict, the terms and / or descriptions between different embodiments are consistent and can be referenced to each other. The technical features in different embodiments can be combined to form new embodiments according to their inherent logical relationship.

[0236] It is understood that in the embodiments of this application, the first network device and / or the second network device and / or the UE may perform some or all of the steps in the embodiments of this application. These steps or operations are merely examples. In the embodiments of this application, other operations or variations of various operations may also be performed. Furthermore, the steps may be performed in different orders as presented in the embodiments of this application, and it is not necessary to perform all the operations in the embodiments of this application.

Claims

1. A communication method, characterized in that, Applied to a first network device, the method includes: Obtain the terminal's first key; The first data packet from the terminal is verified based on the first key, and the first data packet is received via satellite; If the verification is successful, a second data packet is sent to the second network device. The second data packet is determined based on the first data packet and is used by the second network device to perform the verification.

2. The method according to claim 1, characterized in that, There is no wireless resource control connection between the first network device and the terminal.

3. The method according to claim 1 or 2, characterized in that, Obtaining the first key of the terminal includes: Receive the first key from the second network device or the terminal; or, Negotiate the first key with the terminal.

4. The method according to claim 3, characterized in that, After negotiating the first key with the terminal, the method further includes: Send the first key to the second network device.

5. The method according to any one of claims 1 to 4, characterized in that, The method further includes: Receive M third data packets from the terminal, where M is a positive integer; The first data packet is obtained based on the M third data packets.

6. The method according to any one of claims 1 to 5, characterized in that, The first key includes a second key and a third key, wherein verifying the first data packet based on the first key includes: The first data packet is decrypted based on the second key to obtain the first application verification code and the first data, wherein the first data is plaintext data or ciphertext data. A second application verification code is obtained based on the first data and the third key; The first data packet is verified based on the first application verification code and the second application verification code.

7. The method according to any one of claims 1 to 4, characterized in that, The first key includes a second key and a third key, wherein verifying the first data packet based on the first key includes: The first data packet is decrypted using the second key to obtain a first application verification code and first information, wherein the first information is obtained by encrypting the first data and the third application verification code using the sixth key. A second application verification code is obtained based on the first information and the third key; The first data packet is verified based on the first application verification code and the second application verification code.

8. The method according to claim 7, characterized in that, Based on the first information and the third key, a second application verification code is obtained, including: Based on the first information, the first time information, and the third key, the second application verification code is obtained, wherein the first time information is used to indicate the time when the first network device receives the first data packet in the first data packet from the terminal.

9. The method according to claim 7 or 8, characterized in that, The first data packet includes second time information, which indicates the time when the terminal generates the first application verification code.

10. The method according to claim 9, characterized in that, Before obtaining the second application verification code based on the first information and the third key, the method further includes: Based on the first time information and the second time information, determine whether to verify the first data packet based on the first key.

11. The method according to any one of claims 1 to 5, characterized in that, The first key includes a second key and a third key, wherein verifying the first data packet based on the first key includes: Based on the second key, the encrypted first application verification code in the first data packet is decrypted to obtain the first application verification code; A second application verification code is obtained based on the first data included in the first data packet and the third key, wherein the first data is encrypted data; The first data packet is verified based on the first application verification code and the second application verification code.

12. The method according to any one of claims 1 to 11, characterized in that, Send a second data packet to the second network device, including: The second data packet and first time information are sent to the second network device, wherein the first time information is used to indicate the time when the first network device receives the first data packet in the first data packet from the terminal.

13. A communication method, characterized in that, Applied to a second network device, the method includes: Obtain the terminal's first or fourth key; The second data packet from the terminal is verified based on the first key or the fourth key, wherein the second data packet is forwarded via the first network device and is received by the first network device via satellite.

14. The method according to claim 13, characterized in that, There is no wireless resource control connection between the first network device and the terminal.

15. The method according to claim 13 or 14, characterized in that, Obtaining the first or fourth key of the terminal includes: Receive the first key or the fourth key from the first network device or the terminal; or, Negotiate the first key or the fourth key with the terminal.

16. The method according to claim 15, characterized in that, After negotiating the first key with the terminal, the method further includes: Send the first key to the first network device.

17. The method according to any one of claims 13 to 16, characterized in that, The first key includes a second key and a third key, wherein verifying the second data packet based on the first key includes: The second data packet is decrypted based on the second key to obtain the first application verification code and the first data, wherein the first data is plaintext data or ciphertext data; A second application verification code is obtained based on the first data and the third key; The second data packet is verified based on the first application verification code and the second application verification code.

18. The method according to claim 17, characterized in that, The second data packet includes first time information and second time information. The first time information is used to indicate the time when the first network device receives the first data packet in the first data packet. The first data packet is used to determine the second data packet. The second time information is used to indicate the time when the terminal generates the first application verification code.

19. The method according to claim 18, characterized in that, Before obtaining the second application verification code based on the first data and the third key, the method further includes: Based on the first time information and the second time information, determine whether to verify the second data packet from the terminal based on the first key or the fourth key.

20. The method according to any one of claims 17 to 19, characterized in that, The first data is encrypted data, and the method further includes: If the verification is successful, the first data is decrypted using the fifth key to obtain the second data.

21. The method according to any one of claims 13 to 16, characterized in that, The fourth key includes a sixth key and a seventh key, wherein verifying the second data packet based on the fourth key includes: The second data packet is decrypted based on the sixth key to obtain the third application verification code and the first data; The fourth application verification code is obtained based on the first data and the seventh key; The first data packet is verified based on the third application verification code and the fourth application verification code.

22. A communication method, characterized in that, Applied to a terminal, the method includes: The first data and the third application verification code are encrypted based on the sixth key to obtain the first information, wherein the third application verification code is obtained based on the first data and the seventh key; Based on the first information and the third key, obtain the first application verification code; A first data packet is generated based on the second key, the first information, and the first application verification code; Send the first data packet.

23. The method according to claim 22, characterized in that, Sending the first data packet includes: The first data packet is sent to the satellite, and the first data packet is used to send to the first network device via the satellite.

24. The method according to claim 23, characterized in that, There is no wireless resource control connection between the terminal and the first network device.

25. The method according to any one of claims 22 to 24, characterized in that, The method further includes: Negotiate the second key and the third key with the first network device; Negotiate the sixth key and the seventh key with the second network device.

26. A communication device, characterized in that, The communication device includes a module for performing the method as described in any one of claims 1 to 12, or a module for performing the method as described in any one of claims 13 to 21, or a module for performing the method as described in any one of claims 22 to 25.

27. A communication device, characterized in that, The communication device includes a processor configured to perform the method as described in any one of claims 1 to 12, or the method as described in any one of claims 13 to 21, or the method as described in any one of claims 22 to 25.

28. A computer-readable storage medium, characterized in that, The computer-readable storage medium is used to store a computer program that, when run on a computer, causes the method as described in any one of claims 1 to 12 to be performed, or causes the method as described in any one of claims 13 to 21 to be performed, or causes the method as described in any one of claims 22 to 25 to be performed.

29. A computer program product, characterized in that, The computer program product includes a computer program that, when run on a computer, causes the computer to perform the method as described in any one of claims 1 to 12, or causes the computer to perform the method as described in any one of claims 13 to 21, or causes the computer to perform the method as described in any one of claims 22 to 25.

30. A communication system, characterized in that, The communication system includes a first network device and a second network device, wherein... The first network device is configured to perform the method as described in any one of claims 1 to 12; The second network device is used to perform the method as described in any one of claims 13 to 21.

Images