Information processing method, communication device and storage medium

Abstract

The embodiment of the invention provides an information processing method, communication equipment and a storage medium. The information processing method performed by the UE may include: generating a second key according to a first key of a first node; generating a third key according to the second key; the third key is used for protecting the communication security between the UE and the second node.

Description

Information processing method, communication device, and storage medium TECHNICAL FIELD

[0001] The present disclosure relates to the technical field of communication, and particularly relates to an information processing method, a communication device, and a storage medium. BACKGROUND

[0002] The sixth generation mobile communication system (6 th Generantion, 6G) architecture needs to streamline network functions (Network Function, NF). Streamlining NF has significant advantages in capacity, coverage, signaling overhead, scaling, and energy overhead.

[0003] SUMMARY

[0004] The embodiments of the present disclosure provide an information processing method, a communication device, and a storage medium.

[0005] According to a first aspect of the embodiments of the present disclosure, an information processing method is provided, which is executed by a user equipment (UE), and the method comprises: generating a second key according to a first key of a first node; generating a third key according to the second key; and the third key is used to protect the security of communication between the UE and a second node.

[0006] According to a second aspect of the embodiments of the present disclosure, an information processing method is provided, which is executed by a third node, and the method comprises:

[0007] receiving a first message sent by a user equipment (UE), wherein the first message is protected by a third key; the third key is generated by the UE based on a second key, and the second key is generated based on a first key of a first node; and the receiving node of the first message is a second node.

[0008] According to a third aspect of the embodiments of the present disclosure, an information processing method is provided, which is executed by a first node, and the method comprises: generating a fifth key according to a first key of the first node; and sending the fifth key to a second node, wherein the fifth key is used by the second node to generate a fourth key, and the fourth key is used to protect the security of communication between the second node and a user equipment (UE).

[0009] According to a fourth aspect of the embodiments of the present disclosure, an information processing method is provided, which is executed by a second node, and the method comprises: receiving a fifth key sent by a first node, wherein the fifth key is generated according to a first key of the first node; generating a fourth key according to the fifth key; and the fourth key is used to protect the security of communication between the second node and a user equipment (UE).

[0010] According to a fifth aspect of the embodiments of the present disclosure, a user equipment (UE) is provided, wherein the UE comprises a processing module configured to generate a second key according to a first key of a first node; and generate a third key according to the second key; the third key is used to protect security of communication between the UE and a second node.

[0011] According to a sixth aspect of the embodiments of the present disclosure, a third node is provided, wherein the third node comprises a receiving module configured to receive a first message sent by a user equipment (UE), the first message being protected by a third key; the third key is generated by the UE based on a second key, and the second key is generated based on a first key of a first node; a receiving node of the first message is a second node.

[0012] According to a seventh aspect of the embodiments of the present disclosure, a first node is provided, wherein the first node comprises a processing module configured to generate a fifth key according to a first key of the first node; and a sending module configured to send the fifth key to a second node, the fifth key being used by the second node to generate a fourth key, and the fourth key being used to protect security of communication between the second node and a user equipment (UE).

[0013] According to an eighth aspect of the embodiments of the present disclosure, a second node is provided, wherein the second node comprises a receiving module configured to receive a fifth key sent by a first node, the fifth key being generated according to a first key of the first node; and a processing module configured to generate a fourth key according to the fifth key; the fourth key being used to protect security of communication between the second node and a user equipment (UE).

[0014] According to a ninth aspect of the embodiments of the present disclosure, a communication system is provided, wherein the communication system comprises a user equipment (UE), a first node, a second node and a third node; the UE is configured to execute the information processing method provided in any of the technical solutions of the first aspect; the third node is configured to execute the information processing method provided in any of the technical solutions of the second aspect; the first node is configured to execute the information processing method provided in any of the technical solutions of the third aspect; and the second node is configured to execute the information processing method provided in any of the technical solutions of the fourth aspect.

[0015] According to a tenth aspect of the embodiments of the present disclosure, a communication device is provided, wherein the communication device comprises one or more processors; and the processors are configured to invoke instructions to cause the communication device to execute the information processing method provided in any of the technical solutions of the first aspect to the fourth aspect.

[0016] According to a twelfth aspect of the embodiments of the present disclosure, a program product is provided, and the program product comprises a computer program, and the computer program is executed by a communication device, so that the communication device can implement the information processing method provided by any of the first aspect to the fourth aspect.

[0017] According to a twelfth aspect of the embodiments of the present disclosure, a program product is provided, and the program product comprises a computer program, and the computer program is executed by a communication device, so that the communication device can implement the information processing method provided by any of the first aspect to the fourth aspect.

[0018] The technical solution provided by the embodiments of the present disclosure allows the UE to communicate directly with the second node in addition to communicating directly with the first node, and generates the second key according to the first key of the first node, so that the second key can be used to protect the security of the communication between the UE and the second node.

[0019] It should be understood that the foregoing general description and the following detailed description are only exemplary and explanatory, and cannot limit the embodiments of the present disclosure. BRIEF DESCRIPTION OF DRAWINGS

[0020] The drawings incorporated in the specification and constituting a part of the specification illustrate the embodiments consistent with the present disclosure and, together with the specification, serve to explain the principles of the embodiments of the present disclosure.

[0021] FIG. 1A is a schematic diagram of an architecture of a communication system according to an example embodiment;

[0022] FIG. 1B is a schematic diagram of an architecture of a communication system according to an example embodiment;

[0023] FIG. 1C is a schematic diagram of a connection between a user equipment (UE) and a radio access network (RAN) and a core network according to an example embodiment;

[0024] FIG. 1D is a schematic diagram of a connection between another UE and a RAN and a core network according to an example embodiment;

[0025] FIG. 1E is a schematic diagram of a security architecture according to an example embodiment;

[0026] FIG. 1F is a schematic diagram of a security architecture according to an example embodiment;

[0027] FIG. 1G is a schematic diagram of a security architecture according to an example embodiment;

[0028] FIG. 2A is a schematic diagram of a flow of an information processing method according to an example embodiment;

[0029] FIG. 2B is a flow diagram illustrating a method of processing information according to an example embodiment;

[0030] FIG. 2C is a flow diagram illustrating a method of processing information according to an example embodiment;

[0031] FIG. 2D is a flow diagram illustrating a method of processing information according to an example embodiment;

[0032] FIG. 3 is a flow diagram illustrating a method of processing information according to an example embodiment;

[0033] FIG. 4A is a flow diagram illustrating a method of processing information according to an example embodiment;

[0034] FIG. 4B is a flow diagram illustrating a method of processing information according to an example embodiment;

[0035] FIG. 5A is a flow diagram illustrating a method of processing information according to an example embodiment;

[0036] FIG. 5B is a flow diagram illustrating a method of processing information according to an example embodiment;

[0037] FIG. 5C is a flow diagram illustrating a method of processing information according to an example embodiment;

[0038] FIG. 6A is a flow diagram illustrating a method of processing information according to an example embodiment;

[0039] FIG. 6B is a flow diagram illustrating a method of processing information according to an example embodiment;

[0040] FIG. 7A is a flow diagram illustrating a method of processing information according to an example embodiment;

[0041] FIG. 7B is a flow diagram illustrating a method of processing information according to an example embodiment;

[0042] FIG. 7C is a flow diagram illustrating a method of processing information according to an example embodiment;

[0043] FIG. 8A is a schematic diagram of a structure of a UE according to an example embodiment;

[0044] FIG. 8B is a schematic diagram of a structure of a third node according to an example embodiment;

[0045] FIG. 8C is a schematic diagram of a structure of a first node according to an example embodiment;

[0046] FIG. 8D is a schematic diagram of a structure of a first node according to an example embodiment;

[0047] FIG. 9A is a schematic diagram of a structure of a communication device according to an example embodiment;

[0048] FIG. 9B is a schematic diagram of a structure of a chip according to an example embodiment. DETAILED DESCRIPTION

[0049] Embodiments of the present disclosure provide an information processing method, a communication device, a communication system and a storage medium.

[0050] The first aspect provides an information processing method, wherein the method is performed by a user equipment (UE), and the method comprises: generating a second key according to a first key of a first node; generating a third key according to the second key; and the third key is used to protect security of communication between the UE and a second node.

[0051] Based on the above scheme, in addition to allowing the UE to directly communicate with the first node, the UE is also allowed to directly communicate with the second node, and the second key is generated according to the first key of the first node, and the third key is generated according to the second key; in this way, the third key can be used to protect the security of communication between the UE and the second node.

[0052] In some embodiments of the first aspect, the generating of the second key according to the first key of the first node comprises at least one of: generating the second key according to the first key and a type of the second node; and generating the second key according to the first key and an instance identifier (ID) of the second node.

[0053] Based on the above scheme, the second key can be generated according to the first key and the type of the second node, so that the UE is allowed to generate the second key without knowing a specific second node, and the generation of the second key is simplified. In some embodiments, if the second key is generated according to the first key and the type of the second node, the UE can generate the second key in advance according to a type of a node that may need to communicate after obtaining the first key, and the generated second key can be directly used when communication is needed subsequently.

[0054] In some embodiments of the first aspect, the generating of the second key according to the first key and the type of the second node comprises at least one of: generating the second key according to the first key, the type of the second node and a first count value; the first count value is a count of uplink messages sent by the UE to the second node; and generating the second key according to the first key, the type of the second node and first time information; the first time information indicates a time period for generating the second key.

[0055] Based on the above scheme, two embodiments of generating the second key based on the first key and the type of the second node are given. After introducing the first count value and the first time information, the second key generated by the UE in different time periods when communicating with the second node is different, and the third key generated further is also changed, so that the security of the communication between the UE and the second node can be improved again.

[0056] In some embodiments of the first aspect, the second key is generated according to the first key and an instance identification ID of the second node, including that the UE is preconfigured with the instance ID of the second node, and the second key is generated according to the first key and the instance ID of the second node.

[0057] Based on the above scheme, the UE is preconfigured with the instance ID of the second node, and in order to realize that the keys for the communication between the UE and different second nodes are different, the second key can be generated based on the first key and the instance ID of the second node, so that the third keys for different second nodes are different, and the security of the communication between the UE and the second node is improved again.

[0058] In some embodiments of the first aspect, the second key is generated according to the first key and an instance identification ID of the second node, including at least one of the following: the second key is generated according to the first key, the instance ID of the second node, and a first count value; the first count value is a count of an uplink message sent by the UE to the second node; the second key is generated according to the first key, the instance ID of the second node, and first time information; and the first time information indicates a time period of generating the second key.

[0059] Based on the above scheme, it is given how to generate the second key according to the first key and the instance ID of the second node, and by introducing the first count value or the first time information, the second key generated by the UE in different time periods when communicating with the second node is different, so that the third key is also different, and the security of the communication between the UE and the second node is improved.

[0060] In some embodiments of the first aspect, the method further includes: sending a first radio resource control (RRC) message to a third node, the first RRC message being a first message; the first message is protected by the third key; and the second node is a receiving node of the first message.

[0061] Based on the above scheme, the first message is encapsulated in the first RRC message, which can be sent to the third node using the RRC connection between the UE and the third node, and the third node can transparently pass or forward the first message to a subsequent node.

[0062] In some embodiments of the first aspect, the first message includes at least one of the following: a non-access stratum (NAS) signaling; an ID of the UE; and a first algorithm identification, the first algorithm identification being used to identify a security algorithm for protecting the first message.

[0063] In some embodiments, the first message carrying at least one of the above information contents can make the second node aware of the communication requirement of the UE and / or obtain an input parameter for generating the fourth key.

[0064] In some embodiments of the first aspect, the first RRC message is protected by an access stratum (AS) security context of the UE.

[0065] Based on the above scheme, the first RRC message is protected by the AS security context, ensuring the security of the first message on the air interface.

[0066] In some embodiments of the first aspect, the method further comprises: receiving a second RRC message sent by the third node, the second RRC message comprising a second message; the second message being from the second node; the second message being protected by the fourth key; the fourth key being generated according to a fifth key, the fifth key being generated according to the first key.

[0067] Based on the above scheme, the UE receives a second RRC message from the second node, the second RRC message comprising a second message returned by the second node based on the first message, so that the UE completes one communication with the second node in a time period.

[0068] In some embodiments of the first aspect, the second RRC message is protected by an access stratum (AS) security context of the UE.

[0069] Based on the above scheme, the second RRC message is protected by the AS security context, so that the second message provides double-layer security protection, further improving the security of the second message.

[0070] In some embodiments, when the second message is secured by the fourth key, the second RRC message can also not be protected by the AS security context, reducing the message parsing delay of the UE. Similarly, when the UE has protected the first message by the third key, the first RRC message can also not be protected by the AS security context, in order to facilitate the message parsing rate of the first node and / or the second node.

[0071] In some embodiments of the first aspect, the first RRC message further comprises at least one of: type information of the second node; an instance ID of the second node; address information of the second node.

[0072] Based on the above scheme, the type information of the second node, the instance ID of the second node, or the address information of the second node is carried in the first RRC message instead of the first message, facilitating the determination of the second node by the third node and / or the first node, so that the transparent transmission of the first message can be implemented.

[0073] The second aspect provides an information processing method, wherein the method is performed by a third node, and the method comprises: receiving a first message sent by a user equipment (UE), the first message being protected by a third key; the third key is generated by the UE based on a second key, and the second key is generated based on a first key of a first node; and a receiving node of the first message is a second node.

[0074] In some embodiments of the second aspect, the receiving the first message sent by the UE comprises: receiving a first radio resource control (RRC) message sent by the UE, the first RRC message comprising the first message.

[0075] In some embodiments of the second aspect, the first RRC message is protected by an access stratum (AS) security context.

[0076] In some embodiments of the second aspect, the first RRC message further comprises at least one of the following: type information of the second node; an instance ID of the second node; and address information of the second node.

[0077] In some embodiments of the second aspect, the method further comprises: sending the first message to the first node or the second node, and the third node being a forwarding node of the first message.

[0078] In some embodiments of the second aspect, the sending the first message to the first node or the second node comprises at least one of the following: sending the first message to the first node or the second node according to whether the first message is a first message sent by the UE to the second node; sending the first message to the first node or the second node according to whether the third node obtains first information of the second node, the first information comprising at least one of an instance ID of the second node and address information of the second node; and sending the first message to the first node or the second node according to whether the third node can determine the second node.

[0079] Based on the above scheme, the third node determines to send the first message to the second node or the first node according to different situations, thereby realizing the targeted transmission of the first message in different situations and facilitating the flexible selection according to needs in the actual transmission process.

[0080] In some embodiments of the second aspect, the sending the first message to the first node or the second node according to whether the first message is a first message sent by the UE to the second node comprises at least one of the following: sending the first message to the first node when the first message is a first message sent by the UE to the second node; and sending the first message to the second node when the first message is not a first message sent by the UE to the second node.

[0081] In some embodiments of the second aspect, the first message is sent to the first node or the second node according to whether the third node obtains the first information of the second node, including at least one of: the first RRC message including the first information of the second node, the first message being sent to the second node; the third node storing the first information of the second node, the first message being sent to the second node; the first RRC message not containing the first information of the second node, the first message being sent to the first node; the first node not storing the first information of the second node, the first message being sent to the first node.

[0082] In some embodiments of the second aspect, the first message is sent to the first node or the second node according to whether the third node is able to determine the second node, including at least one of: the first RRC message including type information of the second node and configuration information of the third node, the second node being determined according to the type information and the configuration information; the first RRC message not including type information of the second node and configuration information of the third node, the first message being sent to the first node.

[0083] In some embodiments of the second aspect, the first message is sent to the first node or the second node, including at least one of: determining a type of the second node; the first message being sent to the second node of the type connected to the third node.

[0084] In some embodiments of the second aspect, the type of the second node is determined, including at least one of: the type of the second node being determined according to type information of the second node included in the first RRC message; the type of the second node being determined according to a message type of the first message.

[0085] In some embodiments of the second aspect, the third node sends the first message to the first node; the method further includes: sending at least one of type information of the second node and an instance ID of the second node to the first node.

[0086] In some embodiments of the second aspect, the method further includes: receiving a second message sent by the first node or the second node, the second message being protected using a third key; the third key being generated by the second node according to the first key; sending a second RRC message to the UE according to the second message, the second RRC message including the second message.

[0087] In some embodiments of the second aspect, the method further includes: receiving second information of the second node sent by the first node or the second node, the second information including at least one of an instance ID of the second node and address information of the second node.

[0088] In some embodiments of the second aspect, the method further includes: interpreting the second message to obtain second information of the second node, the second information including at least one of an instance ID of the second node and address information of the second node.

[0089] In some embodiments of the second aspect, the second RRC message is protected by an access stratum, AS, layer context of the UE.

[0090] In some embodiments of the second aspect, before sending the first message to the second node, the method further comprises: sending a third message to the first node, the third message being used to request the first node to generate a fifth key for the second node; the fifth key being used to generate a fourth key; the fourth key being used to protect security of communication between the second node and the UE.

[0091] In some embodiments of the second aspect, the method further comprises: receiving a fourth message sent by the first node;

[0092] The sending of the first message to the second node comprises: the fourth message indicating that the fifth key has been generated, and the sending of the first message to the second node.

[0093] In some embodiments of the third aspect, an information processing method, wherein the method is performed by a first node, and the method comprises:

[0094] generating a fifth key according to a first key of the first node;

[0095] sending the fifth key to a second node, the fifth key being used by the second node to generate a fourth key, the fourth key being used to protect security of communication between the second node and a user equipment, UE.

[0096] In some embodiments of the third aspect, the generating of the fifth key according to the first key of the first node comprises:

[0097] receiving a first message sent by a third node, and generating the fifth key according to the first key of the first node; the first message being protected by a third key; the third key being generated based on a second key; the second key being generated based on the first key of the first node.

[0098] In some embodiments of the third aspect, the method further comprises: receiving a third message sent by the third node, and generating the fifth key according to the first key of the first node; the third message being used to request the first node to generate the fifth key for the second node.

[0099] In some embodiments of the third aspect, the method further comprises: sending a fourth message to the third node; the fourth message being used by the third node to determine whether the fifth key has been generated.

[0100] In some embodiments of the third aspect, the generating of the fifth key according to the first key of the first node comprises: receiving a fifth message sent by the second node, and generating the fifth key according to the first key of the first node; the fifth message being used by the second node to request the first node for the fifth key.

[0101] In some embodiments of the third aspect, before generating the fifth key according to the first key of the first node, the method further comprises: determining the second node.

[0102] In some embodiments of the third aspect, determining the second node comprises at least one of: determining the second node according to type information of the second node sent by the third node; determining the second node according to an instance identifier of the second node sent by the third node; determining the second node according to a message type of the first message forwarded by the third node; determining the second node according to information content of the first message forwarded by the third node.

[0103] In some embodiments of the third aspect, the method further comprises: sending the first message to the second node.

[0104] In some embodiments of the third aspect, generating the fifth key according to the first key comprises at least one of: generating the fifth key according to the first key and a type of the second node; generating the fifth key according to the first key and an instance identifier ID of the second node.

[0105] In some embodiments of the third aspect, generating the fifth key according to the first key and the type of the second node comprises at least one of: generating the fifth key according to the first key, the type of the second node, and a first count value; the first count value being a count of uplink messages sent by the UE to the second node; generating the fifth key according to the first key, the type of the second node, and second time information; the second time information indicating a time period for generating the fifth key.

[0106] In some embodiments of the third aspect, generating the fifth key according to the first key and the instance identifier ID of the second node comprises at least one of: generating the fifth key according to the first key, the instance ID of the second node, and a first count value; the first count value being a count of uplink messages sent by the UE to the second node; generating the fifth key according to the first key, the instance ID of the second node, and second time information; the second time information indicating a time period for generating the fifth key.

[0107] In some embodiments of the third aspect, the method further comprises: in the case of sending the first message to the second node, sending a second algorithm identifier to the second node, the second algorithm identifier being an input parameter for generating the fourth key.

[0108] In some embodiments of the third aspect, the method further comprises: receiving a second message sent by the second node, the second message being protected using the fourth key; the fourth key being generated by the second node according to the fifth key.

[0109] In some embodiments of the third aspect, the method further comprises: sending the second message to the third node.

[0110] In some embodiments of the third aspect, the method further includes: sending, to the third node, second information, the second information comprising at least one of an instance ID of the second node and address information of the second node.

[0111] The fourth aspect provides an information processing method, wherein the method is performed by a second node, and the method comprises: receiving a fifth key sent by a first node; the fifth key is generated according to a first key of the first node; generating a fourth key according to the fifth key; the fourth key is used to protect security of communication between the second node and a user equipment (UE).

[0112] In some embodiments of the fourth aspect, the method further includes: receiving a first message sent by the first node or the third node; the first message is protected by a third key; the third key is generated according to a second key; the second key is generated according to the first key; and verifying security of the first message using the fourth key.

[0113] In some embodiments of the fourth aspect, the method further includes: receiving a second algorithm identifier sent by the first node, the second algorithm identifier being used as an input parameter for generating the fourth key; or receiving a first algorithm identifier in the first message forwarded by the third node, the first algorithm identifier being used as an input parameter for generating the fourth key.

[0114] In some embodiments of the fourth aspect, the method further includes: sending, to the first node or the third node, a second message, the second message being protected using the fourth key.

[0115] In some embodiments of the fourth aspect, the method further includes: receiving the first message forwarded by the third node, and sending a fifth message to the first node; the fifth message is used for the second node to request the fifth key from the first node.

[0116] The fifth aspect provides a user equipment (UE), wherein the UE comprises:

[0117] a processing module configured to generate a second key according to a first key of a first node, and generate a third key according to the second key; the third key is used to protect security of communication between the UE and a second node.

[0118] The sixth aspect provides a third node, wherein the third node comprises:

[0119] a receiving module configured to receive a first message sent by a user equipment (UE), the first message being protected using a third key; the third key is generated by the UE based on a second key, the second key being generated based on a first key of a first node; and a receiving node of the first message is a second node.

[0120] The seventh aspect provides a first node, wherein the first node comprises:

[0121] The processing module is configured to generate a fifth key according to the first key of the first node;

[0122] The sending module is configured to send the fifth key to the second node, and the fifth key is used by the second node to generate a fourth key, and the fourth key is used to protect the security of communication between the second node and a user equipment (UE).

[0123] The eighth aspect provides a second node, and the second node comprises:

[0124] The receiving module is configured to receive the fifth key sent by the first node, and the fifth key is generated according to the first key of the first node;

[0125] The processing module is configured to generate a fourth key according to the fifth key, and the fourth key is used to protect the security of communication between the second node and a user equipment (UE).

[0126] The ninth aspect provides a communication system, and the communication system comprises a user equipment (UE), a first node, a second node and a third node; the UE is used to execute the method of any technical solution of the first aspect; the third node is used to execute the method of any technical solution of the second aspect; the first node is used to execute the method of any technical solution of the third aspect; and the second node is used to execute the method of any technical solution of the fourth aspect.

[0127] The tenth aspect provides a communication device, and the communication device comprises one or more processors; wherein the processor is used to call instructions to enable the communication device to execute the information processing method of any technical solution of the first aspect to the fourth aspect.

[0128] The eleventh aspect provides a program product, and the program product comprises a computer program, and the computer program is executed by a communication device to enable the communication device to implement the information processing method of any technical solution of the first aspect to the fourth aspect.

[0129] The twelfth aspect provides a computer program, and the computer program is executed by a computer to enable the computer to execute the information processing method of any technical solution of the first aspect to the fourth aspect.

[0130] It can be understood that the UE, the network device and the communication system, the program product and the computer program are used to execute the method provided by the embodiments of the present disclosure. Therefore, the beneficial effects that can be achieved can refer to the beneficial effects in the corresponding method, which will not be described here.

[0131] The embodiments of the present disclosure provide an information processing method, a communication device, a communication system and a storage medium. The embodiments of the present disclosure are not exhaustive, but only illustrate some embodiments, and are not specific limitations on the protection scope of the present disclosure. In the case of no contradiction, each step in an embodiment can be implemented as an independent embodiment, and the steps can be combined arbitrarily, for example, the mode after removing some steps in an embodiment can also be implemented as an independent embodiment, and the order of the steps in an embodiment can be exchanged arbitrarily, in addition, the optional implementation mode in an embodiment can be combined arbitrarily; in addition, the embodiments can be combined arbitrarily, for example, the steps of different embodiments or part of the steps of different embodiments can be combined arbitrarily, an embodiment can be combined with the optional implementation mode of other embodiments.

[0132] In the embodiments of the present disclosure, the terms and / or descriptions between the embodiments are consistent and can be referred to each other if there is no special description and logical conflict, and the technical features in different embodiments can be combined to form new embodiments according to their inherent logical relationship.

[0133] The terms used in the embodiments of the present disclosure are only for the purpose of describing the specific embodiments, and not as a limitation on the present disclosure.

[0134] In the embodiments of the present disclosure, unless otherwise specified, the elements expressed in singular form, such as "one", "a", "the", "above", "preceding", "this", etc., can represent "one and only one", or "one or more", "at least one", etc. For example, in the case of using articles such as "a", "an", "the" in English, the noun after the article can be understood as singular expression, or as plural expression.

[0135] In the embodiments of the present disclosure, "plurality" means two or more.

[0136] In some embodiments, the terms "at least one of", "one or more", "a plurality of", "multiple", and the like can be replaced with each other.

[0137] In some embodiments, the description of "at least one of A, B", "A and / or B", "A or B in an instance", "A in one instance and B in another instance", and the like, can include the following technical manners according to the situation: A in some embodiments (A is executed regardless of B); B in some embodiments (B is executed regardless of A); A and B are selectively executed in some embodiments (A and B are selected from A and B); A and B are executed in some embodiments (A and B are executed). When there are more branches such as A, B, C, and the like, the above is similar.

[0138] In some embodiments, the description of "A or B" and the like can include the following technical manners according to the situation: A in some embodiments (A is executed regardless of B); B in some embodiments (B is executed regardless of A); A and B are selectively executed in some embodiments (A and B are selected from A and B). When there are more branches such as A, B, C, and the like, the above is similar.

[0139] The prefix words "first", "second", and the like in the embodiments of the present disclosure are only used to distinguish different description objects, and do not constitute a limitation on the position, order, priority, quantity, or content of the description objects. The description of the description objects should refer to the description in the context of the claims or embodiments, and should not constitute an additional limitation because of the use of the prefix words. For example, the description object is "field", and the ordinal words before "field" in "first field" and "second field" do not limit the position or order between "fields", and "first" and "second" do not limit whether the "fields" modified thereby are in the same message or not, nor limit the order of "first field" and "second field". For another example, the description object is "level", and the ordinal words before "level" in "first level" and "second level" do not limit the priority between "levels". For another example, the quantity of the description object is not limited by the ordinal words, and can be one or more. For example, "first device", wherein the quantity of "device" can be one or more. In addition, the objects modified by different prefix words can be the same or different, for example, the description object is "device", and "first device" and "second device" can be the same device or different devices, and the types thereof can be the same or different; for another example, the description object is "information", and "first type of information" and "second type of information" can be the same information or different information, and the content thereof can be the same or different.

[0140] In some embodiments, "including A", "containing A", "for indicating A", "carrying A", can be interpreted as directly carrying A, or indirectly indicating A.

[0141] In some embodiments, the terms "…", "determining …", "in the case of …", "when …", "when …", "if …", and the like can be replaced with each other.

[0142] In some embodiments, the terms "greater than", "greater than or equal to", "not less than", "more than", "more than or equal to", "not less than", "higher than", "higher than or equal to", "not lower than", "above", and the like can be replaced with each other, and the terms "less than", "less than or equal to", "not greater than", "fewer than", "fewer than or equal to", "not more than", "lower than", "lower than or equal to", "not higher than", "below", and the like can be replaced with each other.

[0143] In some embodiments, an apparatus and the like can be interpreted as an entity, and can also be interpreted as virtual, and the name thereof is not limited to the name described in the embodiments. The terms "apparatus", "equipment", "device", "circuit", "network element", "node", "function", "unit", "section", "system", "network", "chip", "chip system", "entity", "subject", and the like can be replaced with each other.

[0144] In some embodiments, "network" can be interpreted as a network-side device or network function included in an access network device, a core network device, and the like in a network.

[0145] In some embodiments, the terms “access network device (AN device),” “radio access network device (RAN device),” “base station (BS),” “radio base station,” “fixed station,” “node,” “access point,” “transmission point (TP),” “reception point (RP),” “transmission / reception point (TRP),” “panel,” “antenna panel,” “antenna array,” “cell,” “macro cell,” “small cell,” “femto cell,” “pico cell,” “sector,” “cell group,” “serving node,” “node (carrier),” “component node,” “bandwidth part (BWP),” and the like can be used interchangeably.

[0146] In some embodiments, the terms "terminal," "terminal device," "user equipment (UE)," "user UE," "mobile station (MS)," "mobile UE (MT)," "subscriber station," "mobile unit," "subscriber unit," "wireless unit," "remote unit," "mobile device," "wireless device," "wireless communication device," "remote device," "mobile subscriber station," "access UE," "mobile terminal," "wireless terminal," "remote terminal," "handset," "user agent," "mobile client," "client," and so on can be replaced with each other.

[0147] In some embodiments, the access network device, the core network device, or the network device can be replaced with the UE. For example, the embodiments of the present disclosure can also be applied to a structure in which communication between the access network device, the core network device, or the network device and the UE is replaced with communication between a plurality of UEs (e.g., device-to-device (D2D), vehicle-to-everything (V2X), and so on). In this case, the structure in which the UE has all or part of the functions of the access network device can also be provided. In addition, the terms "uplink," "downlink," and so on can also be replaced with terms corresponding to the inter-UE communication (e.g., "side"). For example, the uplink channel, the downlink channel, and so on can be replaced with the side channel, and the uplink, the downlink, and so on can be replaced with the sidelink.

[0148] In some embodiments, the UE can be replaced with the access network device, the core network device, or the network device. In this case, the structure in which the access network device, the core network device, or the network device has all or part of the functions of the UE can also be provided.

[0149] In some embodiments, the data, information, etc. can be obtained in compliance with the laws and regulations of the country where the location is situated.

[0150] In some embodiments, the data, information, etc. can be obtained after obtaining the consent of the user.

[0151] In addition, each element, each row, or each column in the table of the embodiments of the present disclosure can be implemented as an independent embodiment, and any combination of any element, any row, or any column can also be implemented as an independent embodiment.

[0152] FIG. 1A is a schematic diagram of an architecture of a communication system according to an embodiment of the present disclosure.

[0153] As shown in FIG. 1A, the communication system 100 includes a terminal 101 and a network device 102. The network device 102 can include an access network device and / or a core network device. The terminal can also be referred to as a UE.

[0154] In some embodiments, the terminal 101 includes at least one of a mobile phone, a wearable device, an Internet of Things device, a communication-capable automobile, a smart automobile, a Pad, a computer with wireless transceiver function, a virtual reality (VR) UE device, an augmented reality (AR) UE device, a wireless UE device in industrial control, a wireless UE device in self-driving, a wireless UE device in remote medical surgery, a wireless UE device in smart grid, a wireless UE device in transportation safety, a wireless UE device in smart city, a wireless UE device in smart home, and the like, but is not limited thereto.

[0155] In some embodiments, the UE is also referred to as a User Equipment (UE).

[0156] In some embodiments, the access network device may, for example, be at least one of a node or a device that accesses a UE to a wireless network, and the access network device may, for example, include at least one of an evolved NodeB (eNB) in a 5G communication system, a next generation eNB (ng-eNB), a next generation NodeB (gNB), a node B (NB), a home node B (HNB), a home evolved node B (HeNB), a wireless backhaul device, a radio network controller (RNC), a base station controller (BSC), a base transceiver station (BTS), a base band unit (BBU), a mobile switching center, a base station in a 6G communication system, an Open RAN, a Cloud RAN, a base station in other communication systems, an access node in a Wi-Fi system, but is not limited thereto.

[0157] In some embodiments, the technical means of the present disclosure can be applicable to an Open RAN architecture, in which case, the interfaces between or within the access network devices involved in the embodiments of the present disclosure can become internal interfaces of the Open RAN, and the processes and information interactions between these internal interfaces can be implemented through software or programs.

[0158] In some embodiments, the access network device can be composed of a central unit (CU) and a distributed unit (DU), where the CU can also be referred to as a control unit. The CU-DU structure can split the protocol layers of the access network device, and some of the protocol layers can be controlled by the CU, while the rest or all of the protocol layers can be distributed in the DU and controlled by the CU, but is not limited thereto.

[0159] In some embodiments, the core network device can be one device including the first network element, or can be multiple devices or device groups each including the first network element. The network element can be virtual or physical. The core network may, for example, include at least one of an evolved packet core (EPC), a 5G core network (5GCN), and a next generation core (NGC).

[0160] It can be understood that the communication system described in the embodiments of the present disclosure is for more clearly illustrating the technical means of the embodiments of the present disclosure, and does not constitute a limitation on the technical means provided by the embodiments of the present disclosure. It can be known by those skilled in the art that, as the system architecture evolves and new service scenarios appear, the technical means provided by the embodiments of the present disclosure are also applicable to similar technical problems.

[0161] The embodiments of the present disclosure described below can be applied to the communication system 100 shown in FIG. 1A or part of the subjects, but are not limited thereto. The subjects shown in FIG. 1A are exemplary, and the communication system can include all or part of the subjects in FIG. 1A, or other subjects other than those in FIG. 1A. The number and form of each subject is arbitrary, and the connection relationship between the subjects is exemplary. The subjects can not be connected or can be connected, and the connection can be in any manner, can be direct connection or indirect connection, and can be wired connection or wireless connection.

[0162] Embodiments of the present disclosure can be applied to Long Term Evolution (LTE), LTE-Advanced (LTE-A), LTE-Beyond (LTE-B), SUPER 3G, IMT-Advanced, 4th generation mobile communication system (4G), 5th generation mobile communication system (5G), 5G new radio (NR), Future Radio Access (FRA), New-Radio Access Technology (RAT), New Radio (NR), New radio access (NX), Future generation radio access (FX), Global System for Mobile communications (GSM (registered trademark)), CDMA2000, Ultra Mobile Broadband (UMB), IEEE 802.11 (Wi-Fi (registered trademark)), IEEE 802.16 (WiMAX (registered trademark)), IEEE 802.20, Ultra-WideBand (UWB), Bluetooth (Bluetooth (registered trademark)), Public Land Mobile Network (PLMN) network, Device-to-Device (D2D) system, Machine to Machine (M2M) system, Internet of Things (IoT) system, Vehicle-to-Everything (V2X), system using other resources, next-generation system extended based thereon, and the like. Further, a plurality of systems can be combined (for example, LTE and NR can be combined).

[0163] As above, the network functions (NFs) in the 6G architecture are streamlined in order to significantly improve performance in terms of capacity, coverage, signaling overhead, scalability, and energy consumption, etc. The dependencies between NFs can lead to unnecessary complexity and even delays. The number of dependencies and processing points can be reduced by redesigning the network functions. One way is the possibility of direct signaling between enhanced NFs of the 6G system to eliminate potential bottlenecks. Today, many services require information to be transmitted from a terminal device through a (5th Generation Core, 5GC) to a new generation radio access network (New Generation-Radio Access Netork, NG-RAN) node. In the 5th Generation Core (5GC), information is delivered to the NG-RAN node through the AMF, and rarely does it not involve the AMF. To simplify this transmission, the introduction of a service-based interface (Service Based Interface, SBI) to the NG-RAN will allow this information to be exchanged directly between the NF and the NG-RAN without going through the Access Management Function (AMF), as shown in FIG. IB.

[0164] If the RAN evolves in the service-based direction, it means that the RAN node can be a consumer or producer of services for other network functions in addition to the AMF. In the 5th Generation (5G) system, non-access stratum (NAS) signaling is supported only between the AMF of the core network and the UE. Typically, NAS signaling is transparently transmitted through the RAN node. If the RAN can evolve to communicate directly with other core NFs without going through the AMF, it means that NAS signaling needs to be supported between the User Equipment (UE) and other core network NFs in addition to the AMF.

[0165] However, the NAS security of the NAS signaling is currently supported only by the UE and the AMF. According to the key hierarchy structure shown in FIG. 1C, the root key (K AMF ) for NAS security is derived by the UE and the Security Anchor Function (SEAF). K AMF is used to derive the NAS integrity key K NASint and / or the NAS confidentiality protection key K NASencand no other core NF can derive NAS security keys. Since the current key hierarchy design of other core NFs does not support NAS security, the NAS signaling between the UE and other core NFs cannot be protected. If the NAS signaling between the UE and the NF is not protected, there is a risk that the NAS signaling information will be tampered with or eavesdropped when the RAN node forwarding the NAS signaling is attacked. Therefore, it is necessary to study how to protect the security of the 6G multi-NAS architecture. That is, the existing 5G security key hierarchy does not support the security protection of the NAS signaling between the UE and other core network NFs. FIG. 1D is a schematic diagram of an architecture of a 5G security key hierarchy.

[0166] As shown in FIG. 2A, the embodiments of the present disclosure provide an information processing method, which is performed by a communication system. The method can include:

[0167] S2101: The UE generates a second key according to a first key of a first node.

[0168] The communication system can be the communication system shown in FIG. 1A. The UE is the terminal 101 shown in FIG. 1A. The first node can be one of the network devices 102 shown in FIG. 1A. Illustratively, the first node can be a core network node. In some embodiments, the first node can include, but is not limited to, an access management function (AMF). In other embodiments, the second node can also include other network functions (NFs).

[0169] In some embodiments, the second key is an intermediate key for generating a third key.

[0170] In some embodiments, the first node and the second node can both be core network nodes.

[0171] In some embodiments, the second key is generated according to the first key and the type of the second node. Illustratively, the UE can determine the type of the second node according to the requested network service or function. For example, the UE requests a user plane session, and the type of the second node is a session management function (SMF). The UE requests positioning, and the type of the second node can be a location management function (LMF). In some embodiments, the second node can be any node in the UE service network except the first node. Illustratively, the second node can be any core network node in the UE service network except the first node. Illustratively, the second node is not necessarily a core network node.

[0172] In some embodiments, the UE derives the second key using a Key Derivation Function (KDF) with the first key as input and the type of the second node as derivation parameter.

[0173] In some other embodiments, the second key is generated according to the first key, the type of the second node, and a first count value, wherein the first count value is a count of uplink messages sent by the UE to the second node.

[0174] For example, the first count value can be the number of uplink NAS messages sent by the UE to the second node. If the UE has not sent any uplink NAS message to the second node, the first count value can be 0.

[0175] In some embodiments, the second key is generated according to the first key, the type of the second node, and first time information, wherein the first time information indicates a time period for generating the second key.

[0176] In some embodiments, the unit of the time period can be millisecond or second, so that the time difference between the time when the UE generates the second key and the time when the first node generates the fifth key can be negligible. For example, the time period can be greater than the time required for transmitting information from the UE to the first node.

[0177] In some embodiments, the second key is generated according to the first key and an instance identity (ID) of the second node.

[0178] In some embodiments, the UE can be pre-configured with the instance ID of the corresponding second node. In this case, the UE can also generate the second key according to the instance ID of the second node and the first key.

[0179] In some other embodiments, the UE obtains the instance ID of the second node after the first node selects the serving second node for the UE through information interaction between the UE and the first node, and returns the instance ID of the second node to the UE, so that the UE also knows the instance ID of the second node.

[0180] If the UE has obtained the instance ID of the second node before generating the second key, the UE can generate the second key according to the instance ID of the second node. For example, the UE is pre-configured with the instance ID of the second node, and generates the second key according to the first key and the instance ID of the second node.

[0181] In some embodiments, the UE ID can also be used as a generation parameter of the second key when the second key is generated. In this case, the second key is generated according to the first key and in combination with one or more of the type of the second node, the instance ID of the second node, the first count value, the first time information, and the UE ID. If the second key is generated according to the UE ID and the first key, the second keys corresponding to different UEs are different, thereby realizing isolation of the communication security between different UEs and the second node.

[0182] In some embodiments, the UE ID can be any information capable of identifying the UE. Exemplarily, the International Mobile Subscriber Identification Number (IMSI), the International Mobile Equipment Identity (IMEI), the 5G Globally Unique Temporary Identifier (GUTI), the Network Access Identifier (NAI), and the like of the UE can be the information capable of uniquely identifying the UE.

[0183] In some embodiments, the second key can be generated according to the first key using at least one of the following parameters: P0 = UE ID; L0 = the length of P0; P1 = the type of the NF or the NF instance ID; for example, the type of the NF is LMF, SMF, or the like; L1 = the length of P1; P2 = the value of UTC or the number of uplink NAS messages; L2 = the length of P2.

[0184] Of course, the above is only an example, and the specific implementation is not limited to the above example.

[0185] S2102: The UE generates a third key according to the second key.

[0186] In some embodiments, the third key is used to protect the communication security between the UE and the second node. Exemplarily, the third key is used to protect the NAS communication security between the UE and the second node. Here, the NAS communication security can include the security of the NAS message.

[0187] In some embodiments, the third key can include at least one of the following: an integrity key; a confidentiality key; a scrambling key. The integrity key can be used for integrity protection (or integrity verification). The confidentiality key can be used for confidentiality protection, for example, encryption or decryption. The scrambling key can be used for information scrambling or descrambling.

[0188] In some embodiments, different terminal devices or core network devices support different security algorithms, and when generating the third key according to the second key, the algorithm identifier needs to be taken as a generation parameter of the third key.

[0189] In some embodiments, the second key is taken as an input of the KDF, and the third key is generated in combination with one or more of the following parameters:

[0190] P0=algorithm type distinguisher, and exemplary types of the security algorithm here include but are not limited to an integrity algorithm and / or a confidentiality algorithm;

[0191] L0=length of P0;

[0192] P1=security algorithm ID; exemplary IDs include an ID for an Advanced Encryption Standard (AES), an ID for the ZUC algorithm, and the like;

[0193] L1=length of the algorithm ID.

[0194] In the embodiments of the present disclosure, the third key can be used to protect a NAS message sent by the UE to the second node.

[0195] S2103: The UE sends a first message to the third node.

[0196] In some embodiments, the third node can be an access network node, and specifically can be various types of base stations.

[0197] In some embodiments, the first message is carried in a first RRC message using a message container.

[0198] In some embodiments, in order to further improve the security of the first message, the first RRC message is protected using an AS security context, which can include a key for communication between the UE and the access network node. For example, the first RRC message is encrypted and / or integrity protected.

[0199] In some embodiments, the first message includes at least one of the following:

[0200] non-access stratum (NAS) signaling;

[0201] an ID of the UE;

[0202] a first algorithm identifier, the first algorithm identifier being used to identify a security algorithm for protecting the first message.

[0203] In some embodiments, the NAS signaling can be a NAS message that the UE needs to send to the second node. The NAS signaling can be carried in the first RRC message by means of a container. In some embodiments, the encapsulation protocol of the NAS signaling can be different for different types of second nodes. In some embodiments, the signaling content of the NAS signaling can be different for different types of second nodes. In some embodiments, the second node is an LMF, then the NAS signaling can be a NAS signaling encapsulating a Long Term Evolution (LTE) Positioning Protocol (LPP) protocol, and / or the NAS message is related to absolute positioning and / or relative positioning of the UE. In some embodiments, the second node is an SMF, then the signaling content of the NAS signaling is related to establishment, connection or release of a Protocol Data Unit (PDU).

[0204] In some embodiments, the ID of the UE can include, but is not limited to, various types of IDs of the UE, such as IMEI, IMSI or NAI, etc.

[0205] In some embodiments, the first algorithm identity can be used to identify a specific algorithm, such as an integrity algorithm or a confidentiality algorithm.

[0206] In some embodiments, the first algorithm identity can be an input parameter for the UE to generate a third key.

[0207] In some embodiments, the first algorithm identity indicates a security algorithm that can be the same as the NAS security algorithm negotiated between the UE and the first node, so that the security algorithm negotiation between the UE and the second node can not be needed. For example, assuming that the first node is an AMF or an SAEF, when the UE registers to the network, the UE needs to generate K AMF or K SEAF , then the first algorithm identity can be the same as the NAS security algorithm negotiated between the UE and the first node, so that the security algorithm negotiation between the UE and the second node can not be needed. AMF or K SEAFThe first key is a first node. The first key is used to generate a NAS security key for protecting the non-access layer communication security between the UE and the first node as an intermediate security key of the non-access layer communication between the UE and the first node. At this time, the NAS security key between the UE and the first node also needs an algorithm identifier as an input parameter for key generation. In the embodiment of the present disclosure, the UE can use the algorithm identifier used for the non-access layer communication between the UE and the first node by default based on the second key for generating the third key that needs to be used. In this case, the UE does not need to additionally negotiate the algorithm with the second node, and does not need to send the capability of the algorithm supported by the UE to the network, thereby simplifying the process and reducing the signaling overhead. In this case, the first message can carry the first algorithm identifier or can not carry the first algorithm identifier. For example, the first message is sent to the first node via the third node, and the first node knows the security algorithm identifier (i.e., the second algorithm identifier) negotiated with the UE, which can be provided to the second node by the first node. Of course, if the first message carries the first algorithm identifier, the first node does not need to additionally provide the algorithm identifier to the second node. In summary, the first algorithm identifier is optional content of the first message.

[0208] The first RRC message further includes at least one of the following:

[0209] Type information of the second node;

[0210] Instance ID of the second node;

[0211] Address information of the second node.

[0212] In some embodiments, the type information of the second node is carried in the first RRC message, so that the third node or the first node can know the type of the second node, and the second node can be selected for the UE according to the location information of the UE and / or the second node reachable by the third node.

[0213] In some embodiments, the instance ID of the second node can be an identifier of the second node pre-configured on the UE, etc. In some embodiments, the instance ID of the second node is obtained by the UE according to the second node in the historical communication.

[0214] In some embodiments, the address information of the second node can include but is not limited to an Internet Protocol (IP) address.

[0215] In some embodiments, in order to improve the security of the first message, the first RRC message is further protected using an AS security context. In some embodiments, the AS security context can include a confidentiality key and / or an integrity key for the communication between the UE and the third node.

[0216] S2104: The third node sends the first message.

[0217] In some embodiments, the third node sends the first message to the first node or the second node.

[0218] In some embodiments, the first node can be a core network function such as an Access Mobility Management Function (AMF) or a Mobile Manangement Entity (MME).

[0219] In some embodiments, the first node can select the second node for the UE. The second node is a target node for the UE to receive the first message in the current NAS communication.

[0220] In an embodiment, the third node can be a forwarding node of the first message. For example, the third node receives the first RRC message, extracts the first message from the first RRC message, and sends the first message to the first node.

[0221] In some embodiments, the first message is sent to the first node or the second node according to whether the first message is the first message sent by the UE to the second node.

[0222] In some embodiments, the third node is a serving node of the UE. After receiving the first message, the third node can determine whether the first message is the first message sent by the UE to the third node in a period of time or after accessing the third node. If the first message is the first message sent by the UE to the second node, the first message is sent to the first node or the second node. If the first message is not the first message sent by the UE to the second node, the first message is sent to the second node. In summary, the first message is sent to the first node or the second node according to whether the first message is the first message sent by the UE to the second node, including at least one of the following: the first message is the first message sent by the UE to the second node, the first message is sent to the first node; the first message is not the first message sent by the UE to the second node, the first message is sent to the second node.

[0223] In some embodiments, the first message is sent to the first node or the second node according to whether the third node obtains the first information of the second node. The first information includes at least one of an instance ID of the second node and address information of the second node. For example, the third node obtains the first information of the second node, and sends the first message to the second node. The third node does not obtain the first information of the second node, and sends the first message to the first node. In summary, the first message is sent to the first node or the second node according to whether the third node obtains the first information of the second node, including at least one of the following: the first RRC message includes the first information of the second node, and the first message is sent to the second node; the third node stores the first information of the second node, and the first message is sent to the second node; the first RRC message does not contain the first information of the second node, and the first message is sent to the first node; the first node does not store the first information of the second node, and the first message is sent to the first node.

[0224] In some embodiments, the third node can obtain the first information from the first message, or obtain the first information according to a record of one or more UEs communicating with a node of the same type as the second node. Alternatively, the third node can obtain the first information according to local configuration. If the third node successfully obtains the first information, it means that the UE can not be communicating with the second node for the first time, or the third node and the second node can directly communicate. In this case, the first message can be directly sent to the second node, instead of needing to be forwarded by the first node.

[0225] In some embodiments, the first message is sent to the first node or the second node according to whether the third node can determine the second node. In some embodiments, the third node can determine the second node, and the first message is sent to the second node. In other embodiments, the third node cannot determine the second node, and the first message is sent to the first node.

[0226] In some embodiments, the first message is sent to the first node or the second node according to whether the third node is able to determine the second node, including at least one of: the first message is sent to the second node according to that the first RRC message includes type information of the second node and configuration information of the third node, and the third node is able to determine the second node; the first message is sent to the first node according to that the first RRC message does not include type information of the second node and configuration information of the third node, and the third node is unable to determine the second node. Illustratively, the third node can determine the second node according to message content carried by the first message and / or message type of the first message. Further illustratively, the third node can determine the second node according to local configuration of the third node. For example, the third node supports a service-based interface (SBI). In this case, the third node itself is connected with one or more nodes of the same type as the second node, and at this time the third node can determine the node connected as the second node when the third node is connected with one node of the same type as the second node. When the third node is connected with multiple nodes of the same type as the second node, the third node can select the second node for the UE according to a selection strategy. For example, the third node can select the second node for the UE according to current load rate or reachability of the multiple nodes or randomly. Of course, there are many ways for the third node to determine the second node, which are not limited to the above examples.

[0227] In some embodiments, the third node sends the first message to the first node; the method further includes: sending at least one of type information of the second node and an instance ID of the second node to the first node.

[0228] S2105: The first node determines the second node for the UE.

[0229] In some embodiments, the first node determines the second node for the UE includes but is not limited to at least one of:

[0230] determining the second node according to type information of the second node sent by the third node;

[0231] determining the second node according to an instance identifier of the second node sent by the third node;

[0232] determining the second node according to message type of the first message forwarded by the third node;

[0233] determining the second node according to information content of the first message forwarded by the third node;

[0234] In some embodiments, the first node receives type information of the second node, and selects the second node for the UE according to location information of the UE and / or load rate of the second node, etc.

[0235] In some embodiments, the first node receives the first message forwarded by the third node, and selects the second node for the UE.

[0236] S2106: The first node generates a fifth key according to the first key of the first node.

[0237] In some embodiments, the first node can be an AMF, and the first key of the first node can be K AMF In some embodiments, the fifth key is generated according to the first key, including at least one of:

[0238] The fifth key is generated according to the first key and the type of the second node;

[0239] The fifth key is generated according to the first key and the instance identifier ID of the second node.

[0240] In some embodiments, the fifth key is generated according to the first key and the type of the second node, including at least one of:

[0241] The fifth key is generated according to the first key, the type of the second node, and a first count value; the first count value is a count of uplink messages sent by the UE to the second node.

[0242] The fifth key is generated according to the first key, the type of the second node, and second time information; the second time information indicates a time period for generating the fifth key.

[0243] If the first key is generated using the NAS message count or the second time information, the second key and the fifth key are different when the same UE communicates with the same second node at different time periods, thereby further improving the security of direct NAS communication between the UE and the second node.

[0244] In some embodiments, the fifth key is generated according to the first key and the instance identifier ID of the second node, including at least one of:

[0245] The fifth key is generated according to the first key, the instance ID of the second node, and a first count value; the first count value is a count of uplink messages sent by the UE to the second node.

[0246] The fifth key is generated according to the first key, the instance ID of the second node, and second time information; the second time information indicates a time period for generating the fifth key.

[0247] In some embodiments, the fifth key is generated according to the first key and the instance identifier ID of the second node, including at least one of:

[0248] The fifth key is generated according to the first key, the instance ID of the second node, and a first count value; the first count value is a count of uplink messages sent by the UE to the second node.

[0249] The fifth key is generated according to the first key, an instance ID of the second node, and second time information; the second time information indicates a time period of generating the fifth key.

[0250] In some embodiments, the generating of the fifth key according to the first key can use at least one of the following parameters:

[0251] P0 = UE ID;

[0252] L0 = length of P0;

[0253] P1 = type or NF instance ID of the NF; for example, the type of the NF is LMF, SMF, etc.

[0254] L1 = length of P1;

[0255] P2 = value of UTC or number of uplink NAS messages;

[0256] L2 = length of P2.

[0257] Of course, the above is only an example, and the specific implementation is not limited to the above example.

[0258] S2107: The first node sends the fifth key and the first message to the second node.

[0259] In some embodiments, in the case of sending the first message to the second node, the first node sends the second algorithm identifier to the second node.

[0260] In some embodiments, the second algorithm identifier is used to identify the security algorithm for protecting the second message. In other embodiments, the second algorithm identifier is an input parameter for generating the fourth key. Illustratively, the second algorithm identifier can be sent to the second node at the same time as the first message and / or the fifth key. Further illustratively, the second algorithm identifier can also be sent to the second node separately.

[0261] In some embodiments, the first node identifies whether the first message contains the first algorithm identifier, and determines whether to send the second algorithm identifier to the second node according to whether the first message contains the first algorithm identifier. Illustratively, the first node identifies that the first message contains the first algorithm identifier, and if the first message contains the first algorithm identifier, the first node does not need to send the second algorithm identifier to the second node. Further illustratively, the first node identifies that the first message does not contain the first algorithm identifier, and the first node sends the second algorithm identifier to the second node.

[0262] In some embodiments, the second algorithm identifier can be an algorithm identifier negotiated between the first node and the UE for NAS communication.

[0263] In some embodiments, the first node does not identify whether the first message contains the first algorithm identity, and sends the second algorithm identity to the second node in case that the fifth key and / or the first message needs to be sent to the second node, which has simplified the information processing of the first node.

[0264] If the UE is a UE that has successfully registered to the first node, the first algorithm identity and the second algorithm identity should be the same.

[0265] S2108: The second node generates a fourth key according to the fifth key.

[0266] In some embodiments, the fourth key is generated with the fifth key as the input of the KDF, and in combination with one or more of the following parameters:

[0267] P0 = an algorithm type distinguisher, exemplary, the type of security algorithm here includes but is not limited to an integrity algorithm and / or a confidentiality algorithm;

[0268] L0 = the length of P0;

[0269] P1 = a security algorithm ID; exemplary, the ID of the Advanced Encryption Standard (AES), the ID of the ZUC algorithm, etc.

[0270] L1 = the length of the algorithm ID.

[0271] S2109: The second node sends a second message to the first node or the third node.

[0272] In some embodiments, the second message is protected using the fourth key. Exemplary, the second message is integrity protected using the fourth key, or the second message is confidentiality protected using the fourth key.

[0273] In some embodiments, the second node verifies the first message to be successful using the fourth key, and the second node sends the second message to the first node or the third node. In some embodiments, the second node verifies the first message to fail using the fourth key, and the second node sends a rejection message to the first node or the third node. The rejection message can be used to indicate the rejection of the UE access. Exemplary, the rejection message sent by the second node to the first node or the third node can further include a failure cause. The failure cause can indicate the reason for rejecting the UE access to the second node.

[0274] In some embodiments, the second node allows the UE to access the second node, and sends the second message. The second message can be a response message of the first message.

[0275] S2110: The first node sends the second message to the third node.

[0276] In some embodiments, the first node transmits or forwards the second message to the third node.

[0277] In some embodiments, the first node sends second information to the third node. Exemplarily, the second information includes at least one of an instance ID of the second node and address information of the second node. The second information can be used for direct communication between the third node and the second node. It is worth noting that the first node sending the second information to the third node is an optional step. Exemplarily, the third node can obtain the second information of the second node by interpreting the second message. For example, the second message carries a five-tuple of the sending end, and at this time the third node can obtain the second information through the five-tuple. Exemplarily, the five-tuple can include a source IP address, a source port, a destination IP address, a destination port, and a transport layer protocol. In other embodiments, in the case of a direct connection interface or a direct connection tunnel between the second node and the third node, the second node sends the second information to the third node, which can be beneficial to improve the message transmission efficiency. Exemplarily, the second information can be sent to the third node together with the second message, and the second information can also be sent to the third node separately. Exemplarily, the first node can also return the second information of the second node to the third node after determining the second node.

[0278] S2111: The third node sends the second message to the UE.

[0279] In some embodiments, the third node sends a second RRC message to the UE, and the second RRC message includes the second message.

[0280] In some embodiments, the second RRC message is protected using an AS security context.

[0281] In some embodiments, the UE receives the second message sent by the third node. Exemplarily, after receiving the second message, the UE can be considered to have completed the message interworking between the UE and the second node.

[0282] In some embodiments, after receiving the second message, the UE can send a subsequent NAS message to the second node if necessary, and at this time the third node receives the NAS message and directly transmits or forwards it to the second node. The third node will also directly receive the NAS message sent by the second node to the UE and forward or transmit the NAS message received from the second node to the UE.

[0283] As shown in FIG. 2B, the embodiments of the present disclosure provide an information processing method, which is executed by a communication system. The method can include:

[0284] S2201: The UE generates a second key according to a first key of the first node.

[0285] In some embodiments, the related descriptions of the first node, the second node, the third node, the first key and / or the second key can refer to the related descriptions in the corresponding embodiments of FIG. 2A.

[0286] In some embodiments, the optional implementation that the UE generates the second key according to the first key of the first node can refer to the related descriptions in S2101 in the corresponding embodiments of FIG. 2A.

[0287] S2202: The UE generates a third key according to the second key.

[0288] In some embodiments, the optional implementation that the UE generates the third key according to the second key of the first node can refer to the related descriptions in S2102 in the corresponding embodiments of FIG. 2A.

[0289] S2203: The UE sends a first message to the third node.

[0290] In some embodiments, the optional implementation that the UE sends the first message to the third node can refer to the related descriptions in S2103 in the corresponding embodiments of FIG. 2A.

[0291] S2204: The third node sends the first message.

[0292] In some embodiments, the third node sends the first message to the first node or the second node.

[0293] In some embodiments, the optional implementation that the third node sends the first message to the first node or the second node can refer to the related descriptions in S2104 in the corresponding embodiments of FIG. 2A.

[0294] S2205: The first node determines the second node for the UE.

[0295] In some embodiments, the optional implementation that the first node determines the second node for the UE can refer to the related descriptions in S2105 in the corresponding embodiments of FIG. 2A.

[0296] S2206: The first node generates a fifth key according to the first key of the first node.

[0297] In some embodiments, the optional implementation that the first node generates the fifth key according to the first key of the first node can refer to the related descriptions in S2106 in the corresponding embodiments of FIG. 2A.

[0298] S2207: The first node sends the fifth key and the first message to the second node.

[0299] In some embodiments, the first node sends both the fifth key and the first message to the second node. For each of these embodiments, please refer to the relevant description in the corresponding embodiment S2107 of FIG2A.

[0300] In some embodiments, the first node also sends a second algorithm identifier to the second node. A description or function of this second algorithm identifier can be found in the embodiment corresponding to Figure 2A.

[0301] In some embodiments, the first node also sends node information of the third node to the second node. This node information may include, but is not limited to, at least one of the following: the node identifier of the third node; and the address information of the third node. In some embodiments, the node information of the third node may be optional. For example, if the second node and the UE communicate based on information such as the UE's IP address, the second message sent by the second node will be automatically routed to the third node. If the second node receives the information from the third node, it can communicate with the third node more conveniently. For example, the second node can communicate directly with the third node using the corresponding SBI interface or tunnel based on the node information of the third node.

[0302] In some embodiments, the first node may send the node information of the third node together with the first message to the second node, or the first node may send the node information of the third node to the second node separately.

[0303] S2208: The second node generates the fourth key based on the fifth key.

[0304] In some embodiments, the optional implementation of the second node generating the fourth key based on the fifth key can be found in the relevant description in the embodiment S2108 corresponding to FIG2A.

[0305] In some embodiments, the second node uses an algorithm identifier as an input parameter when generating the fourth key. This algorithm identifier can be either a first algorithm identifier or a second algorithm identifier. The first algorithm identifier is provided by the UE, and the second algorithm identifier is provided by the first node. Specifically, the first algorithm identifier may be included in the first message, and the second algorithm identifier may be actively sent by the first node to the second node or requested by the second node from the first node. For a specific implementation, the relevant descriptions of the first and second algorithm identifiers can be found in the embodiment corresponding to Figure 2A.

[0306] S2209: The second node sends a second message to the third node.

[0307] In some embodiments, the alternative implementations of the second node sending the second message to the third node can be found in the relevant description in the embodiment S2109 corresponding to FIG2A.

[0308] S2210: The third node sends a second message to the UE.

[0309] In some embodiments, the optional implementation of the second node sending the second message to the third node can be seen in the corresponding description in S2110 in FIG. 2A.

[0310] As shown in FIG. 2C, the embodiments of the present disclosure provide an information processing method, which is performed by a communication system. The method can include:

[0311] S2301: The UE generates a second key according to the first key of the first node.

[0312] In some embodiments, the related description of the first node, the second node, the third node, the first key and / or the second key can be seen in the corresponding description in FIG. 2A.

[0313] In some embodiments, the optional implementation of the UE generating the second key according to the first key of the first node can be seen in the corresponding description in S2101 in FIG. 2A.

[0314] S2302: The UE generates a third key according to the second key.

[0315] In some embodiments, the optional implementation of the UE generating the third key according to the second key of the first node can be seen in the corresponding description in S2102 in FIG. 2A.

[0316] S2303: The UE sends a first message to the third node.

[0317] In some embodiments, the optional implementation of the UE sending the first message to the third node can be seen in the corresponding description in S2103 in FIG. 2A.

[0318] S2304: The third node sends a third message to the first node.

[0319] In some embodiments, the third message is sent to the first node before the first message is sent to the second node.

[0320] In some embodiments, the third node determines that the first message is the first message sent by the UE to the second node, and the third message is sent to the first node before the first message is sent to the second node. In some embodiments, the third node determines that the first message is not the first message sent by the UE to the second node, and skips the step of sending the third message to the first node, and directly enters the step of sending the third message to the first node.

[0321] In some embodiments, the third node does not obtain the historical communication record between the UE and the second node, and the third message is sent to the first node before the first message is sent to the second node.

[0322] In some embodiments, the third message is used to request the first node to generate a fifth key for the second node.

[0323] In some embodiments, the fifth key is used to generate a fourth key. Exemplarily, the fourth key can include, but is not limited to, an integrity key and / or a confidentiality key.

[0324] In some embodiments, the fourth key is used to protect the security of the communication between the second node and the UE.

[0325] In some embodiments, the third message includes at least one of the following: an ID of the UE; a type of the second node; an instance ID of the second node; and a first count value. Exemplarily, the first count value can be a count value of an uplink NAS message sent by the UE to the second node.

[0326] Of course, the above is only an example of the third message, and the information content of the third message in the actual implementation is not limited to the above example.

[0327] S2305: The first node sends a fourth message to the third node.

[0328] In some embodiments, the fourth message is used for the third node to determine whether the fifth key has been generated; or the fourth message is used to indicate that the first node has sent the fifth key to the second node. In summary, the fourth message can be used for the third node to determine whether the first message can be sent to the second node.

[0329] In some embodiments, if the first node needs to select the second node for the UE, the first node can also send second information to the third node.

[0330] In some embodiments, if the first node does not need to select the second node for the UE, the first node does not need to send the second information to the third node.

[0331] Exemplarily, if the third node carries the instance ID of the second node or the address information of the second node, it means that the first node does not need to select the second node for the UE, otherwise, the first node needs to select the second node for the UE. Of course, in some cases, the first node can also update the second node determined by the third node for the UE or the second node selected by the UE according to the load rate and / or abnormal condition of different second nodes without the need to select the second node for the UE. In this case, if the first node reselects the second node for the UE, the second information of the second node needs to be sent to the third node.

[0332] In some embodiments, the second information includes at least one of the instance ID of the second node and the address information of the second node.

[0333] In some embodiments, the second information can or can not be included in the fourth message. The second information can be sent to the third node together with the fourth message, or sent to the third node separately.

[0334] In some embodiments, the optional manner in which the first node selects or reselects the second node for the UE can refer to S2105 of the corresponding embodiment of FIG. 2A, which will not be repeated here.

[0335] S2306: The third node sends the first message to the second node.

[0336] In some embodiments, the third node receives the fourth message indicating that the fifth key has been generated or has been sent to the second node, and sends the first message to the second node.

[0337] In some embodiments, the third node can send the first message to the second node at the same time as sending the third message to the first node.

[0338] In other embodiments, the third node can send the first message to the second node before sending the third message to the first node.

[0339] That is, S2306 and S2304 do not have a certain order, and the specific case can have different orders. For example, the first node needs to determine the second node, and the third node first sends the first message to the first node, and then sends the first information to the second node according to the second information after receiving the second information from the first node.

[0340] In some embodiments, the optional implementation in which the first node determines the second node for the UE can refer to the related description in S2105 of the corresponding embodiment of FIG. 2A.

[0341] S2307: The first node generates the fifth key according to the first key of the first node.

[0342] In some embodiments, the optional implementation in which the first node generates the fifth key according to the first key of the first node can refer to the related description in S2106 of the corresponding embodiment of FIG. 2A.

[0343] S2308: The first node sends the fifth key to the second node.

[0344] In some embodiments, the first node sends the fifth key to the second node can be based on the interface between the nodes or calling the corresponding service to send the fifth key to the second node.

[0345] In some embodiments, the first node also sends a second algorithm identifier to the second node. The related description or role of the second algorithm identifier can refer to the corresponding embodiment of FIG. 2A.

[0346] In some embodiments, the first node further sends node information of the third node to the second node. The node information of the third node can include, but is not limited to, at least one of the following: a node identifier of the third node; address information of the third node. In some embodiments, the node information of the third node can be optional information. For example, if the second node and the UE communicate based on the IP address of the UE and other information, the second message sent by the second node will be automatically routed to the third node. If the second node receives the information of the third node, it can communicate with the third node more conveniently. For example, the second node can directly communicate with the second node according to the node information of the second node using the corresponding SBI interface or tunnel.

[0347] In some embodiments, the first node can send the node information of the third node to the third node together with the first message, or the first node can send the node information of the third node to the third node separately.

[0348] S2309: The second node generates a fourth key according to the fifth key.

[0349] In some embodiments, the optional implementation of the second node generating the fourth key according to the fifth key can be referred to the related description in the corresponding embodiment S2108 of FIG. 2A.

[0350] If the algorithm identifier is used as a parameter in the process of generating the fourth key, the algorithm identifier can be the first algorithm identifier or the second algorithm identifier mentioned in any of the foregoing embodiments.

[0351] S2310: The second node sends the second message to the third node.

[0352] In some embodiments, the optional implementation of the second node sending the second message to the third node can be referred to the related description in the corresponding embodiment S2109 of FIG. 2A.

[0353] S2311: The third node sends the second message to the UE.

[0354] In some embodiments, the optional implementation of the second node sending the second message to the third node can be referred to the related description in the corresponding embodiment S2110 of FIG. 2A.

[0355] As shown in FIG. 2D, the embodiments of the present disclosure provide an information processing method, which is executed by a communication system. The method can include:

[0356] S2401: The UE generates a second key according to a first key of the first node.

[0357] In some embodiments, the related description of the first node, the second node, the third node, the first key and / or the second key can be referred to the related description in the corresponding embodiments of FIG. 2A.

[0358] In some embodiments, the optional implementation of the UE generating the second key according to the first key of the first node, can be found in the corresponding description in S2101 in FIG. 2A.

[0359] S2402: The UE generates a third key according to the second key.

[0360] In some embodiments, the optional implementation of the UE generating the third key according to the second key of the first node, can be found in the corresponding description in S2102 in FIG. 2A.

[0361] S2403: The UE sends a first message to a third node.

[0362] In some embodiments, the optional implementation of the UE sending the first message to the third node, can be found in the corresponding description in S2103 in FIG. 2A.

[0363] S2404: The third node sends the first message to the second node.

[0364] In some embodiments, the third node receives a fourth message indicating that the fifth key has been generated or has been sent to the second node, and sends the first message to the second node.

[0365] In some embodiments, the third node can send the first message to the second node at the same time as sending the third message to the first node.

[0366] In other embodiments, the third node can send the first message to the second node before sending the third message to the first node.

[0367] In some embodiments, the optional implementation of the first node determining the second node for the UE, can be found in the corresponding description in S2105 in FIG. 2A.

[0368] S2405: The second node sends a fifth message to the first node.

[0369] In some embodiments, the fifth message is used by the second node to request the fifth key from the first node.

[0370] In some embodiments, the fifth message includes but is not limited to at least one of the following:

[0371] An identity of the UE;

[0372] A type of the second node;

[0373] An instance identity of the second node;

[0374] A first count value.

[0375] In some embodiments, the fifth message can carry an input parameter for the first node to generate the fifth key.

[0376] In some embodiments, the identity of the UE is used to indicate the UE, and the identity of the UE can be used by the first node to determine the second algorithm identity.

[0377] In some embodiments, the fifth message is further used to request the second algorithm identity. For example, the fifth message includes an indicator requesting the algorithm identity, so that when the first node receives the fifth message containing the indicator, the first node sends the second algorithm identity and the fifth key to the second node.

[0378] In other embodiments, the indicator requesting the algorithm identity is optional content of the fifth message. For example, the first node sends the second algorithm identity to the second node by default, so the fifth message does not need to contain the indicator. For another example, when the first message contains the first algorithm identity, the second node does not need to obtain the second algorithm identity from the first node. For another example, when the third key and the fourth key are generated without using the algorithm identity, it is obvious that the transmission of the first algorithm identity and the second algorithm identity between the UE and the network and between different nodes does not need to be performed.

[0379] S2406: The first node sends the fifth key to the second node.

[0380] In some embodiments, the first node needs to generate the fifth key before sending the fifth key to the second node. In some embodiments, the optional implementation of the first node generating the fifth key according to the first key of the first node can be referred to the related description in the corresponding embodiment S2106 of FIG. 2A.

[0381] In some embodiments, the optional implementation of the first node sending the fifth key to the second node can be referred to the corresponding embodiment S2308 of FIG. 2C.

[0382] S2407: The second node generates the fourth key according to the fifth key.

[0383] In some embodiments, the optional implementation of the second node generating the fourth key according to the fifth key can be referred to the related description in the corresponding embodiment S2108 of FIG. 2A.

[0384] If the algorithm identity is used as a parameter in the process of generating the fourth key, the algorithm identity can be the first algorithm identity or the second algorithm identity mentioned in any of the foregoing embodiments.

[0385] S2408: The second node sends the second message to the third node.

[0386] In some embodiments, the optional implementations that the second node sends the second message to the third node can be found in the corresponding description in S2109 in FIG. 2A.

[0387] S2409: The third node sends the second message to the UE.

[0388] In some embodiments, the optional implementations that the second node sends the second message to the third node can be found in the corresponding description in S2110 in FIG. 2A.

[0389] As shown in FIG. 3, the embodiments of the present disclosure provide an information processing method, which is performed by a UE. The method can include:

[0390] S3101: Generating a second key.

[0391] In some embodiments, the second key is generated according to the first key of the first node.

[0392] In some embodiments, the related descriptions of the first node, the second node, the third node, the first key and / or the second key can be found in the corresponding description in the embodiments in FIG. 2A.

[0393] In some embodiments, the optional implementations that the UE generates the second key according to the first key of the first node can be found in the corresponding description in S2101, S2201, S2301 or S2401 in FIG. 2A, FIG. 2B, FIG. 2C or FIG. 2D.

[0394] S3102: Generating a third key.

[0395] In some embodiments, the third key is generated according to the second key.

[0396] In some embodiments, the optional implementations that the UE generates the third key according to the second key of the first node can be found in the corresponding description in S2102, S2202, S2302 or S2402 in FIG. 2A, FIG. 2B, FIG. 2C or FIG. 2D.

[0397] S3103: Sending a first message.

[0398] In some embodiments, the UE sends the first message to the third node.

[0399] In some embodiments, the optional implementations that the UE sends the first message to the third node can be found in the corresponding description in S2103 in FIG. 2A, FIG. 2B, FIG. 2C or FIG. 2D.

[0400] S3104: Receiving a second message.

[0401] In some embodiments, the UE receives a second message from the second node forwarded or transparently transmitted by the third node.

[0402] In some embodiments, the second node sends the optional implementation of the second message to the third node, which can be found in the description of the corresponding embodiment S2110 in FIG. 2A. In some embodiments, the second node sends the optional implementation of the second message to the third node, which can be found in the description of the corresponding embodiment S2210 in FIG. 2B. In some embodiments, the second node sends the optional implementation of the second message to the third node, which can be found in the description of the corresponding embodiment S2311 in FIG. 2C. In some embodiments, the second node sends the optional implementation of the second message to the third node, which can be found in the description of the corresponding embodiment S2409 in FIG. 2D.

[0403] In some embodiments, S3102 to S3104 can be optional steps. For example, after the UE generates the second key, there is no need to communicate with the second node, so there is no need to perform S3102 to S3104. For another example, after the UE generates the third key, there is no need to communicate with the second node, so the UE does not send the third message. For another example, although the UE generates the second key and the third key and sends the first message, in the case that the UE does not select a suitable second node or the selected second node refuses to communicate with the UE, the UE does not receive the second message. Therefore, S3104 is also an optional step.

[0404] As shown in FIG. 4A, the embodiments of the present disclosure provide an information processing method, which is performed by a third node. The method can include:

[0405] S4101: receiving a first message.

[0406] In some embodiments, the third node receives the first message sent by the UE.

[0407] In some embodiments, the first message is protected using a third key.

[0408] In some embodiments, the third key is generated by the UE based on a second key.

[0409] In some embodiments, the second key is generated based on a first key of a first node.

[0410] In some embodiments, the receiving node of the first message is the second node.

[0411] In some embodiments, the first node, the second node, the third node, the first key, the second key, and the first message can be found in the description of the corresponding embodiment S2101, S2201, S2301, or S2401 in FIG. 2A, FIG. 2B, FIG. 2C, or FIG. 2D.

[0412] S4102: sending the first message.

[0413] In some embodiments, the third node sends the first message to the first node or the second node.

[0414] In some embodiments, the optional way in which the third node sends the first message to the first node or the second node can refer to S2104 of the corresponding embodiment of FIG. 2A.

[0415] S4103: receiving the second message.

[0416] In some embodiments, the first node forwards the second message.

[0417] In some embodiments, the second node sends the second message.

[0418] In some embodiments, the related description of the second message can refer to the related description of the corresponding embodiment of the aforementioned FIG. 2A, FIG. 2B, FIG. 2C, or FIG. 2D.

[0419] S4104: sending the second message.

[0420] In some embodiments, the third node sends the second message to the UE.

[0421] In some embodiments, the optional implementation in which the third node sends the second message to the UE can refer to S2111 of the corresponding example of FIG. 2A.

[0422] In some embodiments, S4102 to S4104 can all be optional steps. If the third node determines the second node for the UE, if the third node fails to select the second node for the UE, or if the first RRC message security verification fails through the AS security context verification, the first node does not need to send the first message, and thus will not receive the second message returned based on the first message.

[0423] In some embodiments, after the third node receives the first message and sends the first message, the second node refuses to communicate with the UE, the third node can not receive the second message, and thus does not need to send the second message. In this case, S4103 and S4104 are optional steps.

[0424] As shown in FIG. 4B, the embodiments of the present disclosure provide an information processing method, which is performed by a third node. The method can include:

[0425] S4201: receiving the first message.

[0426] In some embodiments, the first node receives the first message sent by the UE.

[0427] In some embodiments, the first message is protected using a third key.

[0428] In some embodiments, the third key is generated by the UE based on the second key.

[0429] In some embodiments, the second key is generated based on a first key of the first node.

[0430] In some embodiments, the receiving node of the first message is the second node.

[0431] S4202: sending the first message.

[0432] In some embodiments, the third node sends the first message to the first node or the second node.

[0433] In some embodiments, the optional way of sending the first message by the third node to the first node or the second node can be found in S2104 of the corresponding embodiments of FIG. 2A.

[0434] S4203: sending the third message.

[0435] In some embodiments, the third node sends the third message to the first node.

[0436] In some embodiments, the related description of the third message can be found in the related description of the corresponding embodiments of FIG. 2C.

[0437] S4204: receiving the fourth message.

[0438] In some embodiments, the third node receives the fourth message sent by the first node.

[0439] In some embodiments, the related description of the fourth message can be found in the related description of the corresponding embodiments of FIG. 2C.

[0440] S4205: receiving the second message.

[0441] In some embodiments, the second message is received forwarded by the first node.

[0442] In some other embodiments, the second message is received sent by the second node.

[0443] In some embodiments, the related description of the second message can be found in the related description of the corresponding embodiments of FIG. 2A, FIG. 2B, FIG. 2C or FIG. 2D.

[0444] S4206: sending the second message. In some embodiments, the optional implementation of sending the second message by the third node to the UE can be found in S2111 of the corresponding embodiments of FIG. 2A.

[0445] As shown in FIG. 5A, the embodiment of the present disclosure provides an information processing method, which is executed by a first node. The method can include:

[0446] S5101: receiving a first message.

[0447] In some embodiments, the first node receives the first message sent by a third node.

[0448] In some embodiments, the first message is protected using a third key.

[0449] In some embodiments, the third key is generated by the UE based on a second key.

[0450] In some embodiments, the second key is generated based on a first key of the first node.

[0451] In some embodiments, a receiving node of the first message is a second node.

[0452] S5102: generating a fifth key.

[0453] In some embodiments, the fifth key is generated according to the first key of the first node.

[0454] In some embodiments, the fifth key is generated upon receiving the first message.

[0455] In some embodiments, optional implementations of the first node generating the fifth key can refer to any optional implementation of the corresponding embodiment S2106 of FIG. 2A.

[0456] In some embodiments, the method further includes that the first node sends a second algorithm identifier and / or node information of the third node. For example, the second algorithm identifier can refer to any optional implementation of the corresponding embodiment S2106 of FIG. 2A. For example, the node information of the third node can also refer to the related description in the corresponding embodiments of FIG. 2B and / or FIG. 2C.

[0457] S5103: sending the first message and the fifth key.

[0458] In some embodiments, the first node sends the fifth key and the first message to the second node.

[0459] In some embodiments, optional implementations of sending the first message and the fifth key can refer to any optional implementation of the corresponding embodiment S2107 of FIG. 2A.

[0460] S5104: receiving a second message.

[0461] In some embodiments, the first node receives the second message sent by the second node.

[0462] In some embodiments, the related description of the second message can refer to the related description of the corresponding embodiments of FIG. 2A, FIG. 2B, FIG. 2C and / or FIG. 2D.

[0463] S5105: transmitting the second message.

[0464] In some embodiments, the first node transmits the second message to the third node. Exemplarily, the second message will be eventually transparently transmitted or forwarded to the UE by the third node.

[0465] It is worth noting that S5104 and S5105 can be optional steps. For example, the second node can directly transmit the second message to the third node. In this case, the first node will not receive the second message transmitted by the second node, and there is no need to forward the second message to the third node.

[0466] As shown in FIG. 5B, the embodiments of the present disclosure provide an information processing method, which is executed by a first node. The method can include:

[0467] S5201: receiving a third message.

[0468] In some embodiments, the first node receives the third message transmitted by the third node.

[0469] In some embodiments, the third message is used to request the first node to generate a fifth key for the second node. In some embodiments, the fifth key is used to generate a fourth key. Exemplarily, the fourth key can include but is not limited to an integrity key and / or a confidentiality key.

[0470] In some embodiments, the fourth key is used to protect the security of the communication between the second node and the UE.

[0471] In some embodiments, the fourth key is used by the second node to protect the security of the communication with the UE,

[0472] S5202: generating a fifth key.

[0473] In some embodiments, the fifth key is generated according to the first key of the first node.

[0474] In some embodiments, the fifth key is generated in the case of receiving the third message.

[0475] In some embodiments, the optional implementation of the first node generating the fifth key can refer to any optional implementation of the corresponding embodiments of generating the fifth key in FIG. 2A to FIG. 2C.

[0476] In some embodiments, the method further comprises: the first node sending the second algorithm identification and / or node information of the third node. For example, the second algorithm identification can refer to any optional implementation of the corresponding embodiment S2106 of FIG. 2A. For example, the node information of the third node can also refer to the description in the corresponding embodiments of FIG. 2B and / or FIG. 2C.

[0477] S5203: sending the fifth key.

[0478] In some embodiments, the first node sends the fifth key to the second node.

[0479] In some embodiments, the optional implementation of sending the first message can refer to any optional implementation of the corresponding embodiment S2107 of FIG. 2A.

[0480] In some embodiments, the first node can also send the second algorithm identification to the second node. For example, the second algorithm identification can be used to identify the security algorithm of the fourth key. For another example, the second algorithm identification can also be used as an input parameter for generating the fourth key.

[0481] S5204: sending the fourth message.

[0482] In some embodiments, the fourth message can refer to the description of the corresponding embodiment of FIG. 2C.

[0483] In some embodiments, sending the fourth message can be an optional step. For example, by default, the third node and the first node can generate the fifth key after receiving the third message without confirmation.

[0484] As shown in FIG. 5C, the embodiments of the present disclosure provide an information processing method, which is performed by a first node. The method can comprise:

[0485] S5301: receiving the fifth message.

[0486] In some embodiments, the first node receives the fifth message sent by the second node. In some embodiments, the fifth message can be sent by the second node after receiving the first message forwarded by the third node.

[0487] In some embodiments, the first node receives the fifth message sent by the second node. In some embodiments, the fifth message is used by the second node to request the fifth key from the first node.

[0488] In some embodiments, the first node, the second node, the third node, the first key, the second key, and the fifth message can refer to the description in the corresponding embodiments of FIG. 2A, FIG. 2B, FIG. 2C, or FIG. 2D.

[0489] S5302: generate the fifth key.

[0490] In some embodiments, the fifth key is generated according to the first key of the first node.

[0491] In some embodiments, the fifth key is generated upon receiving the third message.

[0492] In some embodiments, optional implementations of the first node generating the fifth key can refer to any optional implementation of generating the fifth key in the corresponding embodiments of FIGS. 2A-2C.

[0493] In some embodiments, the method further includes that the first node sends the second algorithm identifier and / or node information of the third node. For example, the second algorithm identifier can refer to any optional implementation of S2106 in the corresponding embodiment of FIG. 2A. For example, the node information of the third node can also refer to the related description in the corresponding embodiments of FIGS. 2B and / or 2C.

[0494] S5303: send the fifth key.

[0495] In some embodiments, the first node sends the fifth key to the second node.

[0496] In some embodiments, optional implementations of sending the first message can refer to any optional implementation of S2107 in the corresponding embodiment of FIG. 2A.

[0497] As shown in FIG. 6A, the embodiments of the present disclosure provide an information processing method, which is performed by a second node, and can include:

[0498] S6101: receive the fifth key.

[0499] In some embodiments, the second node receives the fifth key sent by the first node.

[0500] In some embodiments, the fifth key is generated by the first node according to the first key.

[0501] In some embodiments, the fifth key is generated by the first node after receiving the first message or the third message sent by the third node.

[0502] S6102: generate the fourth key.

[0503] In some embodiments, the second node generates the fourth key according to the fifth key.

[0504] In some embodiments, optional implementations of the second node generating the fourth key can refer to S2108 in the corresponding embodiment of FIG. 2A.

[0505] S6103: receive the first message.

[0506] In some embodiments, the second node receives the first message from the first node. In other embodiments, the second node receives the first message from the third node. Illustratively, the second node receives the first message and the fifth key together from the first node.

[0507] S6104: sending the second message.

[0508] In some embodiments, the second node verifies the first message using the fourth key, and sends the second message if the first message passes the verification. If the first message fails the verification, the second node does not send the second message, but sends a rejection message.

[0509] In some embodiments, the second node verifying the first message using the fourth key includes, but is not limited to, at least one of the following:

[0510] performing integrity verification on the first message using the fourth key;

[0511] performing confidentiality verification on the first message using the fourth key;

[0512] performing deciphering verification on the first message using the fourth key.

[0513] In some embodiments, the first message is received from the first node, and the second node sends the second message to the first node.

[0514] In some embodiments, the first message is received from the first node, and the second node sends the second message to the third node.

[0515] In some embodiments, the first message is received from the third node, and the second node sends the second message to the third node.

[0516] In some embodiments, the second message can refer to the description of the corresponding embodiments in FIG. 2A, FIG. 2B, FIG. 2C, or FIG. 2D.

[0517] As shown in FIG. 6B, the embodiments of the present disclosure provide an information processing method, which is performed by a second node, and can include:

[0518] S6201: receiving a first message.

[0519] In some embodiments, the second node receives the first message sent by the first node.

[0520] In some embodiments, the message content of the first message can refer to the description of the corresponding embodiments in FIG. 2A to FIG. 2D.

[0521] S6202: sending a fifth message.

[0522] In some embodiments, the related description of the fifth message can be referred to the related description of the corresponding embodiment of FIG. 2D.

[0523] In some embodiments, the optional implementation of the second node sending the fifth message can be referred to the optional implementation of S2405 of the corresponding embodiment of FIG. 2D.

[0524] S6203: receiving the fifth key.

[0525] In some embodiments, the second node receives the fifth key sent by the first node.

[0526] In some embodiments, the second node receives the fifth key sent by the first node based on the fifth message.

[0527] S6204: generating the fourth key.

[0528] In some embodiments, the second node generates the fourth key according to the fifth key.

[0529] In some embodiments, the optional implementation of the second node generating the fourth key can be referred to S2108 of the corresponding embodiment of FIG. 2A.

[0530] S6205: sending the second message.

[0531] In some embodiments, the second node verifies the first message using the fourth key, and sends the second message if the first message passes the verification. If the first message fails the verification, the second node does not send the second message, but sends a rejection message.

[0532] In some embodiments, the second node verifying the first message using the fourth key includes but is not limited to at least one of the following:

[0533] performing integrity verification on the first message using the fourth key;

[0534] performing confidentiality verification on the first message using the fourth key;

[0535] performing ciphering and deciphering verification on the first message using the fourth key.

[0536] In some embodiments, the first message is received from a third node, and the second node sends the second message to the third node.

[0537] In some embodiments, the related description of the second message can be referred to the related description in the corresponding embodiments of FIG. 2A, FIG. 2B, FIG. 2C or FIG. 2D.

[0538] The embodiments of the present disclosure provide an information processing method or a key generation method, which on one hand enhances the existing 5G security key hierarchy to support the 6G multi-NAS architecture protection between the UE and the core NF (non-AMF); on the other hand, completes the NAS security establishment without algorithm negotiation, to support the 6G multi-NAS architecture protection between the UE and the core NF.

[0539] FIG. 1E and FIG. 1F show the key hierarchy architecture of the 5G system. The keys of the NAS signaling are derived by the UE and the AMF according to the key hierarchy, specifically as follows:

[0540] K AMF is a key derived by the UE and the SEAF from K SEAF . When performing horizontal key derivation, K AMF is further derived by the UE and the source AMF.

[0541] K NASINT is a key derived by the UE and the AMF from K AMF , and can only be used to protect the NAS signaling with a specific integrity algorithm.

[0542] K NASENC is a key derived by the UE and the AMF from K AMF , and can only be used to protect the NAS signaling through a specific encryption algorithm.

[0543] In order to protect the NAS signaling between the UE and the core NF, instead of the AMF, the embodiments of the present disclosure propose that K NF needs to be derived as the security root of the NAS signaling between the UE and the NF. In the 6G system, it is assumed that the NF that can directly communicate with the UE is the target NF determined and selected by the AMF in the initial NAS process, and then K NF is proposed to be derived by the UE and the AMF from K AMF . Based on K NF , the UE and the target NF further derive the NAS security key. For example, K NFint is used to protect the integrity of the NAS signaling between the UE and the NF. For another example, K NFenc is used to protect the confidentiality of the NAS signaling between the UE and the NF. Therefore, the new key hierarchy is shown in FIG. 1G, and exemplarily, K NF is derived from K AMF .

[0544] The NF here can include but is not limited to LMF and / or SMF.

[0545] When the AMF and the UE derive K AMF from K NF , the following parameters are used to form the input of the KDF.

[0546] fc = To Be Determined (TBD);

[0547] p0 = UE ID, for example, the UE can be IMSI or NAI or GUTI;

[0548] l0 = length of P0;

[0549] p1 = NF type, for example, the NF type can be LMF, SMF, the NF type can also be NF instance ID.

[0550] l1 = length of P1;

[0551] p2 = UTC-based counter or uplink NAS / NF count;

[0552] l2 = length of P2.

[0553] P0 can be any type of UE ID shared between the UE and the target NF. P1 can be the NF type or the NF instance ID. For example, the NF instance ID can be available on the UE or RAN node. P2 can be a UTC-based K NF derived point in time, or an uplink NAS / NF count in the UE. Exemplarily, it is assumed that the UE maintains a separate NAS counter for each NF, for example, uplink NAS / LMF count, uplink NAS / AMF count.

[0554] The input key is 256-bit K AMF .

[0555] When K NF derived NAS / NF integrity key K NFint and NAS / NF confidentiality key K NFenc , the following parameters need to be used to form a string S.

[0556] fc = To Be Determined (TBD);

[0557] p0 = algorithm type distinguisher, for example, the algorithm type distinguisher for an integrity algorithm or an encryption algorithm has different values;

[0558] l0 = length of the algorithm type distinguisher;

[0559] p1 = algorithm identity, typical identity algorithms can include but are not limited to the ID of AES, the ID of ZUC, etc.

[0560] l1 = length of the algorithm identity;

[0561] The input key is 256-bit K NF .

[0562] In 6G system, it can be assumed that the RAN node cannot determine or select the NF that can directly communicate with the UE, all the NFs capable of directly communicating with the UE and the RAN node are selected by the AMF in the initial NAS procedure. For example, when the UE sends an initial NAS / LPP message to the LMF, the RAN node first forwards the NAS / LPP message to the AMF, and the AMF selects the LMF for the UE. In this way, it can be ensured that any initial NAS / NF message sent to the target NF instead of the AMF is sent after the UE establishes NAS security with the AMF. For simplicity, it can be assumed that all NFs in the same service network support the same set of algorithms and the same algorithm priority as the AMF. Therefore, the NAS security algorithm negotiated between the UE and the AMF can be applied to the NAS / NF security between the UE and the NF other than the AMF, without the need for separate security mode negotiation between the UE and other NFs.

[0563] As shown in FIG. 7A, the embodiments of the present disclosure provide an information processing method, which can include:

[0564] 1. Before the UE initiates a NAS / LMF message (such as a NAS / LPP message) to the LMF through the RAN node, the UE derives K AMF from K NF , for example, K LMF when the NF is the LMF, with its own ID, the type or instance ID of the target NF, and the uplink NAS / LMF COUNT. Note that K AMF was previously derived by the UE and used for the initial NAS message with the AMF.

[0565] 2. The UE further derives NAS / LMF keys from K LMF , for example, K LMF derived based on K LMFint to protect the integrity of the NAS / LMF message and K LMFenc for encryption of the NAS / LMF message. The security algorithm identifier used for derivation of K LMFint and K LMFen c is the same as the NAS signaling security algorithm identifier negotiated between the UE and the AMF through the NAS SMC procedure.

[0566] 3. The UE protects the NAS / LPP message using the derived NAS / LMF keys and encapsulates the NAS / LPP message in an RRC message. The UE can also include the type or instance ID of the target NF in the RRC message. The RRC message is protected using existing AS security.

[0567] 4. If the RRC message received from the UE does not specify a particular NF instance, or the RAN node does not store NF information related to the received NAS / LPP message, the RAN node decides to forward the protected NAS / LPP message to the AMF. The RAN node can also include the type of target NF (i.e. LMF) in the message sent to the AMF.

[0568] 5. When the AMF receives the protected NAS / LPP message, it selects the target NF according to the type of NAS / LPP message received or the target NF type specified by the RAN node. After selecting the LMF, the AMF derives K AMF from K LMF , the input parameters for deriving K LMF are the UE ID, the type or instance ID of the target NF (LMF), and the NAS / LPP message count of the received NAS / LPP message.

[0569] 6. The AMF sends a message to the selected LMF, which includes the protected NAS / LPP message, the derived K LMF , and the negotiated NAS security algorithm retrieved from the UE context.

[0570] 7. The LMF derives the NAS / LMF keys from K LMF according to the received NAS algorithm. That is, K LMFint for protecting the integrity of the NAS / LPP message and K LMFenc for encrypting the NAS / LPP message. The LMF then verifies the received NAS / LPP message using the derived NAS / LMF security context. At this point, the NAS / LMF security context shared between the UE and the LMF has been established.

[0571] 8. The LMF protects the NAS / LPP response message using the NAS / LMF security context shared with the UE and returns the response to the AMF.

[0572] 9. The AMF forwards the protected NAS / LPP response message to the RAN node, along with the selected LMF information to the RAN node.

[0573] 10. The RAN node encapsulates the protected NAS / LPP response message in an RRC message and sends it to the UE. At the same time, the RAN node stores the information of the selected LMF in the UE context.

[0574] 11. The UE sends subsequent NAS / LPP messages to the LMF through the RAN node, which are protected by the NAS / LMF security context shared between the UE and the LMF.

[0575] 12. Since the RAN node has already stored the LMF information in the UE context, the RAN node forwards the protected NAS / LPP message directly to the LMF, the LMF verifies the received NAS / LPP message using the existing NAS / LMF security context derived in step 7. The RAN node then receives the response directly from the LMF.

[0576] 13. The RAN node sends the protected NAS / LPP message response encapsulated in a RRC message to the UE.

[0577] Alternatively, when the target NF (LMF) returns the response, the response can be sent directly to the RAN node without going through the AMF, as long as the AMF indicates the RAN node's information to the LMF after selecting the target NF.

[0578] Exemplarily, as shown in FIG. 7B, the embodiment of the present disclosure provides an information processing method, which can include:

[0579] Steps 1-5 can be the same as the embodiment corresponding to FIG. 7A, which will not be repeated here.

[0580] 6. The AMF sends a message to the selected LMF, which includes the protected NAS / LPP message, the derived K LMF , the agreed NAS algorithm retrieved from the UE context, and the RAN node's information (e.g., RAN node identity or address).

[0581] Step 7 can be the same as step 7 in the embodiment shown in FIG. 7A.

[0582] 8. The LMF protects the NAS / LPP response message using the NAS / LMF security context shared with the UE, and returns the response to the RAN node according to the RAN node information received in step 6.

[0583] 9. The RAN node sends the protected NAS / LPP message response encapsulated in a RRC message to the UE. Meanwhile, the RAN node stores the LMF's information in the UE context.

[0584] Steps 10-12 can be the same as steps 11-13 in the embodiment shown in FIG. 7A.

[0585] Exemplarily, as shown in FIG. 7C, the embodiment of the present disclosure provides an information processing method, which can include:

[0586] Steps 1-3 can be the same as the embodiment corresponding to FIG. 7A, which will not be repeated here.

[0587] 4. The RAN sends a message directly to the NF, e.g., sends an LPP message protected using a NAS key and the type of LMF to the LMF. Illustratively, the LPP message includes an algorithm identification.

[0588] 5. The NF requests the AMF to generate a key, and the specific key generation request can include a UE ID and an uplink NAS message count; illustratively, the NAS message count can be one of the aforementioned first count values.

[0589] 6. The AMF generates the key, e.g., derives K AMF from K NF .

[0590] 7. The AMF returns the derived key and the algorithm identification of the derivation of the key to the NF.

[0591] 8. The NF derives the key, and the specific derivation of the key can be as per the related steps in the corresponding embodiments of FIG. 7A and / or FIG. 7B.

[0592] Steps 8-10 can be the same as steps 7-10 in the embodiment shown in FIG. 7B.

[0593] In some embodiments, the UE can perform operations including but not limited to at least one of the following:

[0594] The UE should be able to derive K AMF from K NF as the root key to protect NAS signaling between the UE and the NF.

[0595] The UE should be able to include the type of the target NF in the RRC message containing the NAS / NF message sent to the RAN node.

[0596] In some embodiments, the RAN node can perform operations including but not limited to at least one of the following:

[0597] If the RAN node does not store the information of the target NF, the RAN node should be able to forward the protected NAS / NF message received from the UE to the AMF. Illustratively, the target NF is one of the aforementioned second nodes, and the RAN node is one of the aforementioned third nodes. The NAS / NF message is one of the aforementioned first messages. Illustratively, the information of the target NF can include the aforementioned first information. Illustratively, the information of the NF can be included in the UE context. For example, the UE has communicated NAS messages with the NF, and the RAN includes the first information of the NF in the UE context of the UE, etc.

[0598] If the RAN node stores the information of the target NF in the UE context, the RAN node should be able to send the protected NAS / NF message received from the UE directly to the target NF without going through the AMF.

[0599] The RAN node should be able to receive the NAS / NF response message of the target NF through the AMF.

[0600] The RAN node should be able to receive information of the target NF from the AMF.

[0601] The RAN node should be able to receive the NAS / NF response message of the target NF directly.

[0602] In some embodiments, the operations that the AMF can perform can include, but are not limited to, at least one of the following:

[0603] The AMF should be able to receive the protected NAS / NF message of another NF from the RAN node.

[0604] The AMF should be able to select the target NF according to the type of the NAS / NF message or the type of the target NF received from the RAN node.

[0605] After selecting the target NF, the AMF should be able to derive K AMF from K NF .

[0606] The AMF should be able to send the derived K NF to the target NF.

[0607] The AMF should be able to send the identity of the NAS security algorithm negotiated with the UE to the target NF. The identity of the NAS security algorithm can be one of the aforementioned second algorithm identities.

[0608] The AMF should be able to send the information of the RAN node to the target NF.

[0609] The AMF should be able to receive the NAS / NF message response from the target NF.

[0610] The AMF should be able to forward the NAS / NF message response received from the target NF to the RAN node.

[0611] The AMF should be able to display the information of the target NF to the RAN node.

[0612] The AMF should be able to receive the NF receive key request and send the generated K NF and / or the identity of the NAS security algorithm to the NF based on the key request of the NF.

[0613] In some embodiments, the operations that the other NF can perform can include, but are not limited to, at least one of the following:

[0614] The NF must be able to receive the derived K NF from the AMF.

[0615] The NF should be able to receive the identification of the applied NAS security algorithm from the AMF.

[0616] The NF should be able to receive the information of the RAN node from the AMF.

[0617] If the NF does not have the information of the RAN node, the NF can send a NAS / NF message response to the AMF. Exemplarily, the information of the RAN node can include address information, identification information, interface information, or tunnel information of the RAN node, etc., facilitating direct communication between the NF and the RAN.

[0618] If the NF has the information of the RAN node, the NF can send a NAS / NF message response to the RAN node.

[0619] If the NF receives the message of the RAN node, the NF should be able to request the K NF and / or the identification of the NAS security algorithm from the AMF to generate the message verifying the UE forwarded by the RAN node.

[0620] In the embodiments of the present disclosure, part or all of the steps, and optional implementation manners thereof, can be combined with part or all of the steps in other embodiments, or can be combined with optional implementation manners of other embodiments.

[0621] In the embodiments of the present disclosure, part or all of the steps, and optional implementation manners thereof, can be combined with part or all of the steps in other embodiments, or can be combined with optional implementation manners of other embodiments.

[0622] The embodiments of the present disclosure also provide a device for implementing any of the above methods, for example, providing a device, the device comprising units or modules for implementing the steps performed by the UE in any of the above methods. For another example, another device is also provided, comprising units or modules for implementing the steps performed by the network device (for example, an access network device, or a core network device, etc.) in any of the above methods.

[0623] It should be understood that the division of each unit or module in the above apparatus is only a logical function division, and all or part of them can be integrated into a physical entity or physically separated in actual implementation. In addition, the units or modules in the apparatus can be implemented in the form of processor calling software: for example, the apparatus includes a processor connected with a memory, the memory stores instructions, and the processor calls the instructions stored in the memory to implement any of the above methods or realize the functions of each unit or module of the above apparatus, wherein the processor is, for example, a general processor such as a central processing unit (CPU) or a microprocessor, and the memory is a memory in the apparatus or a memory outside the apparatus. Alternatively, the units or modules in the apparatus can be implemented in the form of hardware circuit, and the functions of part or all of the units or modules can be realized by the design of hardware circuit. The above hardware circuit can be understood as one or more processors; for example, in one implementation, the above hardware circuit is an application-specific integrated circuit (ASIC), and the functions of part or all of the above units or modules are realized by the design of the logical relationship of elements in the circuit; for example, in another implementation, the above hardware circuit is a programmable logic device (PLD), and a field programmable gate array (FPGA) is taken as an example, which can include a large number of logic gate circuits, and the connection relationship between the logic gate circuits is configured by a configuration file, so as to realize the functions of part or all of the above units or modules. All units or modules of the above apparatus can be implemented in the form of processor calling software, or all units or modules can be implemented in the form of hardware circuit, or part of the units or modules are implemented in the form of processor calling software, and the remaining part is implemented in the form of hardware circuit.

[0624] In embodiments of the present disclosure, the processor is a circuit with signal processing capability. In one implementation, the processor can be a circuit with instruction reading and running capability, such as a central processing unit (CPU), a microprocessor, a graphics processing unit (GPU) (which can be understood as a microprocessor), a digital signal processor (DSP), etc. In another implementation, the processor can implement certain functions through a logical relationship of hardware circuits, and the logical relationship of the hardware circuits is fixed or reconfigurable. For example, the processor is a hardware circuit implemented by an application-specific integrated circuit (ASIC) or a programmable logic device (PLD), such as an FPGA. In a reconfigurable hardware circuit, the processor loads a configuration document to implement the configuration of the hardware circuit. It can be understood that the processor loads instructions to implement the functions of some or all of the units or modules described above. In addition, the hardware circuit can also be designed for artificial intelligence, which can be understood as an ASIC, such as a neural network processing unit (NPU), a tensor processing unit (TPU), a deep learning processing unit (DPU), etc.

[0625] As shown in FIG. 8A, embodiments of the present disclosure provide a UE, comprising:

[0626] The processing module 7101 is configured to generate a second key according to a first key of a first node; and generate a third key according to the second key, the third key being used to protect the security of communication between the UE and a second node.

[0627] In some embodiments, the UE can further include a sending module and / or a receiving module. For example, the sending module and / or the receiving module can correspond to a network interface and / or a transceiving antenna of the first node.

[0628] In some embodiments, the processing module can be used for the UE to perform information processing related steps in any one of the information processing methods.

[0629] In some embodiments, the sending module can be used for the UE to perform information sending related steps in any one of the information processing methods.

[0630] In some embodiments, the receiving module can be configured to cause the UE to perform the steps related to information sending in any one of the information processing methods.

[0631] In some embodiments, the processing module is configured to generate the second key according to the first key and a type of the second node; or, generate the second key according to the first key and an instance ID of the second node.

[0632] In some embodiments, the processing module is configured to perform at least one of the following: generate the second key according to the first key, a type of the second node, and a first count value; the first count value is a count of uplink messages sent by the UE to the second node; generate the second key according to the first key, a type of the second node, and first time information; the first time information indicates a time period for generating the second key.

[0633] In some embodiments, the processing module is configured to cause the UE to be preconfigured with an instance ID of the second node, and generate the second key according to the first key and the instance ID of the second node.

[0634] In some embodiments, the processing module is configured to perform at least one of the following: generate the second key according to the first key, an instance ID of the second node, and a first count value; the first count value is a count of uplink messages sent by the UE to the second node; generate the second key according to the first key, an instance ID of the second node, and first time information; the first time information indicates a time period for generating the second key.

[0635] In some embodiments, the sending module is configured to send, to a third node, a first radio resource control (RRC) message, the first RRC message comprising a first message; the first message is protected by a third key; and the second node is a receiving node of the first message.

[0636] In some embodiments, the first message comprises at least one of the following: a non-access stratum (NAS) signaling; an ID of the UE; and a first algorithm identifier, the first algorithm identifier being used to identify a security algorithm for protecting the first message.

[0637] In some embodiments, the first RRC message is protected by an access stratum (AS) security context of the UE.

[0638] In some embodiments, the receiving module is configured to receive a second RRC message sent by the third node, the second RRC message comprising a second message; the second message is from the second node; the second message is protected by a fourth key; and the fourth key is generated according to a fifth key, the fifth key being generated according to the first key.

[0639] In some embodiments, the second RRC message is protected by an access stratum (AS) security context of the UE.

[0640] In some embodiments, the first RRC message further comprises at least one of: type information of the second node; instance ID of the second node; address information of the second node.

[0641] As shown in FIG. 8B, the third node of the embodiment of the present disclosure comprises:

[0642] The receiving module 7201 is configured to receive a first message sent by a user equipment (UE), the first message being protected using a third key, the third key being generated by the UE based on a second key, the second key being generated based on a first key of the first node, and the receiving node of the first message being the second node.

[0643] In some embodiments, the third node can further comprise a processing module and / or a sending module.

[0644] In some embodiments, the sending module and / or the receiving module can correspond to a network interface and / or a transceiving antenna of the source node.

[0645] In some embodiments, the processing module can be used by the third node to perform steps related to information processing in any one of the information processing methods.

[0646] In some embodiments, the sending module can be used by the third node to perform steps related to information sending in any one of the information processing methods.

[0647] In some embodiments, the receiving module can be used by the third node to perform steps related to information sending in any one of the information processing methods.

[0648] In some embodiments, the receiving module is configured to receive a first radio resource control (RRC) message sent by the UE, the first RRC message comprising the first message.

[0649] In some embodiments, the first RRC message is protected by an access stratum (AS) security context.

[0650] In some embodiments, the first RRC message further comprises at least one of: type information of the second node; instance ID of the second node; address information of the second node.

[0651] In some embodiments, the sending module is configured to send the first message to the first node or the second node, the third node being a forwarding node of the first message.

[0652] In some embodiments, the sending module is configured to perform at least one of: sending the first message to the first node or the second node according to whether the first message is the first message sent by the UE to the second node; sending the first message to the first node or the second node according to whether the third node obtains the first information of the second node; the first information comprising at least one of an instance ID of the second node and address information of the second node; sending the first message to the first node or the second node according to whether the third node can determine the second node.

[0653] In some embodiments, the sending module is configured to perform at least one of: sending the first message to the first node when the first message is the first message sent by the UE to the second node; sending the first message to the second node when the first message is not the first message sent by the UE to the second node.

[0654] In some embodiments, the sending module is configured to perform at least one of: sending the first message to the second node when the first RRC message comprises the first information of the second node; sending the first message to the second node when the third node has stored the first information of the second node; sending the first message to the first node when the first RRC message does not contain the first information of the second node; sending the first message to the first node when the first node has not stored the first information of the second node.

[0655] In some embodiments, sending the first message to the first node or the second node according to whether the third node can determine the second node comprises at least one of: sending the first message to the second node according to that the first RRC message comprises type information of the second node and configuration information of the third node can determine the second node; sending the first message to the first node according to that the first RRC message comprises type information of the second node and configuration information of the third node cannot determine the second node.

[0656] In some embodiments, the sending module is configured to perform at least one of: determining the type of the second node; sending the first message to the second node of the type to which the third node is connected.

[0657] In some embodiments, the processing module is configured to perform at least one of: determining the type of the second node according to that the first RRC message comprises type information of the second node; determining the type of the second node according to the message type of the first message.

[0658] In some embodiments, the third node sends the first message to the first node; and the sending module is configured to send at least one of type information of the second node and an instance ID of the second node to the first node.

[0659] In some embodiments, the receiving module is configured to receive a second message sent by the first node or the second node, the second message being protected using a third key; the third key being generated by the second node according to the first key; and send, according to the second message, a second RRC message to the UE, the second RRC message including the second message.

[0660] In some embodiments, the receiving module is configured to receive second information of the second node sent by the first node or the second node, the second information including at least one of an instance ID of the second node and address information of the second node.

[0661] In some embodiments, the processing module is configured to interpret the second message to obtain the second information of the second node, the second information including at least one of an instance ID of the second node and address information of the second node.

[0662] In some embodiments, the second RRC message is protected by an access stratum (AS) layer context of the UE.

[0663] In some embodiments, before sending the first message to the second node, the sending module is configured to send a third message to the first node, the third message being used to request the first node to generate a fifth key for the second node; the fifth key being used to generate the fourth key; and the fourth key being used to protect the communication security between the second node and the UE.

[0664] In some embodiments, the receiving module is configured to receive a fourth message sent by the first node; and the sending module is configured to send the first message to the second node if the fourth message indicates that the fifth key has been generated.

[0665] As shown in FIG. 8C, the embodiments of the present disclosure provide a second node, wherein the second node includes: a processing module 7301 configured to generate a fifth key according to a first key of a first node; and a sending module 7302 configured to send the fifth key to the second node, the fifth key being used by the second node to generate a fourth key, the fourth key being used to protect the communication security between the second node and a user equipment (UE).

[0666] In some embodiments, the second node can further include a sending module.

[0667] In some embodiments, the sending module and / or the receiving module can correspond to a network interface and / or a transceiving antenna of the network node.

[0668] In some embodiments, the processing module can be used by the second node to perform steps related to information processing in any one of the information processing methods.

[0669] In some embodiments, the sending module can be used by the second node to perform steps related to information sending in any one of the information processing methods.

[0670] In some embodiments, the receiving module can be configured to receive the first message sent by the second node, and generate the fifth key according to the first key of the first node.

[0671] In some embodiments, the receiving module is configured to receive a third message sent by the third node, and generate the fifth key according to the first key of the first node; the third message is used to request the first node to generate the fifth key for the second node.

[0672] In some embodiments, the receiving module is configured to receive a third message sent by the third node, and generate the fifth key according to the first key of the first node; the third message is used to request the first node to generate the fifth key for the second node.

[0673] In some embodiments, the sending module is configured to send a fourth message to the third node; the fourth message is used for the third node to determine whether the fifth key has been generated.

[0674] In some embodiments, the processing module is configured to receive a fifth message sent by the second node, and generate the fifth key according to the first key of the first node; the fifth message is used for the second node to request the fifth key from the first node.

[0675] In some embodiments, before generating the fifth key according to the first key of the first node, the processing module is configured to determine the second node.

[0676] In some embodiments, the processing module is configured to perform at least one of the following:

[0677] determine the second node according to type information of the second node sent by the third node;

[0678] determine the second node according to an instance identifier of the second node sent by the third node;

[0679] determine the second node according to a message type of the first message forwarded by the third node;

[0680] determine the second node according to information content of the first message forwarded by the third node.

[0681] In some embodiments, the sending module is configured to send the first message to the second node.

[0682] In some embodiments, the processing module is configured to perform at least one of the following: generate the fifth key according to the first key and the type of the second node; generate the fifth key according to the first key and an instance identifier ID of the second node.

[0683] In some embodiments, the processing module is configured to perform at least one of the following: generating the fifth key according to the first key, the type of the second node, and the first count value, wherein the first count value is a count of uplink messages sent by the UE to the second node; or generating the fifth key according to the first key, the type of the second node, and second time information, wherein the second time information indicates a time period for generating the fifth key.

[0684] In some embodiments, the processing module is configured to perform at least one of the following: generating the fifth key according to the first key, the instance ID of the second node, and the first count value, wherein the first count value is a count of uplink messages sent by the UE to the second node; or generating the fifth key according to the first key, the instance ID of the second node, and second time information, wherein the second time information indicates a time period for generating the fifth key.

[0685] In some embodiments, the sending module is configured to send, to the second node, a second algorithm identifier as an input parameter for generating the fourth key, in a case that the first message is sent to the second node.

[0686] In some embodiments, the receiving module is configured to receive a second message sent by the second node, wherein the second message is protected using the fourth key, and wherein the fourth key is generated by the second node according to the fifth key.

[0687] In some embodiments, the sending module is configured to send the second message to a third node.

[0688] In some embodiments, the sending module is configured to send, to the third node, second information, wherein the second information comprises at least one of an instance ID of the second node and address information of the second node.

[0689] As shown in FIG. 8D, the embodiments of the present disclosure provide a second node, which comprises:

[0690] The receiving module 7401 is configured to receive a fifth key sent by a first node, wherein the fifth key is generated according to a first key of the first node;

[0691] The processing module 7402 is configured to generate a fourth key according to the fifth key, wherein the fourth key is used to protect security of communication between the second node and a user equipment (UE).

[0692] In some embodiments, the second node can further comprise a sending module.

[0693] In some embodiments, the sending module and / or the receiving module can correspond to a network interface and / or a transceiving antenna of the second node.

[0694] In some embodiments, the processing module can be used by the second node to perform steps related to information processing in any one of the information processing methods.

[0695] In some embodiments, the sending module can be configured to enable the second node to perform the steps related to information sending in any one of the information processing methods.

[0696] In some embodiments, the receiving module can be configured to enable the second node to perform the steps related to information sending in any one of the information processing methods.

[0697] In some embodiments, the receiving module is further configured to receive a first message sent by the first node or the third node; the first message is protected by a third key; the third key is generated according to the second key; the second key is generated according to the first key; and the processing module is configured to verify the security of the first message using a fourth key.

[0698] In some embodiments, the receiving module is configured to receive a second algorithm identifier sent by the first node, the second algorithm identifier being used as an input parameter for generating the fourth key; or receive a first algorithm identifier in the first message forwarded by the third node, the first algorithm identifier being used to indicate a security algorithm of the fourth key.

[0699] In some embodiments, the sending module is configured to send a second message to the first node or the third node, the second message being protected using the fourth key.

[0700] In some embodiments, the receiving module is configured to receive the first message forwarded by the third node, and send a fifth message to the first node; the fifth message is used by the second node to request a fifth key from the first node.

[0701] The embodiments of the present disclosure further provide a communication device, which can include one or more processors; wherein the processor is configured to invoke instructions to enable the communication device to perform the information processing method implemented by any one of the preceding embodiments.

[0702] In some embodiments, as shown in FIG. 9A and / or FIG. 9B, the communication device 8100 further includes one or more memories 8102 configured to store instructions. Alternatively, all or part of the memory 8102 can also be located outside the communication device 8100.

[0703] The communication device can be the UE and the network device described above. In some embodiments, the network device can be the master node and / or the secondary node.

[0704] In some embodiments, the communication device 8100 further includes one or more transceivers 8103. When the communication device 8100 includes one or more transceivers 8103, the communication steps such as sending and receiving in the above method are performed by the transceiver 8103, and the other steps are performed by the processor 8101.

[0705] In some embodiments, the transceiver can include a receiver and a transmitter, which can be separate or integrated together. Optionally, the terms transceiver, transceiving unit, transceiver, transceiving circuit, etc. can be replaced by each other, the terms transmitter, transmitting unit, transmitter, transmitting circuit, etc. can be replaced by each other, and the terms receiver, receiving unit, receiver, receiving circuit, etc. can be replaced by each other.

[0706] Optionally, the communication device 8100 further includes one or more interface circuits 8104 connected with the memory 8102, which can be used to receive signals from the memory 8102 or other devices, and can be used to send signals to the memory 8102 or other devices. For example, the interface circuit 8104 can read the instructions stored in the memory 8102 and send the instructions to the processor 8101.

[0707] The communication device 8100 described in the above embodiments can be a network device or a UE, but the scope of the communication device 8100 described in the present disclosure is not limited to this, and the structure of the communication device 8100 can not be limited by Figure 9A. The communication device can be a standalone device or can be part of a larger device. For example, the communication device can be: (1) a standalone integrated circuit (IC), or a chip, or a chip system or subsystem; (2) a set of one or more ICs, which can optionally also include storage components for storing data, programs; (3) an ASIC, such as a modem; (4) a module that can be embedded in other devices; (5) a receiver, UE device, smart UE device, cellular phone, wireless device, handset, mobile unit, vehicle-mounted device, network device, cloud device, artificial intelligence device, etc.; (6) other, etc.

[0708] Figure 9B is a structural schematic diagram of a chip 8200 according to an embodiment of the present disclosure. For the case where the communication device 8100 is a chip or a chip system, the structural schematic diagram of the chip 8200 shown in Figure 9B can be referred to, but is not limited thereto.

[0709] The chip 8200 includes one or more processors 8201 for invoking instructions to cause the chip 8200 to perform any of the above information processing methods.

[0710] In some embodiments, chip 8200 further includes one or more interface circuits 8202 that are wired to memory 8203, which can be used to receive signals from or send signals to memory 8203 or other devices. For example, interface circuit 8202 can read instructions stored in memory 8203 and send those instructions to processor 8201. Alternately, the terms interface circuit, interface, transceiver pin, transceiver, and the like can be used interchangeably.

[0711] In some embodiments, chip 8200 further includes one or more memories 8203 for storing instructions. Alternately, all or part of memory 8203 can be external to chip 8200.

[0712] The present disclosure also provides a storage medium having stored thereon instructions which, when executed by a communication device 8100, cause communication device 8100 to perform any of the above methods. Alternately, the storage medium is an electronic storage medium. Alternately, the storage medium is a computer-readable storage medium, but can also be a storage medium readable by other devices. Alternately, the storage medium can be a non-transitory storage medium, but can also be a transitory storage medium.

[0713] The present disclosure also provides a program product which, when executed by a communication device 8100, causes communication device 8100 to perform any of the above information processing methods. Alternately, the program product is a computer program product.

[0714] The present disclosure also provides a computer program which, when executed on a computer, causes the computer to perform any of the above information processing methods.

[0715] Other embodiments of the present disclosure will be apparent to those skilled in the art from consideration of the specification and practice of the features disclosed herein. The present disclosure is intended to cover any variations, uses or adaptations of the present disclosure following, in general, the principles of the present disclosure and including such features that are evident to those skilled in the art. The specification and examples given are intended as illustrative only and not in a limiting sense. For the avoidance of doubt, the scope of the present disclosure is measured by the claims that follow.

[0716] It is understood that the present disclosure is not limited to the precise structures herein described and illustrated in the drawings, and that various modifications and changes can be made therein without departing from the scope thereof. The scope of the present disclosure is indicated by the appended claims.

Claims

1. An information processing method, wherein, The method is performed by a user equipment (UE), and comprises: generating a second key according to a first key of a first node; generating a third key according to the second key; the third key is used to protect security of communication between the UE and a second node.

2. The method of claim 1, wherein, The generating the second key according to the first key of the first node comprises at least one of: generating the second key according to the first key and a type of the second node; generating the second key according to the first key and an instance identification (ID) of the second node.

3. The method of claim 2, wherein, The generating the second key according to the first key and the type of the second node comprises at least one of: generating the second key according to the first key, the type of the second node, and a first count value; the first count value is a count of uplink messages sent by the UE to the second node; generating the second key according to the first key, the type of the second node, and first time information; the first time information indicates a time period of generating the second key. The generating the second key according to the first key and the instance ID of the second node comprises:

4. The method of claim 2, wherein, The UE is preconfigured with the instance ID of the second node, and the second key is generated according to the first key and the instance ID of the second node. The generating the second key according to the first key and the instance ID of the second node comprises at least one of:

5. The method of claim 2 or 4, wherein, generating the second key according to the first key, the instance ID of the second node, and a first count value; the first count value is a count of uplink messages sent by the UE to the second node; generating the second key according to the first key, the instance ID of the second node, and first time information; the first time information indicates a time period of generating the second key. The method further comprises:

6. The method of claim 1, wherein, sending a first radio resource control (RRC) message to a third node, the first RRC message comprising a first message; the first message is protected by the third key; the second node is a receiving node of the first message. The first message comprises at least one of:

7. The method of claim 6, wherein, non-access stratum (NAS) signaling; an ID of the UE; a first algorithm identification, the first algorithm identification being used to identify a security algorithm used to protect the first message. The first RRC message is protected by an access stratum (AS) security context of the UE.

8. The method of claim 7, wherein, The method further comprises:

9. The method of claim 7 or 8, wherein, receiving a second RRC message sent by the third node, the second RRC message comprising a second message; the second message is from the second node; the second message is protected by a fourth key; the fourth key is generated according to a fifth key, and the fifth key is generated according to the first key. The second RRC message is protected by the AS security context of the UE.

10. The method of claim 9, wherein, The first RRC message further comprises at least one of:

11. The method according to any one of claims 7 to 10, wherein, type information of the second node; an instance ID of the second node; address information of the second node. The method is performed by a third node, and comprises:

12. An information processing method, wherein, ​ receiving a first message sent by a user equipment (UE), the first message being protected using a third key, the third key being generated by the UE based on a second key, the second key being generated based on a first key of a first node, a receiving node of the first message being a second node.

13. The method of claim 12, wherein, The receiving a first message sent by a user equipment (UE) comprises: receiving a first radio resource control (RRC) message sent by the UE, the first RRC message comprising the first message.

14. The method of claim 13, wherein, The first RRC message is protected by an access stratum (AS) security context.

15. The method of claim 13 or 14, wherein, The first RRC message further comprises at least one of: type information of the second node; an instance ID of the second node; address information of the second node.

16. The method according to any one of claims 13 to 15, wherein, The method further comprises: sending the first message to the first node or the second node, the third node being a forwarding node of the first message.

17. The method of claim 16, wherein, The sending the first message to the first node or the second node comprises at least one of: sending the first message to the first node or the second node according to whether the first message is a first message sent by the UE to the second node; sending the first message to the first node or the second node according to whether the third node has obtained first information of the second node, the first information comprising at least one of an instance ID of the second node and address information of the second node; sending the first message to the first node or the second node according to whether the third node can determine the second node.

18. The method of claim 17, wherein, The sending the first message to the first node or the second node according to whether the first message is a first message sent by the UE to the second node comprises at least one of: sending the first message to the first node if the first message is a first message sent by the UE to the second node; sending the first message to the second node if the first message is not a first message sent by the UE to the second node.

19. The method of claim 17, wherein, The sending the first message to the first node or the second node according to whether the third node has obtained first information of the second node comprises at least one of: sending the first message to the second node if the first RRC message comprises the first information of the second node; sending the first message to the second node if the third node has stored the first information of the second node; sending the first message to the first node if the first RRC message does not comprise the first information of the second node; sending the first message to the first node if the first node has not stored the first information of the second node.

20. The method of claim 16, wherein, The sending the first message to the first node or the second node according to whether the third node can determine the second node comprises at least one of: sending the first message to the second node if the first RRC message comprises type information of the second node and configuration information of the third node can determine the second node; The first message is sent to the first node or the second node according to the type of the second node.

21. The method of claim 16, wherein, The first message is sent to the first node or the second node according to the type of the second node. The type of the second node is determined according to the type information of the second node included in the first RRC message. The type of the second node is determined according to the type information of the second node included in the first RRC message.

22. The method of claim 21, wherein, The type of the second node is determined according to the type information of the second node included in the first RRC message. The first message is sent to the first node or the second node according to the type of the second node. The method further comprises:

23. The method of any one of claims 16 to 20, wherein, The second message is received from the first node or the second node, and the second message is protected by a third key; the third key is generated by the second node based on the first key.

24. The method of any one of claims 16 to 23, wherein, The second RRC message is sent to the UE according to the second message, and the second RRC message includes the second message. The method further comprises: The second information of the second node is received from the first node or the second node, and the second information includes at least one of an instance ID of the second node and address information of the second node.

25. The method of claim 24, wherein, The method further comprises: The second information of the second node is obtained by interpreting the second message, and the second information includes at least one of an instance ID of the second node and address information of the second node.

26. The method of claim 24, wherein, The second RRC message is protected by an access stratum (AS) layer context of the UE. Before the first message is sent to the second node, the method further comprises: sending a third message to the first node, the third message being used to request the first node to generate a fifth key for the second node; the fifth key being used to generate a fourth key; the fourth key being used to protect the security of communication between the second node and the UE.

27. The method of any one of claims 24 to 26, wherein, The method further comprises:

28. The method of any one of claims 12 to 16, wherein, The fourth message is received from the first node.

29. The method of claim 28, wherein, The first message is sent to the second node according to the indication of the fifth key being generated in the fourth message. The method is performed by a first node, and the method comprises: A fifth key is generated based on a first key of the first node. The fifth key is sent to a second node, and the fifth key is used by the second node to generate a fourth key, and the fourth key is used to protect the security of communication between the second node and a user equipment (UE).

30. An information processing method, wherein, The fifth key is generated based on the first key of the first node, and the method comprises: A first message is received from a third node, and a fifth key is generated based on a first key of the first node; the first message is protected by a third key; the third key is generated based on a second key; and the second key is generated based on the first key of the first node. The method further comprises:

31. The method of claim 30, wherein, ​ ​ 32. The method of claim 30, wherein, ​ receiving a third message sent by a third node, and generating a fifth key according to a first key of the first node; the third message is used for requesting the first node to generate the fifth key for the second node.

33. The method of claim 32, wherein, The method further includes: sending a fourth message to the third node; the fourth message is used for the third node to determine whether the fifth key has been generated.

34. The method of claim 30, wherein, The generating of the fifth key according to the first key of the first node includes: receiving a fifth message sent by a second node, and generating a fifth key according to a first key of the first node; the fifth message is used for the second node to request the first node for the fifth key.

35. The method of any one of claims 30 to 34, wherein, Before the generating of the fifth key according to the first key of the first node, the method further includes: determining the second node.

36. The method of claim 35, wherein, The determining of the second node includes at least one of: determining the second node according to type information of the second node sent by the third node; determining the second node according to an instance identifier of the second node sent by the third node; determining the second node according to a message type of the first message forwarded by the third node; determining the second node according to information content of the first message forwarded by the third node.

37. The method of claim 31, wherein, The method further includes: sending the first message to the second node.

38. The method of any one of claims 30 to 37, wherein, The generating of the fifth key according to the first key includes at least one of: generating the fifth key according to the first key and a type of the second node; generating the fifth key according to the first key and an instance identifier ID of the second node.

39. The method of claim 30, wherein, The generating of the fifth key according to the first key and the type of the second node includes at least one of: generating the fifth key according to the first key, the type of the second node and a first count value; the first count value is a count of uplink messages sent by the UE to the second node; generating the fifth key according to the first key, the type of the second node and second time information; the second time information indicates a time period of the generation of the fifth key.

40. The method of claim 30, wherein, The generating of the fifth key according to the first key and the instance identifier ID of the second node includes at least one of: generating the fifth key according to the first key, the instance ID of the second node and a first count value; the first count value is a count of uplink messages sent by the UE to the second node; generating the fifth key according to the first key, the instance ID of the second node and second time information; the second time information indicates a time period of the generation of the fifth key. The method further includes:

41. The method of any one of claims 30 to 40, wherein, in the case of sending the first message to the second node, sending a second algorithm identifier to the second node, the second algorithm identifier being an input parameter for generating the fourth key. The method further includes:

42. The method of claim 31, wherein, receiving a second message sent by the second node, the second message being protected by a fourth key; the fourth key is generated by the second node according to the fifth key. The method further includes:

43. The method of claim 42, wherein, sending the second message to the third node. The method further includes:

44. The method of any one of claims 31 to 43, wherein, ​ sending second information to the third node, the second information comprising at least one of an instance ID of the second node and address information of the second node.

45. An information processing method, wherein, The method is performed by the second node, and the method comprises: receiving a fifth key sent by the first node; the fifth key is generated according to a first key of the first node; generating a fourth key according to the fifth key; the fourth key is used to protect security of communication between the second node and a user equipment (UE).

46. The method of claim 45, wherein, The method further comprises: receiving a first message sent by the first node or the third node; the first message is protected by a third key; the third key is generated according to a second key; the second key is generated according to the first key; verifying security of the first message using the fourth key.

47. The method of claim 45 or 46, wherein, The method further comprises: receiving a second algorithm identification sent by the first node, the second algorithm identification being an input parameter for generating the fourth key; or receiving a first algorithm identification in the first message forwarded by the third node, the first algorithm identification being an input parameter for generating the fourth key.

48. The method of claim 46 or 47, wherein, The method further comprises: sending a second message to the first node or the third node, the second message being protected using the fourth key.

49. The method of any one of claims 45 to 47, wherein, The method further comprises: receiving the first message forwarded by the third node, and sending a fifth message to the first node; the fifth message is used for the second node to request the fifth key from the first node.

50. A user equipment (UE), comprising: The UE comprises: a processing module configured to generate a second key according to a first key of a first node; generate a third key according to the second key; the third key is used to protect security of communication between the UE and a second node.

51. A third node, wherein, The third node comprises: a receiving module configured to receive a first message sent by a user equipment (UE), the first message being protected using a third key; the third key is generated by the UE based on a second key, the second key being generated based on a first key of a first node; a receiving node of the first message is the second node.

52. A first node, wherein, The first node comprises: a processing module configured to generate a fifth key according to a first key of the first node; a sending module configured to send the fifth key to a second node, the fifth key being used by the second node to generate a fourth key, the fourth key being used to protect security of communication between the second node and a user equipment (UE).

53. A second node, wherein, The second node comprises: a receiving module configured to receive a fifth key sent by a first node; the fifth key is generated according to a first key of the first node; a processing module configured to generate a fourth key according to the fifth key; the fourth key is used to protect security of communication between the second node and a user equipment (UE).

54. A communication system, wherein, The communication system comprises a user equipment (UE), a first node, a second node and a third node; the UE is configured to perform the method of any one of claims 1 to 11; the third node is configured to perform the method of any one of claims 12 to 29; the first node is configured to perform the method of any one of claims 30 to 44; The second node is configured to perform the method of any one of claims 45-49.

55. A communications device, comprising: The communication device comprises: one or more processors; wherein the processor is configured to invoke instructions to cause the communication device to perform the information processing method of any one of claims 1-11, 12-29, 30-44, or 45-49.

56. A storage medium, wherein, The storage medium stores instructions that, when executed on the communication device, cause the communication device to perform the information processing method of any one of claims 1-11, 12-29, 30-44, or 45-49.

57. A program product, wherein, The program product comprises a computer program that, when executed by a communication device, causes the communication device to implement the information processing method of any one of claims 1-11, 12-29, 30-44, or 45-49.

Images