Communication method and related device

Abstract

A communication method and a related device are applied to the technical field of communication. In the application, the SDU is divided into N SDU segments, and the second SDU segment in the N SDU segments is re-segmented to form M SDU segments. A first node can generate a first PDU, the first PDU carries a first SDU segment in M SDU segments, and security protection is performed on the first PDU by using a target identifier corresponding to the first SDU segment. Wherein the target identifier corresponding to the first SDU segment is different from the target identifiers corresponding to the N SDU segments. According to the method and the device, independent security protection can be carried out on the PDU where the SDU segment is located by using the target identifier corresponding to the SDU segment, and for the newly formed SDU segment, the target identifier corresponding to the newly formed SDU segment is designed to be different from the previously generated target identifier, so that the security of data transmission can be improved, and the security performance of the node is improved.

Description

Technical Field

[0001] This application relates to the field of communication technology, and in particular to a communication method and related apparatus. Background Technology

[0002] With the rapid development of the mobile internet, our tools are more convenient to use than traditional computers, especially desktop workstations and servers. However, this has also created greater information threats, and communication security has gradually become a key issue in communication scenarios.

[0003] In communication networks, most networks use a hierarchical network architecture, meaning that communicating nodes comprise multiple protocol layers. The basic unit for exchanging data between entities operating at the same protocol layer is called a protocol data unit (PDU). Within multiple protocol layers, lower-layer protocols provide services to upper-layer protocols, and the upper-layer PDU becomes the lower-layer service data unit (SDU). For security reasons, some protocol layers implement security protections for their SDUs to prevent data leakage.

[0004] As application scenarios become increasingly complex, the data volume of the local SDU (i.e., the upper-layer PDU) may be quite large. Some nodes support segmenting the local SDU to form multiple SDU segments. Ensuring the security of SDU transmission when the SDU is segmented is a pressing issue that needs to be addressed in this field. Summary of the Invention

[0005] This application provides a communication method and related apparatus. This application utilizes the target identifier corresponding to the SDU segment to independently protect each PDU. For newly formed SDU segments, the target identifier corresponding to them is designed to be different from the previously generated target identifier, which can improve the security of data transmission and enhance the security performance of the node.

[0006] Firstly, this application provides a communication method that can be executed by a node with computing capabilities or a component (such as a chip or module) within a node with computing capabilities. The following description uses the first node as the executing entity of this method as an example; however, in actual implementation, the name of the executing entity can be designed in other ways.

[0007] The communication method includes: generating a first PDU, and using target identifiers corresponding to the first SDU segments to perform security protection on the first PDU. The first PDU includes a first SDU segment, which is one of M SDU segments obtained by segmenting a second SDU segment, where M is an integer and M≥2. The second SDU segment includes at least one of N SDU segments obtained by segmenting the SDU, where N is a positive integer. Each of the N SDU segments corresponds to N target identifiers, and these N target identifiers are used to perform security protection on the PDUs corresponding to the N SDU segments. The target identifier corresponding to the first SDU segment is different from all of the aforementioned N target identifiers.

[0008] In this application, during the process of assembling the current layer's SDU (i.e., the upper layer's PDU, also known as the initial SDU) into the current layer's PDU, the SDU can be segmented into N SDU segments, which are then carried in N PDUs. Each of the N SDU segments corresponds to N target identifiers. Each PDU independently performs security protection using the target identifiers corresponding to its own included SDU segments, resulting in each of the N PDUs using different parameters for security protection.

[0009] During transmission, existing SDU segments may be further segmented to form new SDU segments. When new SDU segments are generated, they are also assembled into PDUs. If the target identifiers of these new SDU segments are identical (i.e., the same parameters are used to protect different data content), it will affect the security of data transmission. In this application, the target identifier of the newly formed SDU segment is designed to be different from the N previously generated target identifiers. This allows nodes to use different parameters to protect different data content, thereby improving the security of data transmission and enhancing the security performance of the node.

[0010] Furthermore, this application employs a target identifier corresponding to each SDU segment to independently protect each PDU during security protection. For the sender, independent security protection on a PDU-by-PDU basis allows for a pipelined security protection process, reducing memory footprint and lowering memory pressure. Consequently, the receiver can independently check the security of each PDU without having to perform an overall security check after reassembling the complete SDU. This reduces the receiver's memory pressure and improves communication efficiency while ensuring data transmission security.

[0011] In some cases, the communication method of this application can be applied to wireless communication systems, including short-range wireless communication systems, such as the StarScan communication system. In the StarScan communication system, devices are called nodes, and nodes have master-slave roles, such as management nodes and terminal nodes. A management node can connect to one or more terminal nodes. The management node can send data scheduling information, while the terminal nodes receive the data scheduling information and send data according to the data scheduling information. The first node can be a management node, a terminal node, or both (which can be understood as a dual-identity node).

[0012] In the StarSpark communication system, the management node supports connecting to multiple terminal nodes, and the terminal nodes also support associating with multiple management nodes. This means that both terminal nodes and management nodes support communication with multiple nodes, necessitating careful management of node memory usage to prevent node crashes. This application supports independent security protection for each PDU based on the target identifier corresponding to the SDU segment. This reduces the memory pressure on nodes in the StarSpark communication system and improves communication efficiency while ensuring data transmission security.

[0013] In some cases, the communication method of this application is applied to one layer of the communication protocol stack, such as the target layer. This target layer enables secure protection of the transmitted information. It should be understood that the name of the target layer may differ in different protocol stack architectures. For example, in one communication system, the target layer may be the link control layer, which enables secure information protection. Taking a protocol stack architecture of the StarSpark communication system as an example, the link control layer can provide data transmission services to the upper layers. Its main functions include: segmenting and reassembling the SDUs of this layer (if configured), segmenting the SDUs of this layer (if configured), link management functions, and security protection.

[0014] Understandably, the layer above the target layer may differ in different protocol stack architectures. In one exemplary protocol stack architecture, the layer above the target layer is the network and transport layer; or, in other protocol stack architectures, the layer above the target layer is the transport layer. Further, this protocol stack architecture, from top to bottom, consists of: the application layer, the network and transport layer, the data link layer (including the link control layer and the media access layer), and the physical layer.

[0015] In one possible implementation of the first aspect, security protection includes one or more of the following: confidentiality protection (i.e., encryption), integrity protection, and authentication encryption. For example, this application can be applied to point-to-point communication scenarios, where the node encrypts the PDU when both parties to the communication have enabled encryption. Alternatively, the node can perform integrity protection on the PDU when both parties to the communication have enabled integrity protection. Another example is that the node encrypts and protects the PDU when both parties to the communication have enabled both encryption and integrity protection. Yet another example is that the node performs authentication encryption on the PDU when both parties to the communication have enabled authentication encryption.

[0016] In yet another possible implementation of the first aspect, the method further includes: sending a securely protected first PDU to the second node. This step can be performed after the first PDU has been securely protected using a target identifier corresponding to a segment of the first PDU.

[0017] Accordingly, the second node can receive the first PDU, which has been secured.

[0018] In another possible implementation of the first aspect, the target identifier corresponding to the first SDU segment is different from all N target identifiers, including: the target identifier corresponding to the first SDU segment is increased by 1 based on the N target identifiers.

[0019] In another possible implementation of the first aspect, the target identifier corresponding to the first SDU segment is different from the target identifiers corresponding to the SDU segments other than the first SDU segment among the M SDU segments.

[0020] In other words, when segmenting existing SDU segments, the target identifiers for the newly generated SDU segments are all different. Thus, each PDU (including PDUs carrying retransmission data) can use different parameters for security protection, further enhancing data transmission security and improving the node's security performance.

[0021] In another possible implementation of the first aspect, the target identifier of the new SDU segment obtained by re-segmenting the second SDU segment is not duplicated with the existing target identifier. That is, when segmenting an existing SDU, the target identifier corresponding to the newly generated SDU segment is different from the previous target identifier. In this way, each PDU can use different parameters for security protection, further improving the security of data transmission and enhancing the security performance of the node.

[0022] In another possible implementation of the first aspect, the target identifier corresponding to the first SDU segment is different from the target identifiers corresponding to the other SDU segments among the M SDU segments, except for the first SDU segment. This includes: among the M SDU segments, for SDU segments that are not the first one, the target identifier of each SDU segment is increased by 1 based on the target identifier of the previous SDU segment in the segment order.

[0023] By adding 1 to the base value, the target identifier can be updated easily and conveniently, reducing the computational load on the nodes.

[0024] In another possible implementation of the first aspect, the target identifier includes a PDU sequence number, which indicates the sequence number of the SDU segment carried by the PDU. It should be understood that the naming of parameters, fields, data, messages, etc., in this application is merely illustrative, and the names can be replaced in specific implementations. For example, the PDU sequence number may also be called the SDU segment sequence number, or simply the segment sequence number.

[0025] In another possible implementation of the first aspect, the PDU sequence number occupies K bits, where K is an integer and 0 < K ≤ 10. During security protection, the first node needs to process the data to be protected using a security algorithm. This processing also requires other parameters, such as a key and a freshness parameter. The key is usually predefined or pre-calculated, and the PDU sequence number serves as either a freshness parameter or a part of it. In the latter case (the PDU sequence number as part of the freshness parameter), since the length of the freshness parameter is limited and some fields are already occupied, the data length of the PDU sequence number should not be set too long. In the above implementation, the number of bits occupied by the PDU sequence number is between 0 and 10 bits, which satisfies the need to distinguish multiple segments, and the length is more suitable.

[0026] For example, K = 8. Since the number of SDU segments is usually not too large, an 8-bit length is appropriate, which can meet the requirements for distinguishing SDU segments, while further reducing the impact on PDU format.

[0027] For another example, K=4. Since the number of SDU segments is usually no more than 16 segments, a length of 4 bits is appropriate and can meet the need to distinguish SDU segments in some cases.

[0028] In another possible implementation of the first aspect, the first PDU includes a target identifier for the first PDU. For example, the first PDU carries a PDU sequence number. This PDU sequence number corresponds to an SDU segment carried by the first PDU, and further, the two correspond one-to-one.

[0029] In some schemes, the SDU may not be segmented, in which case the PDU carries a complete SDU. To ensure consistent PDU format, the PDU can also carry a PDU sequence number in this case, but the value of the PDU sequence number is set to a preset value. That is, when the PDU carries a complete SDU, the PDU sequence number carried in the PDU is a preset value. For example, the preset value is 0.

[0030] In another possible implementation of the first aspect, the PDU sequence number of the first PDU is carried in the 6th byte of the first PDU.

[0031] Furthermore, the PDU sequence number is carried in the 6th byte of each PDU, and the PDU sequence number carried in the PDU corresponds to the corresponding SDU segment carried in the PDU. In some schemes, the fields carried in the first 5 bytes of the PDU are predefined, and the number of bits (and bytes) occupied have been reasonably allocated, while the 4th and 5th bytes carry the segment offset value (or part of the segment offset value). Carrying the PDU sequence number in the 6th byte of the PDU allows fields with similar meanings to be placed in adjacent positions, which is convenient for retrieval and does not affect the normal indication of other fields.

[0032] In another possible implementation of the first aspect, the target identifier includes a segment offset value and a segment data length. The segment offset value indicates the position of the first byte of the SDU segment within the SDU, and the segment data length indicates the data length of the SDU segment.

[0033] The above implementation utilizes the combination of the position of the first byte of an SDU segment and the segment data length to participate in the security protection process of SDU segments. After the SDU is segmented, the position of the first byte of each SDU segment is different, so multiple SDU segments correspond to different target identifiers. When an existing SDU segment is segmented again, the position of the first byte of the first SDU segment after the re-segmentation is the same as the position of the first byte of the segmented SDU segment, but the segment data lengths are different. Therefore, the above implementation ensures that when new SDU segments are generated, the target identifier corresponding to each SDU segment is also different, allowing each PDU to use different parameters for security protection, further improving the security of data transmission and enhancing the security performance of the node.

[0034] Alternatively, the unit "byte" used in the aforementioned segment offset value can be replaced with other data units, such as bits, or "two bytes," etc. That is, the position of the first byte can also be replaced with the position of the first bit, or the position of each two-byte unit in the initial SDU.

[0035] In some possible implementations, when SDU segments are retransmitted, existing SDU segments may be re-segmented.

[0036] In another possible implementation of the first aspect, the target identifier includes a segment offset value and a retransmission count. The segment offset value indicates the position of the first byte of the SDU segment within the SDU, and the retransmission count indicates the number of times the content of the SDU segment has been retransmitted.

[0037] In the above implementation, the segment offset value and the number of retransmissions are used together in the security protection process of SDU segments. This ensures that when the content of the SDU segment is retransmitted each time, the target identifier corresponding to the new SDU segment is different from the target identifier corresponding to the previously transmitted SDU segment. This allows each PDU to use different parameters during security protection, further improving the security of data transmission and enhancing the security performance of the node.

[0038] In another possible implementation of the first aspect, the target identifier includes a PDU sequence number and a retransmission count. The PDU sequence number indicates the sequence number of the SDU segment, and the retransmission count indicates the number of times the content of the SDU segment has been retransmitted.

[0039] In the above implementation, the PDU segment sequence number and the number of retransmissions are combined in the security protection process of the SDU segment. This ensures that each time the content of the SDU segment is retransmitted, the target identifier corresponding to the new SDU segment is different from the target identifier corresponding to the previously transmitted SDU segment. This allows each PDU to use different parameters during security protection, further improving the security of data transmission and enhancing the security performance of the node.

[0040] Optionally, the number of retransmissions occupies Q bits, where Q is an integer and 0 < Q ≤ 8. That is, the bit depth of the number of retransmissions is Q bits.

[0041] In another possible implementation of the first aspect, the first PDU further includes one or more of the following: the PDU sequence number of the first SDU segment, the segment offset value of the first SDU segment, and the number of retransmissions of the first SDU segment included in the first PDU.

[0042] That is, the first PDU carries the target identifier, or a part of the target identifier. For example, if the first PDU carries a part of the target identifier, the other part of the target identifier can be recorded locally on the node and is not carried in the first PDU.

[0043] In another possible implementation of the first aspect, the first PDU is secured using the target identifier corresponding to the first SDU segment, including: securing the first PDU using the target identifier corresponding to the first SDU segment and the global frame number (GFN), wherein the GFN is associated with the SDU. Here, the GFN is a parameter maintained by the node to record updates to the transmission unit number; it is generally maintained locally by the node and updated as the transmission unit number is updated.

[0044] In another possible implementation of the first aspect, the GFN comprises two parts: a predefined value and a transmission unit sequence number. For example, in the StarFlash communication system, for the first type of service, the GFN is 32 bits, with the high 14 bits being the hyperframe number (HFN) and the low 18 bits being the link control layer sequence number (SN). For the second type of service, the GFN is 32 bits, including the HFN (10 bits), the physical layer superframe number (16 bits), and the radio frame sequence number (6 bits). The HFN is the predefined value and does not need to be transmitted; it is typically maintained locally at the node. The link control layer sequence number, physical layer superframe number, and radio frame sequence number are carried in the transmission unit and transmitted to the receiver.

[0045] In another possible implementation of the first aspect, security protection is achieved through a corresponding security algorithm. The inputs to the security algorithm include the information to be protected, the key, and a freshness parameter. The target identifier corresponding to the SDU segment can be used as part of the freshness parameter and input into the security algorithm to achieve security protection for the PDU. Similarly, the GFN is also used as another part of the freshness parameter and input into the security algorithm.

[0046] In other words, the first node can provide security protection for the PDU based on freshness parameters and a key. Freshness parameters include the target identifier corresponding to the SDU segment, and may further include the GFN. Optionally, freshness parameters may also include other parameters.

[0047] In another possible implementation of the first aspect, the inputs to the security algorithm can differ in unicast and multicast scenarios. Taking encryption / decryption as an example, in a unicast scenario, the key used by the encryption algorithm is a unicast encryption key, such as the signaling plane encryption key Ks.enc in signaling plane encryption and the user plane encryption key Ku.enc in user plane encryption. The freshness parameters include GFN, a 1-bit link direction identifier, a 5-bit logical channel identifier, an 8-bit target identifier, and a 2-bit reserved field. The link direction identifier is 1 bit, taking the first value (e.g., 0) for T-links and the second value (e.g., 1) for G-links. When no segmentation is performed, the 4-bit segmentation identifier should be set to 0. The reserved field is 6 bits and can optionally be all 0. Of course, this description assumes the target identifier occupies 8 bits; in actual implementation, the target identifier can occupy other bit counts. For example, the freshness parameters may include GFN, a 1-bit link direction identifier, a 5-bit logical channel identifier, a 4-bit target identifier, and a 6-bit reserved field.

[0048] In multicast scenarios, the encryption algorithm uses a multicast encryption key, such as GKs.enc for signaling plane encryption and GKu.enc for user plane encryption. The freshness parameters include the group global frame number (GGFN), a 1-bit G-link identifier, a 5-bit logical channel identifier, an 8-bit target identifier (number of bits is for example only), and a 6-bit reserved field (optional, number of bits is for example only). The G-link identifier is 1 bit, set to the second value, indicating a G-link.

[0049] Alternatively, the encryption algorithm used in unicast scenarios may differ from that used in multicast scenarios. Of course, this application also applies to cases where both are the same.

[0050] The implementation methods of encryption, integrity protection, and authentication encryption are described below.

[0051] In another possible implementation of the first aspect, the first PDU is protected by using the target identifier and GFN corresponding to the first SDU segment, including: encrypting the first PDU based on the target identifier, GFN and encryption key corresponding to the first SDU segment.

[0052] In another possible implementation of the first aspect, the first PDU is secured using the target identifier and GFN corresponding to the first SDU segment, including: generating a check code based on the target identifier, GFN, integrity protection key, and information contained in the first PDU segment. The check code is carried in the first PDU and is used to check the integrity of the information contained in the first PDU.

[0053] In another possible implementation of the first aspect, the first PDU is secured using the target identifier and GFN corresponding to the first SDU segment, including: encrypting the first PDU based on the target identifier, GFN, authentication encryption key, and information contained in the PDU segment to obtain a check code. The check code is carried in the first PDU and is used to check the integrity of the information contained in the first PDU.

[0054] In another possible implementation of the first aspect, the first PDU also carries a segmentation indicator. The segmentation indicator is used to indicate whether the SDU segment contained in the first PDU belongs to the first segment, an intermediate segment, or the last segment.

[0055] Secondly, this application provides a communication method that can be executed by a node with computing capabilities or a component (such as a chip or module) within a node with computing capabilities. The following description uses a second node as the executing entity of this method; however, in actual implementation, the executing entity can be any other name.

[0056] The communication method includes: receiving a first PDU from a first node, and checking the security of the first PDU using the target identifier corresponding to the first SDU segment. The first PDU includes a first SDU segment, which is one of M SDU segments obtained by segmenting a second SDU segment, where M is an integer and M≥2. The second SDU segment includes at least one of N SDU segments, where N is a positive integer. Each of the N SDU segments corresponds to one of N target identifiers, which are used to provide security protection for the PDUs corresponding to the N SDU segments. The target identifier corresponding to the first SDU segment is different from all of the N target identifiers.

[0057] The communication method provided in the second aspect of this application can be applied to wireless communication systems, including short-range wireless communication systems, such as star-flash communication systems.

[0058] In one possible implementation of the second aspect, the communication method of this application is applied to one layer of a communication protocol stack, for example, referred to as the target layer. For instance, the target layer may be the link control layer. In one exemplary protocol stack architecture, the layer above the target layer is the network and transport layer; or, in some other protocol stack architectures, the layer above the target layer is the transport layer.

[0059] In another possible implementation of the second aspect, checking the security of the PDU includes at least one of the following operations: decryption (i.e., checking confidentiality), checking integrity, and authentication decryption (checking confidentiality and integrity).

[0060] In another possible implementation of the second aspect, the target identifier corresponding to the first SDU segment is different from the target identifiers corresponding to the SDU segments other than the first SDU segment among the M SDU segments.

[0061] In another possible implementation of the second aspect, the target identifier corresponding to the first SDU segment is different from the target identifiers corresponding to the other SDU segments among the M SDU segments, except for the first SDU segment. This includes: among the M SDU segments, for SDU segments that are not the first one, the target identifier of each SDU segment is increased by 1 based on the target identifier of the previous SDU segment in the segment order.

[0062] In another possible implementation of the second aspect, the target identifier of the first SDU segment does not overlap with the existing target identifier.

[0063] In another possible implementation of the second aspect, the target identifier corresponding to the first SDU segment is different from all N target identifiers, including: the target identifier corresponding to the second SDU segment is increased by 1 based on the N target identifiers.

[0064] In another possible implementation of the second aspect, the target identifier includes a PDU sequence number, which is used to indicate the sequence number of the SDU segment.

[0065] In another possible implementation of the second aspect, the PDU sequence number occupies K bits, where M is an integer and 0 < K ≤ 10.

[0066] For example, K = 8. For yet another example, K = 4.

[0067] In another possible implementation of the second aspect, the first PDU includes a target identifier for the first PDU. Further, the PDU sequence number of the first PDU is carried in the 6th byte of the first PDU.

[0068] In another possible implementation of the second aspect, the target identifier includes a segment offset value and a segment data length. The segment offset value indicates the position of the first byte of the SDU segment within the SDU, and the segment data length indicates the data length of the SDU segment.

[0069] In another possible implementation of the second aspect, the target identifier includes a segment offset value and a retransmission count. The segment offset value indicates the position of the first byte of the SDU segment within the SDU, and the retransmission count indicates the number of times the content of the SDU segment has been retransmitted.

[0070] In another possible implementation of the second aspect, the target identifier includes a PDU sequence number and a retransmission count. The PDU sequence number indicates the sequence number of the SDU segment, and the retransmission count indicates the number of times the content of the SDU segment has been retransmitted.

[0071] Optionally, the number of retransmissions occupies Q bits, where Q is an integer and 0 < Q ≤ 8.

[0072] In another possible implementation of the second aspect, the first PDU further includes one or more of the following: the PDU sequence number of the first SDU segment, the segment offset value of the first SDU segment, and the number of retransmissions of the first SDU segment included in the first PDU.

[0073] In another possible implementation of the second aspect, the security of the first PDU is checked using the target identifier corresponding to the first SDU segment, including: checking the security of the first PDU using the target identifier corresponding to the first SDU segment and the GFN, wherein the GFN is associated with the SDU.

[0074] In another possible implementation of the second aspect, the security of the first PDU is checked using the target identifier corresponding to the first SDU segment, including: decrypting the first PDU based on the target identifier, GFN and encryption key corresponding to the first SDU segment.

[0075] In another possible implementation of the second aspect, the PDU also carries a check code. The security of the first PDU is checked using the target identifier corresponding to the first SDU segment, including: checking the integrity of the information contained in the first PDU based on the target identifier corresponding to the first SDU segment, the GFN, the integrity protection key, and the check code.

[0076] In another possible implementation of the second aspect, the PDU also carries a check code, and the security of the first PDU is checked using the target identifier corresponding to the first SDU segment, including: decrypting the first PDU and checking the integrity of the information contained in the first PDU based on the target identifier corresponding to the first SDU segment, GFN, authentication encryption key, information contained in the PDU and check code.

[0077] In another possible implementation of the second aspect, the PDU also carries a segmentation indicator. The segmentation indicator is used to indicate whether the SDU segments contained in the PDU belong to the first segment, an intermediate segment, or the last segment.

[0078] Thirdly, this application provides a communication device, including a unit or module for performing the method described in the first aspect or any possible implementation of the first aspect, and / or including a unit or module for performing the method described in the second aspect or any possible implementation of the second aspect.

[0079] In one possible implementation, the communication device includes a generation unit and a security protection unit. The generation unit generates a PDU, and the security protection unit performs security protection.

[0080] As another possible implementation, the communication device includes a processing unit, which is used to perform one or more operations such as processing, determining, generating, calculating, encrypting, and decrypting.

[0081] Furthermore, the communication device also includes a communication unit, which is used to perform one or more operations such as sending, receiving, and acquiring.

[0082] Fourthly, this application provides a communication device including a processor and a memory. The memory is used to store computer instructions, and the processor is used to invoke the computer instructions stored in the memory to implement the method described in the first aspect or any possible implementation of the first aspect, or to implement the method described in the second aspect or any possible implementation of the second aspect.

[0083] Fifthly, this application provides a chip including a processor and an interface circuit. The interface circuit is used to receive signals from other communication devices and transmit them to the processor or to send signals from the processor to other communication devices. The processor is used to implement the method described in the first aspect or any possible implementation of the first aspect through logic circuits or execution code instructions, or to implement the method described in the second aspect or any possible implementation of the second aspect.

[0084] In a sixth aspect, this application provides a communication system, which includes a first node and a second node. The first node is used to implement the method described in the first aspect or any possible implementation of the first aspect, and the second node is used to implement the method described in the second aspect or any possible implementation of the second aspect.

[0085] In a seventh aspect, this application provides a terminal, which includes the communication device described in the third or fourth aspect, or the chip described in the fifth aspect, or the communication system described in the sixth aspect. Optionally, the terminal may be a handheld terminal, a vehicle, a robot, a drone, or other intelligent device or transportation tool.

[0086] Eighthly, this application provides a readable storage medium for storing a computer program that, when executed by a processor, causes a communication device including a processor to implement the method described in the first aspect or any possible implementation of the first aspect, or to implement the method described in the second aspect or any possible implementation of the second aspect.

[0087] Ninthly, this application provides a computer program product that, when executed by a processor, causes a communication device including a processor to implement the method described in the first aspect or any possible implementation of the first aspect, or to implement the method described in the second aspect or any possible implementation of the second aspect.

[0088] The beneficial effects of aspects two through nine of this application can be found in the beneficial effects of the solution in aspect one. Attached Figure Description

[0089] The accompanying drawings used in the description of the embodiments will be briefly introduced below.

[0090] Figure 1 It is an architecture of a communication system;

[0091] Figure 2 This is a schematic diagram of the architecture of a communication system in a wireless BMS scenario;

[0092] Figure 3 This is a schematic diagram of the architecture of a communication system in a smart home scenario;

[0093] Figure 4 It is the architecture of a communication system's protocol stack;

[0094] Figure 5 This is a schematic diagram of a PDU's security protection process;

[0095] Figure 6 This is a schematic diagram of another type of PDU security protection process;

[0096] Figure 7 This is a flowchart illustrating a communication method provided in an embodiment of this application;

[0097] Figure 8 This is a schematic diagram of a target identifier corresponding to an SDU segment provided in an embodiment of this application;

[0098] Figure 9 This is a schematic diagram of another target identifier corresponding to an SDU segment provided in an embodiment of this application;

[0099] Figure 10 This is a schematic diagram of another target identifier corresponding to an SDU segment provided in the embodiments of this application;

[0100] Figure 11 This is a schematic diagram of another target identifier corresponding to an SDU segment provided in an embodiment of this application;

[0101] Figure 12 This is a schematic diagram of an encryption process provided in an embodiment of this application;

[0102] Figure 13 This is a schematic diagram of an integrity protection process provided in an embodiment of this application;

[0103] Figure 14 This is a schematic diagram of an authentication and encryption process provided in an embodiment of this application;

[0104] Figure 15 This is a schematic diagram of a PDU format provided in an embodiment of this application;

[0105] Figure 16 This is a schematic diagram of another PDU format provided in the embodiments of this application;

[0106] Figure 17 This is a schematic diagram of another PDU format provided in the embodiments of this application;

[0107] Figure 18 This is a schematic diagram of another PDU format provided in the embodiments of this application;

[0108] Figure 19 This is a schematic diagram of another PDU format provided in the embodiments of this application;

[0109] Figure 20 This is a schematic diagram of another PDU format provided in the embodiments of this application;

[0110] Figure 21 This is a schematic diagram of another PDU format provided in the embodiments of this application;

[0111] Figure 22 This is a schematic diagram of another PDU format provided in the embodiments of this application;

[0112] Figure 23 This is a schematic diagram of the structure of a communication device provided in an embodiment of this application;

[0113] Figure 24 This is a schematic diagram of the structure of another communication device provided in the embodiments of this application. Detailed Implementation

[0114] The following section will introduce some of the technical terms.

[0115] 1. Check code

[0116] A check code, also known as a message integrity check (MIC), message authentication code (MAC), integrity check, message authentication code, file message authentication code, or information authentication code, is a small piece of information generated by a specific algorithm and used to check the integrity of a message and / or for authentication.

[0117] 2. Nodes

[0118] A node is a device with communication capabilities, including but not limited to one or more of user equipment, network equipment, and industrial equipment. User equipment includes one or more of handheld terminals, wearable terminals, vehicles, in-vehicle equipment, sensing devices, smart home devices, or leisure and entertainment devices. Handheld terminals include, but are not limited to, mobile phones, tablets, or laptops. Wearable devices include, but are not limited to, headphones, smart bracelets, smartwatches, or smart glasses. Vehicles include, but are not limited to, vehicles, ships, aircraft, rail transit (such as subways and high-speed trains), or logistics robots (such as automated guided vehicles (AGVs)). In-vehicle equipment includes, but is not limited to, domain controllers (DCs), screens, microphones, speakers, electronic keys, keyless entry, start system controllers, battery management systems (BMS), battery packs, or battery cells. Sensing devices include, but are not limited to, cameras, radar, lidar, light sensors, temperature sensors, or humidity sensors. Smart home devices include, but are not limited to, projectors, smart TVs, smart refrigerators, smart home gateways, or security equipment. Leisure and entertainment equipment includes, but is not limited to, virtual reality (VR) devices, mixed reality (MR) devices, massage chairs, home theaters, gaming controllers, or 4D cinema cabins. Network equipment includes, but is not limited to, routers, switches, or base stations. Industrial equipment includes, but is not limited to, industrial robots or robotic arms.

[0119] This application is applicable to various networks, and nodes can represent devices in various networks. Exemplarily, this application can be applied to wired communication networks, wireless communication networks, or networks formed by a combination of wired and wireless communication. For example, wireless communication networks include networks connected via communication technologies such as SparkLink (or NearLink), 802.11b / g, Bluetooth, Zigbee, radio frequency identification (RFID), ultra-wideband (UWB) technology, or short-range wireless communication systems. And / or, wireless communication networks include long-range connection technologies including communication technologies based on Long Term Evolution (LTE), 5th generation mobile networks (or 5th generation wireless systems, 5th-Generation, abbreviated as 5G or 5G technology), Global System for Mobile Communications (GSM), General Packet Radio Service (GPRS), Universal Mobile Telecommunications System (UMTS), and other wireless communication technologies. For example, wired communication networks include networks connected via the following communication technologies: fiber optic connection technology, in-vehicle wired communication technology, controller area network (CAN), local interconnect network (LIN), CAN flexible data rate (CAN FD), or in-vehicle Ethernet, or one or more of these.

[0120] The nodes in this application embodiment can be applied to various scenarios such as smart cars, smart homes, smart terminals, smart manufacturing, smart showrooms, mobile internet (MI), industrial control, self-driving, transportation safety, or the Internet of Things (IoT).

[0121] It should be understood that in certain application scenarios or network types, devices with communication capabilities may not be referred to as nodes. However, for ease of description, devices with communication capabilities are collectively referred to as nodes in this application embodiment.

[0122] 3. Security Algorithm

[0123] Security algorithms are algorithms related to security protection, including encryption algorithms, encryption algorithms, and authentication encryption algorithms.

[0124] Encryption algorithms are used to protect the confidentiality of data, encrypting plaintext to obtain ciphertext. Similarly, encryption algorithms can decrypt ciphertext to obtain plaintext. This article uses the forward encryption process as an example, with decryption being the reverse process. Encryption algorithms can include encryption operations (such as elliptic point addition or XOR operations) as well as various mathematical functions with higher security. Common encryption algorithms include XOR operations, Data Encryption Standard (DES), Triple Data Encryption Algorithm (3DES), Advanced Encryption Standard (AES), RSA encryption algorithm, Data Structure Analysis (DSA) algorithm, Chinese national cryptographic algorithms (such as SM4), and the Zu Chongzhi Algorithm Set (ZUC algorithms, such as Zu Chongzhi's algorithm, Encryption Algorithm 128-EEA3, or Integrity Algorithm 128-EIA3, etc.).

[0125] Integrity protection algorithms are algorithms used to protect message integrity, also known as MAC (message authentication code) algorithms. For example, integrity protection algorithms implemented using hash algorithms are called hash-based message authentication code (HMAC) algorithms. The hash algorithm can be one of MD5, SHA-1, SHA-256, etc. These different HMAC implementations are usually labeled as HMAC-MD5, HMAC-SHA1, HMAC-SHA256, etc. As another example, MAC algorithms implemented using cryptographic algorithms can be called cipher-based message authentication code (CMAC) algorithms. The cryptographic algorithm can be AES. Since AES block ciphers have four operating modes: ECB, CBC, CFB, and OFB, integrity protection algorithms based on block ciphers operating in different modes can be called ECB-MAC algorithms, CBC-MAC algorithms, etc. Furthermore, one-key CBC-MAC (OMAC) is an improvement on the CBC-MAC algorithm. In addition, integrity protection algorithms may also include Galois message authentication code mode (GMAC), Zu Chongzhi cryptographic algorithms (such as ZUC128, ZUC256, etc.), and MD algorithms (such as MD2, MD4, or MD5, etc.).

[0126] Authentication encryption algorithms can generate both ciphertext and checksums for given information. Therefore, they can function as both encryption and integrity protection algorithms. For example, AES-Galois / counter mode (AES-GCM) and AES-CMAC / counter mode (AES-CCM) can authenticate and encrypt information, producing both ciphertext and checksums to protect its integrity.

[0127] 4. Freshness parameters

[0128] Freshness parameters are used in encryption, integrity protection, key derivation, key negotiation, and other processes; they can also be called freshness or freshness parameters. Generally, the specific value of a freshness parameter changes after each use, ensuring that the value of the freshness parameter used this time is different from that used last time, thus improving security.

[0129] 5. Segment offset value

[0130] The segment offset value is used to indicate the position of the first byte (or first bit) of the SDU segment contained in the PDU within the SDU. After the SDU is segmented, the offset value of the first SDU segment (i.e., SDU segment 1) is 1. If the number of bytes in SDU segment 1 is 32, then the segment offset value of SDU segment 2 is 33. If the number of bytes in SDU segment 2 is also 32, then the field offset value of SDU segment 3 is 65, and so on.

[0131] Offset values ​​indicate the data location of SDU segments carried by the PDU. During storage, space can be pre-allocated, and SDU segments can be directly stored at their corresponding offset positions, reducing the number of copies and improving communication efficiency. For the receiver, an address space can be allocated to store the entire SDU; this address space is d1. If the receiver first obtains SDU segment 2, it can store SDU segment 2 at a certain offset position in the address space according to the segment offset value. For example, the storage address of SDU segment 2 is d1+20. After obtaining SDU1, it is stored in the space preceding SDU1 (i.e., address d1). Similarly, the storage address of SDU segment 3 is d1+40. Consider a possible scenario: if the segment offset value is not carried, the receiver cannot obtain the offset position of the SDU segments. When receiving subsequent SDU segments first, it may store them in a certain address space, and after the subsequent SDU segments are stored, the previously received SDU segments are copied over. This process of multiple copies achieves SDU reassembly. The above implementation method enables the storage of SDU segments according to their data location within the entire SDU, achieving zero copying and improving communication efficiency.

[0132] The foregoing explanation of the technical terms may be used in the embodiments described below.

[0133] The following describes the architecture and business scenarios of communication systems to which the embodiments of this application can be applied. It should be noted that the system architecture and business scenarios described in this application are for the purpose of more clearly illustrating the technical solutions of this application and do not constitute a limitation on the technical solutions provided in this application. It should be understood that as system architectures evolve and new business scenarios emerge, the technical solutions provided in this application are also applicable to similar technical problems.

[0134] This application can be applied to communication systems. A communication system is a system that transmits information using electrical signals (or optical signals), and it typically includes multiple nodes that communicate with each other to transmit information. Nodes in a communication system may have different identities and / or different capabilities. In one exemplary communication system, nodes are distinguished as master nodes and slave nodes. The master node has stronger communication capabilities and the ability to manage slave nodes, and can establish links with multiple slave nodes, enabling communication between master nodes and between master nodes and slave nodes to achieve various functions.

[0135] Communication systems can include wired communication systems and wireless communication systems. Wireless communication systems include short-range wireless communication systems and long-range wireless communication systems. Examples of short-range communication systems include the aforementioned Starlink communication system, 802.11b / g, and Bluetooth. Examples of long-range wireless communication systems include LTE and 5G.

[0136] The following section uses the StarFlash communication system as an example to introduce the architecture of a communication system applicable to this application. For example... Figure 1 The communication system shown includes a management node (considered the master node) and terminal nodes (considered slave nodes). Terminal nodes are connected to the management node, and this connection is represented by dashed lines. Communication between the management node and terminal nodes includes bidirectional unicast and / or broadcast communication. In some schemes, the management node can connect to one or more terminal nodes. In the StarScan communication system, the management node supports connecting to multiple terminal nodes, and terminal nodes also support associating with multiple management nodes.

[0137] Optionally, Figure 1 In the diagram, the connection between the management node and the terminal node is exemplarily represented by a dashed line. In a specific implementation, the connection between the management node and the terminal may include a communication link in the direction of the management node and a communication link in the direction of the terminal node. The communication link in the direction of the management node is the communication link from the management node to the terminal node, and can carry one or more of the following: data channel, control information, broadcast channel, or synchronization signal, etc., from the management node to the terminal node; this can be called a G-link. The communication link in the direction of the terminal node is the communication link from the terminal node to the management node, and can carry one or more of the following: data channel, access channel, or feedback signal, etc., from the terminal node to the management node; this can be called a T-link.

[0138] Management nodes possess both communication and management capabilities, and are sometimes referred to as G nodes, access points, or authorized nodes. Management capabilities include communication management capabilities, such as connection management, resource scheduling, or information security management, among others. For example, a management node can send resource management information or data scheduling information, such as access layer resource management information. Terminal nodes, sometimes referred to as T nodes, are nodes with communication capabilities that can transmit services with the management node. In some solutions, terminal nodes receive resource management information (or data scheduling information) and send data based on that information. For example, terminal devices can include user equipment (UE), such as barcode scanners, radio frequency identification (RFID), sensors, global positioning systems (GPS), lidar, and battery cells.

[0139] It should be understood that the identities of management nodes and terminal nodes are not absolute; they are merely exemplary names used to distinguish the operations performed by communicating nodes under a possible connection scenario. In some scenarios, a node may belong to two or more communication domains simultaneously, acting as a terminal node in some domains and a management node in others. For ease of understanding, such a node is referred to as a G(T) node in some embodiments.

[0140] Taking a vehicle scenario as an example, this communication system can be applied to wireless battery management system (BMS) scenarios, or tire pressure monitoring scenarios, etc. See also Figure 2 Taking the wireless BMS scenario as an example, the battery array management system (BAMS) is the management node, namely the G1 node, the battery cluster management system (BCMS) is the G(T) node (dual identity node), and the battery management unit (BMU) is the T node.

[0141] See Figure 3 Taking a smart home scenario as an example, the gateway or customer premises equipment (CPE) is the G node, the sub-router, large screen, mobile phone and air conditioner are the G(T) nodes, and the water heater, smart curtains, speaker, microphone, printer and smart door lock are the T nodes.

[0142] In summary, nodes in a communication system can establish communication connections and transmit data.

[0143] Most communication systems employ a hierarchical network architecture. Taking the StarScan communication system as an example, the architecture of a StarScan communication system's protocol stack is as follows: Figure 4 As shown, from top to bottom, the hierarchical network architecture consists of: the application layer, the network and transport layer, the data link layer (including the link control layer and the media access layer), and the physical layer. In this hierarchical network architecture, lower-layer protocols provide services to upper-layer protocols. For adjacent layers, the PDU formed by packets from the upper layer becomes the SDU of the lower layer. For security reasons, within a certain layer (using the target layer as an example), it is necessary to perform security processing on the SDU of this layer (i.e., the upper-layer PDU) to prevent data leakage. However, as nodes support more and more services and their functions become more complex, the data volume of the target layer's SDU may be quite large. In this case, the process of the sender performing integrity protection on the SDU will take a long time, resulting in significant memory consumption. The receiver also needs to receive the complete SDU before it can perform integrity checks on the entire SDU. Before the task of receiving the entire SDU is completed, the currently received portion occupies the receiver's memory, affecting the receiver's communication efficiency.

[0144] See Figure 5 To control the amount of data transmitted in a single transmission or for other reasons, the target layer segments its SDUs. These segments are then packaged into multiple PDUs. For example... Figure 5 As shown, in the layer above the target layer, the upper-layer SDU is appended with additional information from the upper layer, such as an upper-layer header (optionally including an upper-layer footer), resulting in an upper-layer PDU. The target layer provides services to the upper layer, and the upper-layer PDU is passed to the target layer as its own SDU. The target layer can provide security protection for the data; for example, regarding encryption and integrity, the sender performs overall encryption and integrity protection on the entire SDU at the target layer. Figure 5 The secure target layer SDU includes, for example, the ciphertext of the SDU and the MAC address. The secure target layer SDU is divided into N SDU segments, which are then packetized to form N PDUs. Each PDU includes a target layer header and data, and optionally a target layer footer. These N PDUs are transmitted to the receiver respectively.

[0145] For the receiver, when it receives one of the PDUs at the target layer, it can obtain the SDU segment carried by that PDU. However, since the SDU is encrypted and protected for integrity as a whole, this SDU segment cannot be decrypted or its integrity checked individually. Therefore, it needs to be stored in memory until N PDUs are successfully received. The receiver then reassembles the N SDU segments into a complete SDU and performs security checks based on this complete SDU. In other words, until N PDUs are successfully received, the currently received SDU segments continue to occupy memory, increasing the receiver's memory pressure.

[0146] Consider a possible scenario where the receiver connection may involve multiple nodes, such as... Figure 1 , Figure 2 and Figure 3 In the communication system shown, nodes such as G are connected to multiple nodes. The receiver may need to receive PDUs from multiple nodes, meaning each communication connection requires a certain amount of memory. This can easily lead to excessive memory usage on the receiver, affecting the node's communication efficiency and even causing the node to crash.

[0147] In some schemes, the sender supports independent security protection for each PDU using segment sequence numbers. Accordingly, the receiver can independently check the security of each PDU without having to perform a security check after reassembling the SDUs. See also... Figure 6 The SDU at this layer is segmented into multiple SDU segments (taking four SDU segments as an example). Each SDU segment corresponds to a segment number. For example, the segment number of SDU segment 1 is 0001, the segment number of SDU segment 2 is 0010, and so on for the remaining segments. Each SDU segment can form a corresponding PDU. The PDU uses the segment number of the SDU segment it carries for security protection. For example, PDU1 carries SDU segment 1, and PDU1 uses the segment number of SDU segment 1 (e.g., 0001) for security protection, while PDU2 uses the segment number of SDU segment 2 (e.g., 0010) for security protection. In this way, the SDU is segmented into multiple SDU segments, and the multiple PDUs formed by packet assembly are protected separately and transmitted separately, reducing the memory pressure on the node.

[0148] However, PDUs may experience retransmission during transmission. For example, PDU1 and PDU2 might fail to transmit, requiring retransmission of the data carried by PDU1 and PDU2, i.e., SDU segment 1 and SDU segment 2. During retransmission, the original SDU segments may be further segmented to form smaller PDUs. Combined with... Figure 6SDU segment 1 may be further segmented into SDU segment 1-1 and SDU segment 1-2. In this case, SDU segment 1-1 becomes the first segment, and its corresponding segment number is renumbered to 0001, while the segment number of SDU segment 1-2 is assigned 0010. After these two newly formed SDU segments are combined to form a PDU, when protecting PDU5 carrying SDU segment 1-1, its corresponding segment number 0001 is used, the same as the segment number used when protecting PDU1. Since the data content of SDU segment 1 and SDU segment 1-1 are not entirely identical, this scheme leads to the use of the same parameters when encrypting different content, affecting the security of data transmission. Similar problems may exist in protecting PDUs carrying SDU segment 1-2, and in other scenarios requiring the retransmission of SDUs or SDU segments.

[0149] In view of this, this application provides a communication method and related apparatus that independently protects each PDU by utilizing the target identifier corresponding to the SDU segment. For newly formed SDU segments, the target identifier corresponding to it is designed to be different from the previously generated target identifiers, which can improve the security of data transmission and enhance the security performance of the node. Furthermore, this application supports independent security protection for each PDU based on the target identifier corresponding to the SDU segment, which can significantly reduce the memory pressure on the node and improve communication efficiency while ensuring data transmission security.

[0150] The methods provided in the embodiments of this application will be described below.

[0151] Please see Figure 7 , Figure 7 This is a flowchart illustrating a communication method provided in an embodiment of this application. Optionally, this method can be applied to a communication system, such as the one described above. Figure 1 , Figure 2 or Figure 3 The communication system shown is, of course, not limited to the aforementioned communication system; this application can be applied to devices with communication capabilities. Figure 7 The communication method shown may include one or more steps S701 to S705. It should be understood that, for ease of description, the method is described in the order of S701 to S705, and is not intended to limit the execution to this specific order. This application embodiment does not limit the order of execution, the execution time, or the number of executions of the above one or more steps. S701 to S705 are as follows:

[0152] S701: The first node generates the first PDU.

[0153] The first node is a device with communication capabilities, as described in the terminology section. For example, the first node can be a T node or a G node, including a G(T) node.

[0154] In some cases, the method can be applied to one layer of a node's communication protocol stack, such as the target layer. This target layer enables secure protection of the transmitted information. It should be understood that the name of the target layer may differ in different protocol stack architectures. For example, in... Figure 4 In the aforementioned protocol stack architecture, the target layer can be the link control layer, which enables information security protection. Taking a protocol stack architecture of the StarSpark communication system as an example, the link control layer can provide data transmission services to the upper layer. Its main functions include: segmenting and reassembling the SDUs of this layer (if configured), segmenting the SDUs of this layer (if configured), link management functions, and security protection. The upper layer refers to the layer above the target layer. In different protocol stack architectures, the upper layer of the target layer may be different. For example, in... Figure 4 In the described protocol stack architecture, with the target layer being the link control layer, the layer above the target layer is the network and transport layer. The SDU in this layer is the PDU of the upper layer, combined with... Figure 4 and Figure 5 The PDUs from the network and transport layers are transmitted to the link control layer and become the SDUs from the link control layer.

[0155] The first PDU is the PDU of this layer. The first PDU includes a first SDU segment, which is one of M SDU segments obtained by segmenting the second SDU segment, where M is an integer and M≥1. That is, the first SDU segment carried by the first PDU is a new SDU segment formed by segmenting an existing SDU segment. Combined with... Figure 8 In part (b), SDU segment 1 is segmented to form two new SDU segments: SDU segment 1-1 and SDU segment 1-2. The first node can generate PDU5, which includes SDU segment 1-1. Similarly, the first node can also generate PDU6, which includes SDU segment 1-2.

[0156] The second SDU segment includes at least one of the N SDUs obtained by segmenting the SDU, where N is an integer and N≥2. The SDU (i.e., the SDU of this layer) can also be called the initial SDU, which, after segmentation, forms N SDU segments. The second SDU segment includes one or more of these N SDU segments. For example, combining... Figure 8In part (a), the target layer SDU is segmented into 4 (N=4, for example only) SDU segments. The second SDU segment can be SDU segment 1, that is, the second SDU segment includes one of the 4 SDU segments. For example, the second SDU segment is a segment formed by combining SDU segment 1 and SDU segment 2 (the number of segments combined here is for example only). The combined SDU segment can be further segmented into SDU segment 1-1, SDU segment 1-2, and SDU segment 1-3. The first SDU segment is SDU segment 1-1, SDU segment 1-2, or SDU segment 1-3.

[0157] Optionally, the second SDU segment may include SDU segments from N SDU segments that have not yet been transmitted. For example, the SDU is divided into SDU segments 1 to 4, PDU1 and PDU2 are used to transmit SDU segments 1 and 2 respectively. After the transmission of PDU1 and PDU2 fails, SDU segments 3 and 4 have not yet been assembled into a PDU for transmission. In this case, SDU segments 1, 2, 3, and 4 can be combined and re-segmented, for example, re-segmented to form SDU segments 1-1, 1-2, and 1-3, with the first SDU segment being either SDU segment 1-1, 1-2, or 1-3.

[0158] Optionally, the second SDU segment includes SDU segments of other SDUs (e.g., one or more SDUs such as the second SDU, the third SDU, etc.). For example, SDU segment 1 may also be combined with the second SDU (or an SDU segment of the second SDU) to form a second SDU segment. That is, the second SDU segment includes one or more SDU segments of this SDU, as well as segments of other SDUs or other SDUs, wherein the second SDU includes one or more SDUs.

[0159] Optionally, the second SDU segment may include one or more of the previously generated SDN segments, but is not necessarily limited to the SDU segment generated after segmenting the initial SDU once. That is, the second SDU segment may include at least one of the SDU segments generated after multiple segmentations. For example, SDU segment 1-1 may also be segmented again, and the second SDU segment of this application may also be SDU segment 1-1, while the first SDU segment is a new SDU segment formed after further segmenting the data segment including SDU segment 1-1.

[0160] It should be understood that the above Figure 8The security protection process shown in the accompanying diagram below is only an example. The data obtained after security protection of each SDU segment may include one or more of the following: the ciphertext of the SDU segment, the checksum generated based on the SDU segment, etc.

[0161] In some schemes, SDU segmentation is permitted when the first node is in the target transmission mode. This target transmission mode can be predefined, as can its activation and deactivation methods. For example, in a communication system where the target layer is the link control layer, segmentation of the link control layer SDU in the logical channel is permitted for a logical channel with transmission mode 1-1. However, segmentation of the link control layer SDU in the logical channel is not permitted for a logical channel with transmission mode 1-2. As another example, segmentation of the link control layer SDU in the logical channel is permitted for a logical channel with transmission mode 2-1, but not for a logical channel with transmission mode 2-2. Transmission modes 1-1, 1-2, 2-1, and 2-2 are predefined and used under specified conditions.

[0162] In some possible implementations, SDU segments are carried in the data portion of the first PDU. Furthermore, the first PDU also includes additional information, such as the target layer header and target layer footer. The format of the PDU will be described exemplarily below.

[0163] S702: The first node uses the corresponding target identifier of the first SDU segment to perform security protection on the first PDU.

[0164] The target identifier corresponding to the first SDU segment is different from the N target identifiers corresponding to the aforementioned N SDU segments. That is, the N SDU segments formed by segmenting the SDU each correspond to N target identifiers, and these N SDU segments are used to provide security protection for the PDUs corresponding to the N SDUs. For example, combined with... Figure 8In part (a), the four target identifiers corresponding to SDU segments 1 to 4 are 0000 0001, 0000 0010, 0000 0011, and 0000 0100, respectively. Among them, the target identifier 0000 0001 corresponding to segment 1 can be used to protect PDU 1 (e.g., to encrypt the data part of PDU 1, or to protect the integrity of the data part of PDU). The security protection process for other PDUs is similar. When SDU segment 1 is re-segmented to form a new SDU segment, the target identifier corresponding to the new SDU segment is 0000 0101. The target identifier corresponding to the new SDU segment is different from the four target identifiers corresponding to SDU segments 1 to 4.

[0165] In some possible implementations, the target identifier corresponding to the first SDU segment is different from the target identifiers corresponding to the other SDU segments among the M SDU segments. That is, when segmenting existing SDU segments, the target identifiers corresponding to the newly generated multiple SDU segments are also different.

[0166] In some possible implementations, the target identifier of the new SDU segment obtained by re-segmenting the second SDU segment is not the same as the existing target identifier. That is, when the existing SDU is segmented, the target identifier corresponding to the newly generated SDU segment is different from the previous target identifier.

[0167] For example, the target identifier corresponding to the first SDU segment is incremented by 1 based on the existing target identifiers (e.g., the aforementioned N target identifiers). Combined with... Figure 8 For SDU segment 1-1, the existing SDU segments are SDU segment 1 to SDU segment 4. The target representation corresponding to SDU segment 1-1 is based on the maximum value of the target identifier corresponding to SDU segment 1 to SDU segment 4, plus 1, that is, plus 1 based on 00000100. In other words, if the initial SDU has been divided into N SDU segments, the first SDU segment is based on the N target identifiers corresponding to the N SDU segments, plus 1, that is, plus 1 relative to the maximum value of the N target identifiers. For example, if the maximum value of the N target identifiers is 0000 0100, the target identifier corresponding to the first SDU segment is (0000 0100 + 1 =) 0000 0101.

[0168] Optionally, among the M SDU segments obtained by segmenting the second SDU, for SDU segments that are not the first, the target identifier of each SDU segment is incremented by 1 based on the target identifier of the previous SDU segment in the segmentation order. For example, combining... Figure 8For SDU segment 1-2, the maximum value of the target identifier corresponding to the existing SDU segment is 0000 0101 (i.e., the target identifier corresponding to the previous SDU segment). Therefore, the target identifier corresponding to SDU segment 1-2 is (0000 0101 + 1 =) 0000 0110. The above exemplifies one target identifier update mechanism. Other mechanisms may also exist to ensure that the target identifier corresponding to the first SDU segment is different from the target identifier of the existing SDU.

[0169] The following section will introduce some possible implementations of target identifiers:

[0170] Implementation 1: The target identifier includes a PDU sequence number, which indicates the sequence number of the SDU segment carried by the PDU. For example, taking the link control layer as the target layer, the PDU sequence number field indicates the sequence number of the link control layer SDU segment.

[0171] In one possible implementation, when the SDU is segmented to generate a new SDU segment, the new SDU segment is the existing maximum PDU sequence number + 1. For example, combined with... Figure 8 In part (a), the initial value of the PDU sequence number is preset to 0000 0000 (i.e., 0, occupying 8 bits). When SDU segmentation results in SDU segment 1, the PDU sequence number corresponding to SDU segment 1 is the initial value plus 1, i.e., 0000 0001. Similarly, for SDU segment 2, its corresponding PDU sequence number is the existing PDU sequence number plus 1, i.e., (0000 0001 + 1 =) 0000 0010. Furthermore, when a new SDU segment is generated after further segmentation of the existing SDU segment, the PDU sequence number corresponding to the SDU segment is the existing maximum PDU sequence number plus 1. For example, combining... Figure 8 (b) The segment number of SDU segment 1-1 is 0000 0101.

[0172] In some schemes, the PDU sequence number is determined at or before the PDU is generated. For example, one rule for defining the PDU sequence number is as follows: When a new PDU is generated by segmenting an existing SDU, the PDU sequence number is the existing maximum PDU sequence number + 1. When an existing SDU segment is retransmitted and then further segmented to generate a new PDU, the PDU sequence number is the existing maximum PDU sequence number + 1. When an existing SDU segment is retransmitted but not further segmented, the encrypted PDU is directly retransmitted.

[0173] In some possible implementations, the PDU sequence number corresponding to the SDU segment is carried within the PDU containing the SDU segment. An exemplary PDU format is as follows: Figure 15 , Figure 16 , Figure 21 and Figure 22 As shown.

[0174] Optionally, the PDU sequence number occupies K bits, where K is an integer and 0 < K ≤ 10. The number of bits occupied by the PDU sequence number is between 0 and 10 bits, which is sufficient to distinguish multiple segments, and the length is more suitable. For example, K = 8. Since the number of SDU segments is usually not too large, an 8-bit length is appropriate, meeting the requirements for distinguishing SDU segments while further reducing the impact on the PDU format. As another example, K = 4. Since the number of SDU segments usually does not exceed 16 segments, a 4-bit length is appropriate, meeting the requirements for distinguishing SDU segments in some cases.

[0175] Implementation 2: The target identifier includes a segment offset value and a segment data length. The segment offset value indicates the position of the first byte of the SDU segment within the SDU, and the segment data length indicates the data length of the SDU segment.

[0176] Please see Figure 9 In part (a), after segmenting the SDU of this layer, the position of the first byte of each SDU segment is different, so multiple SDU segments correspond to different target identifiers. For example, the four SDU segments obtained after segmenting the SDU of this layer are represented as SDU segment 1 to SDU segment 2. The target identifier corresponding to the SDU segment includes the segment offset value and the segment data length. The segment offset value and the segment data length each occupy a certain number of bits, for example, each occupies 8 bits. The target identifier includes the data obtained by concatenating the two (represented by the symbol "||"). Among them, the segment offset value of SDU segment 1 is 1, and the segment data length is 32, so the segment identifier includes "1||32", that is, the target identifier corresponding to SDU segment 1 includes, for example, 0x0120. Further, the segment identifier of SDU segment 2 includes "33||32", that is, 0x2120, and so on for the remaining SDU segments. It should be understood that the number of bits occupied by the segment offset value and segment data length here is only an example. The bit number design here is only to facilitate the description of the definition rules of the target identifier. Similarly, the number of bits occupied by other parameters and fields in this article is also only an example.

[0177] When an existing SDU segment is further segmented, the first byte position of the first SDU segment after the re-segmentation is the same as the first byte position of the original SDU segment, but the segment data lengths of the two segments are different. See [link / reference] Figure 9In part (b), when SDU segment 1 is further segmented, SDU segment 1-1 is obtained. This segment has the same segment offset as the original SDU segment 1, but the segment data length is different. Therefore, the target identifier corresponding to SDU segment 1-1 includes 0x0110, which is different from the target identifiers corresponding to the existing SDU segments 1 to 4. Similarly, the target identifier corresponding to SDU segment 1-2 is different from the target identifiers corresponding to the existing SDU segments 1 to 4, and also different from the target identifier corresponding to SDU segment 1-1.

[0178] In summary, the scheme described in 2 enables the target identifier of the new SDU segment obtained from the existing SDU segment to be different from the target identifier of the existing SDU segment.

[0179] Alternatively, the unit "byte" used in the aforementioned segment offset value can be replaced with other data units, such as bits, or "two bytes," etc. That is, the position of the first byte can also be replaced with the position of the first bit, or the position of each two-byte unit in the initial SDU.

[0180] In some possible implementations, the segment offset value corresponding to the SDU segment is carried in the PDU containing the SDU segment. An exemplary PDU format is as follows: Figures 15 to 22 As shown.

[0181] Implementation 3: The target identifier includes the segment offset value and the retransmission count. The retransmission count is used to indicate the number of times the content of the SDU segment has been retransmitted.

[0182] Please see Figure 10 In part (a), after segmenting the SDU at this layer, the segment offset values ​​of each SDU segment are different. During the initial transmission, the retransmission count is an initial value, for example, predefined as 0, and increases by 1 for each subsequent retransmission. The target identifier corresponding to the SDU segment includes the segment offset value and the retransmission count, each occupying a certain number of bits; for example, the segment offset value occupies 8 bits, and the retransmission count occupies 4 bits. Figure 10 Part (a) represents an example of the initial SDU transmission scenario. The segment offset of SDU segment 1 is 1, and the retransmission count is 0. Therefore, the segment identifier includes "1||0", that is, the target identifier corresponding to SDU segment 1 includes, for example, 0x010. Further, the segment identifier of SDU segment 2 includes "33||0", that is, 0x210, and so on for the remaining SDU segments.

[0183] In retransmission scenarios, it may be necessary to re-segment existing SDU segments. Combined with... Figure 10In part (b), taking the retransmission of SDU segment 1 as an example, after the SDU is re-segmented, the first SDU segment after the re-segmentation, namely SDU segment 1-1, has the same segment offset value as SDU segment 1. However, since the data content of SDU segment 1-1 has already been transmitted, the corresponding retransmission count is 1. Therefore, the target identifier corresponding to SDU segment 1-1 includes 0x011, which is different from the target identifiers corresponding to the existing SDU segments 1 to 4. Similarly, the target identifier corresponding to SDU segment 1-2 is different from the target identifiers corresponding to the existing SDU segments 1 to 4, and is also different from the target identifier corresponding to SDU segment 1-1.

[0184] In some possible implementations, the segment offset value and / or retransmission count corresponding to the SDU segment are carried in the PDU containing the SDU segment. An exemplary PDU format is as follows: Figures 19 to 22 As shown.

[0185] Implementation 4: The target identifier includes the PDU sequence number and the number of retransmissions. The PDU sequence number indicates the sequence number of the SDU segment, and the number of retransmissions indicates the number of times the content of the SDU segment has been retransmitted.

[0186] Combination Figure 11 In part (a), the target identifier corresponding to the SDU segment includes the PDU sequence number and the number of retransmissions. Each of the PDU sequence number and the number of retransmissions occupies a certain number of bits; for example, the PDU sequence number occupies 4 bits, and the number of retransmissions occupies 4 bits. Figure 11 Part (a) represents an example of the initial SDU transmission scenario. SDU segment 1 has a PDU of 1 and a retransmission count of 0, so the segment identifier includes "1||0". That is, the target identifier corresponding to SDU segment 1 includes, for example, 0x010. Further, the segment identifier of SDU segment 2 includes "2||0", that is, 0x20, and so on for the remaining SDU segments.

[0187] Combination Figure 11 In part (b), taking retransmitted SDU segment 1 as an example, after the SDU is re-segmented, the PDU sequence number of the first SDU segment after re-segmentation, namely SDU segment 1-1, is increased by 1 based on the PDU sequence number of the existing SDU segments (i.e., PDU sequence number is 5), and the corresponding retransmission count is 1. Therefore, the target identifier corresponding to SDU segment 1-1 includes 0x051, which is different from the target identifiers corresponding to the existing SDU segments 1 to 4. Similarly, the target identifier corresponding to SDU segment 1-2 is different from the target identifiers corresponding to the existing SDU segments 1 to 4, and is also different from the target identifier corresponding to SDU segment 1-1.

[0188] In some possible implementations, the PDU sequence number and / or retransmission count corresponding to the SDU segment are carried in the PDU containing the SDU segment. An exemplary PDU format is as follows: Figures 21 to 22 As shown.

[0189] Optionally, in implementation 4, the PDU sequence number can follow the aforementioned PDU sequence number update rule, that is, whenever a new SDU segment is generated, the PDU sequence number is increased by 1 based on the existing maximum PDU sequence number. Figure 10 The situation is shown.

[0190] Alternatively, in implementation 4, the PDU sequence number can be reset from its initial value in each retransmission, i.e., it can start incrementing from the initial value again. In other words, the PDU sequence number may be the same in different retransmissions, but the number of retransmissions will be different. This allows the PDU sequence number combined with the number of retransmissions to distinguish SDU segments, ensuring that different parameters are used when protecting the content of different SDU segments.

[0191] As a possible example, in the case of Figure 11 In the case where SDU segment 1 shown in part (a) is further segmented, during the first retransmission of the content of SDU segment 1 in the SDU, the PDU sequence number starts increasing again from the initial value (e.g., 1). That is, the target identifier corresponding to SDU segment 1-1 is 0x011 (1||1), i.e., the PDU sequence number is 0x01, and the retransmission count is 0x1. At this time, the target identifier can still be the same as N in the first transmission (e.g., N). Figure 11 As shown, N=4 target identifiers are used to distinguish them. Similarly, the target identifier corresponding to SDU segment 1-2 is 0x021. Furthermore, if SDU segment 2 also needs to be transmitted in this retransmission, the PDU sequence number will increase sequentially in this retransmission. For example, the target identifier bit corresponding to SDU segment 2-1 obtained by segmenting SDU segment 2 is 0x031, where the PDU sequence number is 0x03 and the retransmission count is 0x1. Similarly, the target identifier bit corresponding to SDU segment 2-2 obtained by segmenting SDU segment 2 is 0x041, where the PDU sequence number is 0x04 and the retransmission count is 0x1.

[0192] The above implementations are merely examples, and various possible implementations can be combined. The various possible implementation methods described in this article can also be combined. It should be noted that the names of the information, parameters, fields, devices, and modules listed above are only examples; in specific implementations, the names can be designed according to actual needs. For example, a PDU serial number may also be called a segment serial number.

[0193] As discussed above, in this application, after the SDU is segmented, each SDU segment corresponds to a different target identifier. Furthermore, the target identifier for newly formed SDU segments based on existing SDU segments is also designed to be different from the previously generated target identifiers. In this way, by incorporating the target identifier corresponding to the SDU into the PDU security protection process, different parameters can be used for different PDUs during security protection, thereby improving the security of data transmission.

[0194] In one possible implementation, security protection includes one or more of the following: encryption (or confidentiality protection), integrity protection, and authentication encryption. In some possible implementations, the communication link can be configured to enable or disable security protection, and the specific type of security protection enabled. For example, if both parties to the communication enable encryption, the node encrypts the PDU. As another example, if both parties to the communication enable integrity protection, the node performs integrity protection on the PDU. As yet another example, if both parties to the communication enable both encryption and integrity protection, the node encrypts and protects the PDU. Furthermore, if both parties to the communication enable authentication encryption, the node performs authentication encryption on the PDU.

[0195] In one possible implementation, PDU security is achieved through a security algorithm. That is, the PDU is secured using an encryption algorithm. In this case, the target identifier corresponding to each SDU segment can be used as input to the corresponding security algorithm.

[0196] In the process of security protection, in addition to the target identifier corresponding to the SDU segment, other parameters may also be involved, such as one or more of the following: key, GFN, and data length of the information being securely processed.

[0197] The following is an example of GFN:

[0198] GFN is a parameter maintained by the node to record updates to the transmission unit number. It is typically maintained locally by the node and updated along with the transmission unit number. The transmission unit here can include PDUs or service data units from different layers, such as SDUs, local layer PDUs, or lower layer PDUs. For example, a transmission unit may include a local layer SDU, a physical layer superframe number, or a radio frame number.

[0199] As an example of a GFN, it consists of two parts: a predefined value and a transmission unit sequence number. For instance, in the StarFlash communication system, for the first type of service, the GFN is 32 bits, with the high 14 bits being the HFN and the low 18 bits being the link control layer sequence number (SN). For the second type of service, the GFN is also 32 bits, including the HFN (10 bits), the physical layer superframe number (16 bits), and the radio frame sequence number (6 bits). The HFN is the predefined value and does not need to be transmitted; it is typically maintained locally at the node. The link control layer sequence number, physical layer superframe number, and radio frame sequence number are carried in the transmission unit and transmitted to the receiver.

[0200] In some cases, in the StarFlash communication system, depending on the purpose and link direction of the GFN, G nodes and T nodes need to maintain four GFNs: GFN.su for the signaling plane T link, GFN.sd for the signaling plane G link, GFN.uu for the user plane T link, and GFN.ud for the user plane G link. The GFN.su for the signaling plane T link is used for the encryption process of the signaling plane T link, and the same applies to the other links. After a node generates a security context, the GFN is initialized to 0. After the connection between two nodes is broken, G nodes and T nodes should save the GFN as part of the security context.

[0201] In one possible implementation, the first node uses the target identifier and GFN corresponding to the SDU segment to perform security protection on the PDU corresponding to the SDU, where the GFN is associated with the SDU. Furthermore, different SDUs are associated with different GFNs. By incorporating the target identifier corresponding to the SDU segment and the GFN associated with the SDU into the PDU security protection process, it is possible to ensure that PDUs formed from different SDUs, as well as multiple PDUs formed from the same SDU, use different parameters during security protection, thereby improving the security of data transmission.

[0202] In one possible implementation, the target identifier corresponding to the SDU segment participates in the security protection process as part of the freshness parameter. Furthermore, when using the GFN, the GFN can be used as another part of the freshness parameter. That is, the first node can perform security protection on the PDU based on the freshness parameter and the key. The freshness parameter includes the target identifier corresponding to the SDU segment, and may further include the GFN. Of course, the freshness parameter may also include other parameters, such as link identifier, logical channel identifier, reserved fields, etc.

[0203] The following sections introduce the implementation methods of encryption (i.e. confidentiality protection), integrity protection, and authentication encryption.

[0204] Please see Figure 12 , Figure 12 This is a schematic diagram of an encryption process provided in an embodiment of this application. For example... Figure 12 In part (a), the input parameters of the encryption algorithm include the encryption key, the freshness parameter, and the plaintext length. The sender generates a keystream and XORs the plaintext and the keystream to obtain the ciphertext. See also Figure 12 In part (b), the decryption process is the reverse of the encryption process. The receiver generates a keystream using the decryption key, freshness parameter, and ciphertext length, and then performs an XOR operation between the keystream and the ciphertext to recover the plaintext. The encryption and decryption algorithms can be the same, and the plaintext length can be the same as the ciphertext length.

[0205] In one possible implementation, the inputs to the security algorithm can differ in unicast and multicast scenarios. Figure 12 The encryption / decryption process illustrated here, with the target identifier corresponding to SDU segmentation including the PDU sequence number, is illustrated using a unicast encryption algorithm in a unicast scenario. For example, in signaling plane encryption, it's the signaling plane encryption key Ks.enc, and in user plane encryption, it's the user plane encryption key Ku.enc. The freshness parameter includes a 32-bit GFN, a 1-bit link direction identifier, a 5-bit logical channel identifier, an 8-bit PDU sequence number, and a 2-bit reserved field. The link direction identifier is 1 bit, taking the first value (e.g., 0) for T-links and the second value (e.g., 1) for G-links. When no segmentation is performed, the 8-bit PDU sequence number should be set to 0. The reserved field is 2 bits, which can optionally be all 0s. Of course, this description uses the PDU sequence number occupying 8 bits as an example; in actual implementation, the PDU sequence number can occupy other bit counts. For example, the freshness parameter may include a 32-bit GFN, a 1-bit link direction identifier, a 5-bit logical channel identifier, and a 10-bit PDU sequence number. In some possible designs, the 10-bit PDU sequence number should be set to 0 when no segmentation is performed. For example, the freshness parameter includes a 32-bit GFN, a 1-bit link direction identifier, a 5-bit logical channel identifier, a 4-bit PDU sequence number, and a 6-bit reserved field. In some possible designs, the 4-bit PDU sequence number should be set to 0 when no segmentation is performed. The plaintext length (or simply length) is the length of the plaintext to be encrypted, used to control the length of the key stream.

[0206] In a multicast scenario (taking the target identifier corresponding to the SDU segment, including the PDU sequence number, as an example), the key used by the encryption algorithm is the multicast encryption key. For example, in the case of signaling plane encryption, it is the multicast signaling plane encryption key GKs.enc, and in the case of user plane encryption, it is the multicast user plane encryption key GKu.enc. The freshness parameters include a 32-bit GGFN, a 1-bit G link identifier, a 5-bit logical channel identifier, an 8-bit PDU sequence number (the number of bits is only for example), and a 2-bit reserved field (optional, the number of bits is only for example). Among them, GGFN is part of the freshness parameters in the cryptographic algorithm input during multicast. GGFN does not need to be transmitted and is maintained locally by the G node and T node respectively. The G link identifier is 1 bit, and this value is set to the second value to indicate the G link. GGFN only has the G link direction. Depending on the purpose of GGFN, the G node and T node need to maintain two GGFNs, namely GGFN.sd for the signaling plane G link and GGFN.ud for the user plane G link. After generating the group key GK, GGFN is initialized to 0. After the connection is closed, both the G node and T node should save GGFN as part of the security context.

[0207] Alternatively, the encryption algorithm used in unicast scenarios may differ from that used in multicast scenarios. Of course, this application also applies to cases where both are the same.

[0208] In one possible embodiment of this application, the first node encrypts the PDU corresponding to the SDU segment based on the target identifier, GFN, and encryption key corresponding to the SDU segment. Combined with... Figure 12 In part (a), the plaintext input to the encryption algorithm can be the data portion of the PDU, a segment of the corresponding SDU, or the entire content of the PDU, depending on the specific circumstances. It should be understood that... Figure 12 The example of encrypting SDU segments illustrates the approach of this application to encrypt PDUs corresponding to different segments separately, and does not aim to limit the parameters output during the encryption process to only the SDU segments corresponding to the PDUs.

[0209] Please see Figure 13 , Figure 13 This is a schematic diagram of an integrity protection process provided in an embodiment of this application. The input parameters of the integrity protection algorithm include an integrity protection key Kint, a freshness parameter, and the information Message to be protected. The definition of the freshness parameter used in the integrity protection process can be found in the foregoing description. Figure 13 In part (a), based on these input parameters, the sender uses an integrity protection algorithm to calculate a Message Integrity Code (MIC). The MIC is appended to the message (e.g., in the footer of the PDU) when the message is sent. Figure 13In part (b), after receiving the message, the receiver calculates the expected message integrity code (e.g., called XMIC) and compares it with the received message integrity code MIC. If the XMIC matches the MIC, the integrity protection verification is successful. In some possible implementations, the first node generates a check code, such as MIC, based on the target identifier, GFN, integrity protection key, and information contained in the PDU corresponding to the SDU segment. Figure 13 Part (a) of the PDU contains information called Message, which is the information to be protected for integrity. This could be an SDU, a portion of the PDU (e.g., the data portion), or the specific details to be designed. The checksum generated during transmission can be carried within the PDU, as shown below. Figures 15 to 22 The PDU is designed with multiple bytes for integrity protection, which can be used to carry check codes.

[0210] In some possible implementations, when encryption and integrity protection are enabled simultaneously, the encryption process and the integrity protection process are performed in the following order: first, the encryption process is executed, and then the integrity protection is performed on the encrypted ciphertext.

[0211] Please see Figure 14 , Figure 14 This is a schematic diagram of an authentication encryption process provided in an embodiment of this application. Authentication encryption is an encryption mode that can simultaneously guarantee the confidentiality, integrity, and authenticity of data. The input parameters of the authentication encryption algorithm include the authentication encryption key Kac, a freshness parameter, plaintext, and additional authentication data AAD (optional). Figure 14 In part (a), based on these input parameters, the sender uses an authentication encryption algorithm to generate ciphertext and a message integrity code (MIC). The MIC is the message integrity code in the authentication encryption algorithm, used to verify the integrity of the encrypted data and the AAD. The sender then sends the ciphertext, AAD, and MIC to the receiver. Figure 14 In part (b), the receiver uses the ciphertext and the same other input parameters to generate plaintext and the expected message integrity code (XMIC), and compares it with the received message integrity code (MIC). If the XMIC matches the MIC, the integrity protection verification is successful.

[0212] AAD is data that is protected for integrity only and not for confidentiality, and is an optional input.

[0213] In some possible implementations, the authentication encryption algorithm uses AES-128, AES-256, or SM4, and the operating mode of the authentication encryption algorithm uses GCM mode or CCM mode. In GCM mode, the freshness parameter is also called the initialization vector; in CCM mode, the freshness parameter is also called NONCE.

[0214] For example, in a unicast scenario of a communication system (taking the target identifier corresponding to the SDU segment, including the PDU sequence number, as an example), during the authentication and encryption process, the initialization vector (GCM mode) or NONCE (CCM mode) is 96 bits, consisting of a 32-bit GFN, a 1-bit link direction identifier, a 5-bit logical channel identifier, an 8-bit PDU sequence number, and a 50-bit reserved field concatenated. The parameters, values, and optional designs are described above.

[0215] As another example, in a multicast scenario of a communication system, the initialization vector (GCM mode) or nonce (CCM mode) is 96 bits, consisting of 32 GGFN, 1 bit G link identifier, 5 bits logical channel identifier, 8 bits PDU sequence number, and 50 bits reserved field concatenated.

[0216] In one possible embodiment of this application, the first node encrypts the PDU corresponding to the SDU segment based on the target identifier, GFN, authentication encryption key, and information contained in the PDU corresponding to the SDU segment, and obtains a check code. Figure 14 In part (a), the target identifier and GFN are input as freshness parameters into the authentication encryption algorithm, while the information contained in the PDU is input as plaintext into the encryption algorithm to generate ciphertext and obtain a check code. Optionally, the plaintext input into the authentication encryption algorithm can be the data part of the PDU, or the SDU segment of the PDU, or the PDU itself, which can be designed according to the specific situation.

[0217] In some possible implementations, the first node can send a securely protected PDU to the second node, which will be described later. Figure 7 The communication method shown may include S703, and may further include S704 and S705.

[0218] Step S703: The first node sends the first PDU, which has been secured, to the second node.

[0219] It should be understood that step S703 is an optional step, meaning that step S703 may not be executed in the specific implementation process. For example, if the connection between the two is broken, or if the PDU transmission is terminated, step S703 will not be executed.

[0220] In one possible implementation, the target layer of the first node sends a Link Control Layer (PCL) PDU to the lower layer of the target layer. Further, when sending the PCL PDU to the lower layer, the PCL sending entity sets the SN of the PDU to the SN of the corresponding SDU.

[0221] Step S704: The second node receives the first PDU from the first node.

[0222] In some schemes, the receiving entity of the target layer of the second node can receive the PDU sent by the sending entity of the target layer of the first node.

[0223] Step S705: The second node checks the security of the first PDU using the target identifier corresponding to the first SDU segment.

[0224] The security check includes one or more of the following: confidentiality check (i.e., decryption), integrity protection check, or authentication decryption. The check process can be found in [link to relevant documentation]. Figure 12 , Figure 13 and Figure 14 Description of the relevant processes for the recipient.

[0225] In one possible embodiment of this application, the second node decrypts the first PDU based on the target identifier, GFN, and encryption key corresponding to the first SDU segment.

[0226] In one possible embodiment of this application, the second node checks the integrity of the information contained in the first PDU based on the target identifier, GFN, integrity protection key, and check code corresponding to the first SDU segment. Figure 13 (b) Generate the expected check code XMIC based on the freshness parameters (including segment number and GFN). If XMIC matches the check code MIC, the integrity check passes.

[0227] In one possible embodiment of this application, the second node decrypts the first PDU and checks the integrity of the information contained in the first PDU based on the target identifier, GFN, authentication encryption key, information contained in the first PDU corresponding to the first SDU segment, and the check code.

[0228] exist Figure 7 In the communication method shown, each PDU is independently protected using the target identifier corresponding to the SDU segment. For newly formed SDU segments, the target identifier is designed to be different from the previously generated target identifiers, which can improve the security of data transmission and enhance the security performance of the node. Furthermore, this application supports independent security protection for each PDU based on the target identifier corresponding to the SDU segment, which can significantly reduce the memory pressure on the node and improve communication efficiency while ensuring data transmission security.

[0229] The security protection process for PDUs has been described above. Below are examples of several PDU formats. A first PDU can be encapsulated using one or more of the following formats.

[0230] Please see Figure 15 , Figure 15This is a schematic diagram of a PDU format provided in an embodiment of this application. The PDU includes a Header portion (bytes 1 to 8) and a Data portion (byte 9, optionally including some or all bytes after byte 9). Optionally, it also includes a Footer portion (e.g., bytes X-3 to byte X, where X is an integer and X > 13; for example, a Footer of 4 bytes). SDU segments are carried in the Data portion of the PDU.

[0231] exist Figure 15 In the PDU format shown, the 6th byte of the PDU is the PDU sequence number field, which is used to indicate the segment number of the SDU segment corresponding to the PDU.

[0232] exist Figure 15 In the PDU format shown, since the fields carried by the first 5 bytes of the PDU are predefined and the number of bits (and bytes) occupied are reasonably allocated, and the 4th and 5th bytes are used to carry the segment offset value (or part of the segment offset value), carrying the PDU sequence number in the 6th byte of the PDU allows fields with similar meanings to be placed in adjacent positions, making them easy to retrieve without affecting the normal indication of other fields. In one possible implementation, the PDU also carries the segment offset value.

[0233] In one possible implementation, the PDU also carries a segmentation indicator. The segmentation indicator is used to indicate whether the SDU segments contained in the PDU belong to the first segment, an intermediate segment, or the last segment. For example... Figure 15 The PDU segmentation indicator can occupy 2 bits. When it is 00, it indicates that the PDU includes a complete SDU. When it is 01, it indicates that it includes the first segment of the SDU. When it is 10, it indicates that it includes the middle segment of the SDU. When it is 11, it indicates that it includes the last segment of the SDU.

[0234] It should be understood that Figure 15 The PDU format shown is for illustrative purposes only. The following section discusses... Figure 15The other fields in the PDU format shown are briefly described below. The Data / Control field indicates whether the PDU carries data or control information. The Query field indicates whether a status report is requested. The Sequence Number field indicates the serial number generated by the service data units included in the PDU according to the transmission order; optionally, multiple PDUs may have the same sequence number. For example, the sequence number can be associated with an SDU, and multiple PDUs formed by segmenting the same SDU may have the same sequence number. The Reserved field is reserved by the protocol and is usually set to 0; the receiver can ignore this field. The Upper-Layer Protocol Indication field is indicated by the upper-layer protocol, or it is used to indicate the upper-layer protocol; see the description of the relevant technology. The Integrity Protection Bullet is used to protect the integrity of information (such as data in the PDU); its length can be pre-designed, for example, 32 bits, 64 bits, or 128 bits.

[0235] The following section introduces some other possible PDU formats provided in this application. Explanations of some fields can be found in the [reference needed]. Figure 15 Explanation of the fields in the PDU shown.

[0236] Please see Figure 16 , Figure 16 This is a schematic diagram of another possible PDU format according to an embodiment of this application. The PDU includes a header section and a data section, and optionally also includes a footer section. SDU segments are carried in the data section of the PDU. Further, the data length of the SDU segments can be determined by the space occupied by the carried SDU segments. Figure 16 In the PDU format shown, the 6th byte of the PDU is the PDU sequence number field, which indicates the segment number of the SDU segment corresponding to the PDU. Furthermore, the PDU also carries a segment offset value and / or a segment indicator.

[0237] Please see Figure 17 and Figure 18 , Figure 17 and Figure 18 This is a schematic diagram illustrating two possible PDU formats according to embodiments of this application. The PDU includes a header section and a data section, and optionally also includes a footer section. SDU segments are carried in the data section of the PDU. Further, the data length of the SDU segments can be determined by the space occupied by the carried SDU segments. Figure 17 and Figure 18 In the PDU format shown, the 4th and 5th bytes of the PDU are segment offset fields, used to indicate the segment offset values ​​of the SDU segments carried by the PDU. Furthermore, the PDU also carries segmentation indicators.

[0238] Please see Figure 19 and Figure 20 , Figure 19 and Figure 20 This is a schematic diagram illustrating two possible PDU formats according to embodiments of this application. The PDU includes a header section and a data section, and optionally also includes a footer section. SDU segments are carried in the data section of the PDU. Figure 19 and Figure 20 In the PDU format shown, the 4th and 5th bytes of the PDU are segment offset fields, used to indicate the segment offset value of the SDU segment corresponding to the PDU. The first 4 bits of the 6th byte of the PDU are retransmission count fields, used to carry a value indicating the number of retransmissions, and the last 4 bits of the 6th byte are reserved. Furthermore, the PDU also carries a segmentation indicator.

[0239] Please see Figure 21 and Figure 22 , Figure 21 and Figure 22 This is a schematic diagram illustrating two possible PDU formats according to embodiments of this application. The PDU includes a header section and a data section, and optionally also includes a footer section. SDU segments are carried in the data section of the PDU. Figure 21 and Figure 22 In the PDU format shown, the 4th and 5th bytes of the PDU are segment offset fields, used to indicate the segment offset value of the corresponding SDU segment. The first 4 bits of the 6th byte of the PDU are the PDU sequence number field, used to carry the PDU sequence number, that is, the PDU sequence number occupies 4 bits. The last 4 bits of the 6th byte of the PDU are the retransmission count field, used to carry the value indicating the number of retransmissions. Furthermore, the PDU also carries a segmentation indicator.

[0240] It should be noted that the positions of the fields listed above in the PDU and the number of bits they occupy are only examples.

[0241] The methods of the embodiments of this application have been described in detail above. The apparatus of the embodiments of this application is provided below.

[0242] It should be understood that the division of units in the apparatus provided in this application embodiment is only a logical functional division. In actual implementation, they can be fully or partially integrated into a single physical entity, or they can be physically separated. Furthermore, the units in the apparatus can be implemented by a processor calling software. For example, the apparatus includes a processor connected to a memory, which stores instructions. The processor calls the instructions stored in the memory to implement any of the above methods or to implement the functions of each unit of the apparatus. The processor is, for example, a general-purpose processor, such as a central processing unit (CPU) or a microprocessor, and the memory is either internal or external to the apparatus.

[0243] Alternatively, the units in the device can be implemented as hardware circuits. The functionality of some or all of the units can be achieved through the design of these hardware circuits, which can be understood as one or more processors. For example, in one implementation, the hardware circuit is an application-specific integrated circuit (ASIC). The functionality of some or all of the above units is achieved through the design of the logical relationships between the components within the circuit. In another implementation, the hardware circuit can be implemented using a programmable logic device (PLD). Taking a field-programmable gate array (FPGA) as an example, it can include a large number of logic gates. The connection relationships between the logic gates are configured through a configuration file, thereby achieving the functionality of some or all of the above units.

[0244] In the embodiments of this application, each unit in the device may be one or more processors (or processing circuits) configured to implement the above methods, such as: CPU, graphics processing unit (GPU), neural network processing unit (NPU), tensor processing unit (TPU), deep learning processing unit (DPU), microprocessor unit (MPU), digital signal processor (DSP), ASIC, FPGA, or a combination of at least two of these processor forms.

[0245] Furthermore, the units in the above devices can be integrated in whole or in part, or they can be implemented independently. In one implementation, these units are integrated together as a system-on-a-chip (SOC). The SOC may include at least one processor for implementing any of the above methods or for implementing the functions of the units in the device. The at least one processor can be of different types, such as including a CPU and an FPGA, or including a CPU and an artificial intelligence processor, or including a CPU and a GPU, etc. Several possible devices are listed below.

[0246] Please see Figure 23 , Figure 23This is a schematic diagram of a communication device provided in an embodiment of this application. Optionally, the communication device 230 can be an independent device, such as a node. Alternatively, the communication device 230 can also be a component within an independent device (such as a node), such as a chip or integrated circuit. The communication device 230 is used to implement the aforementioned communication method, for example... Figure 7 The communication method shown.

[0247] In one possible design, the communication device 230 includes a generation unit 2301 and a security protection unit 2302, and further includes a communication unit 2303. The generation unit 2301 is used to generate PDUs, for example, to perform one or more operations such as determining or generating. The security protection unit 2302 is used to perform security protection, for example, to perform one or more operations such as encryption or generating checksums. It should be understood that the unit division here is only illustrative; in a specific implementation, some units may be combined, or a single unit may be divided into multiple units. For example, the functions of the generation unit 2301 and the security protection unit 2302 may be performed by a processing unit.

[0248] In one possible implementation, the generation unit 2301 is used to generate a first PDU, and the security protection unit 2302 is used to perform security protection on the first PDU using the target identifiers corresponding to the first SDU segments. The first PDU includes a first SDU segment, which is one of M SDU segments obtained by segmenting a second SDU segment, where M is an integer and M≥2. The second SDU segment includes at least one of N SDU segments obtained by segmenting the SDU, where N is a positive integer. Each of the N SDU segments corresponds to N target identifiers, and each of the N target identifiers is used to perform security protection on the PDU corresponding to the N SDU segments. The target identifier corresponding to the first SDU segment is different from all of the aforementioned N target identifiers.

[0249] In another possible implementation, the communication device 230 further includes a communication unit 2303 for sending a first PDU that has been secured to the second node.

[0250] In another possible implementation, the security protection unit 2302 is used to encrypt the first PDU based on the target identifier, GFN and encryption key corresponding to the first SDU segment.

[0251] In another possible implementation, the security protection unit 2302 is used to generate a check code based on the target identifier, GFN, integrity protection key, and information contained in the first PDU corresponding to the first SDU segment. The check code is carried in the first PDU and is used to check the integrity of the information contained in the first PDU.

[0252] In another possible implementation, the security protection unit 2302 is used to encrypt the first PDU based on the target identifier, GFN, authentication encryption key, and information contained in the first SDU segment, and obtain a check code. The check code is carried in the first PDU and is used to check the integrity of the information contained in the first PDU.

[0253] For related descriptions, please refer to the descriptions in the foregoing embodiments, which will not be repeated here.

[0254] In another possible design, the communication device 230 includes a communication unit 2303 and a security protection unit 2302. The security protection unit 2302 is used to check the security of the data, for example, by performing one or more operations such as decryption and integrity checks. It should be understood that the unit division here is only illustrative; in a specific implementation, some units may be combined together, or a single unit may be divided into multiple units. Furthermore, the communication device 230 is used to execute the method performed by the second node in the aforementioned communication method.

[0255] In one possible implementation, the communication unit 2303 is used to receive a first PDU from a first node, and the security protection unit 2302 is used to check the security of the first PDU using the target identifier corresponding to the first SDU segment. The first PDU includes a first SDU segment, which is one of M SDU segments obtained by segmenting a second SDU segment, where M is an integer and M≥2. The second SDU segment includes at least one of N SDU segments, where N is a positive integer. Each of the N SDU segments corresponds to one of N target identifiers, and these N target identifiers are used to provide security protection for the PDUs corresponding to the N SDU segments. The target identifier corresponding to the first SDU segment is different from all of the N target identifiers.

[0256] In one possible implementation, the security protection unit 2302 is used to check the security of the first PDU using the target identifier and GFN corresponding to the first SDU segment, wherein the GFN is associated with the SDU.

[0257] In one possible implementation, the security protection unit 2302 is used to check the integrity of the information contained in the first PDU based on the target identifier, GFN, integrity protection key and check code corresponding to the first SDU segment.

[0258] In one possible implementation, the security protection unit 2302 is used to decrypt the first PDU and check the integrity of the information contained in the first PDU based on the target identifier, GFN, authentication encryption key, information contained in the PDU, and check code corresponding to the first SDU segment.

[0259] For related descriptions, please refer to the descriptions in the foregoing embodiments, which will not be repeated here.

[0260] Please see Figure 24 , Figure 24 This is a schematic diagram of another communication device provided in an embodiment of this application. The communication device 240 can be a standalone device, such as a node, or a component included within a standalone device, such as a chip, software module, or integrated circuit. The communication device 240 may include at least one processor 2401 and a memory 2403. Optionally, it may also include a communication interface 2402. Further optionally, it may also include a connection line 2404, wherein the processor 2401, the communication interface 2402, and / or the memory 2403 are connected via the connection line 2404, and / or communicate with each other via the connection line 2404 to transmit control signals and / or data signals.

[0261] in:

[0262] Processor 2401 is a module that performs arithmetic and / or logical operations, and may specifically include one or more of the following modules: filter, modem, power amplifier, low noise amplifier (LNA), baseband processor, radio frequency processor, radio frequency circuit, central processing unit (CPU), application processor (AP), microcontroller unit (MCU), electronic control unit (ECU), graphics processing unit (GPU), microprocessor unit (MPU), application specific integrated circuit (ASIC), image signal processor (ISP), digital signal processor (DSP), field programmable gate array (FPGA), complex programmable logic device (CPLD), or coprocessor, etc.

[0263] The communication interface 2402 can be used to provide information input or output to at least one processor, or to receive and / or transmit signals to externally transmitted signals. For example, the communication interface 2402 may include interface circuitry. For instance, the communication interface 2402 may include a wired link interface such as an Ethernet cable, or a wireless link interface (Wi-Fi, Bluetooth, general wireless transmission, vehicular short-range communication technology, and other short-range wireless communication technologies, etc.). Optionally, the communication interface 2402 may also include a radio frequency transmitter, an antenna, etc. If the communication interface 2402 includes an antenna, the number of antennas can be one or more.

[0264] As one possible design, if the communication device 240 is a standalone device, the communication interface 2402 may include a receiver and a transmitter. The receiver and transmitter may be the same component or different components. When the receiver and transmitter are the same component, this component may be referred to as a transceiver.

[0265] As another possible design, if the communication device 240 is a chip or circuit, the communication interface 2402 may include an input interface and an output interface, which may be the same interface or different interfaces.

[0266] Alternatively, the functions of the communication interface 2402 can be implemented by a transceiver circuit or a dedicated transceiver chip.

[0267] The memory 2403 provides storage space, in which data such as the operating system and computer programs can be stored. The memory 2403 can be one or a combination of several of the following: random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), or compact disc read-only memory (CD-ROM).

[0268] The functions and operations of each module or unit in the communication device 240 listed above are merely illustrative examples.

[0269] Each functional unit in the communication device 240 can be used to implement the aforementioned communication method, for example... Figure 7 The communication method shown is, for example, a method used to execute the first node or the second node.

[0270] Optionally, the processor 2401 may be a processor specifically designed to perform the aforementioned methods (for ease of distinction, referred to as a dedicated processor), or a processor that performs the aforementioned methods by calling a computer program (for ease of distinction, referred to as a dedicated processor). Optionally, at least one processor may include both dedicated processors and general-purpose processors.

[0271] Optionally, if the communication device 240 includes at least one memory 2403, and the processor 2401 implements the aforementioned communication method by calling a computer program, the computer program can be stored in the memory 2403.

[0272] This application also provides a chip, which includes logic circuitry and a communication interface. The communication interface is used to receive or transmit signals; the logic circuitry is used to receive or transmit signals through the communication interface. The chip is used to implement the aforementioned communication method, for example... Figure 7 The communication method shown.

[0273] This application also provides a computer-readable storage medium storing instructions that, when executed on at least one processor (or communication device), implement the aforementioned communication method, for example... Figure 7 The communication method shown.

[0274] This application also provides a computer program product, which includes computer instructions for implementing the aforementioned communication method, for example... Figure 7 The communication method shown.

[0275] This application embodiment also provides a terminal, which includes the aforementioned communication device 230 and / or communication device 240.

[0276] In one possible implementation, the terminal includes a terminal node. Further, the terminal also includes a first management node and / or a second management node. Further, the terminal also includes a control node.

[0277] For example, the terminal can include intelligent terminals or transportation tools such as vehicles, robots, drones, ships, and vessels. Among them, "vehicle" is a broad concept, which can include transportation tools (such as commercial vehicles, passenger cars, motorcycles, flying cars, trains, etc.), industrial vehicles (such as forklifts, trailers, tractors, etc.), engineering vehicles (such as excavators, bulldozers, cranes, etc.), agricultural equipment (such as lawnmowers, harvesters, etc.). As another example, "robot" can refer to automated guided vehicles (AGVs), walking conversational robots, service robots, etc.

[0278] It should be noted that, in the embodiments of this application, the words "exemplarily" or "for example" are used to indicate examples, illustrations, or explanations. Any embodiment or design scheme described as "exemplarily" or "for example" in this application should not be construed as being more preferred or advantageous than other embodiments or design schemes. Specifically, the use of the words "exemplarily" or "for example" is intended to present the relevant concepts in a specific manner.

[0279] In this embodiment, the names of information and devices are exemplarily chosen for ease of understanding of the content of this solution; in specific implementations, these names may have other designs. Furthermore, the names of the same thing can have different designs in different scenarios (e.g., different communication layers). For example, time resource configuration information can also be called reference information. As another example, different communication layers may use different names for encapsulating service data. At the application layer, the first service is transmitted directly as data, but at the network layer, the data of the first service is encapsulated in the message transmission of the first service.

[0280] In addition, a few additional points need to be made regarding this application:

[0281] 1. Unless otherwise stated, “multiple” means two or more.

[0282] 2. Unless otherwise specified or in case of logical conflict, the terms and / or descriptions in different embodiments of this application are consistent and can be referenced in each other. The technical features in different embodiments can be combined to form new embodiments according to their inherent logical relationships.

[0283] III. The various numerical designations used in this application are merely for descriptive convenience and are not intended to limit the scope of protection of this application. The magnitude of the serial numbers used in this application does not imply a sequential order of execution; the execution order of each process should be determined by its function and internal logic. For example, the terms "first," "second," "third," "fourth," and other various terminology (if present) in the specification, claims, and drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. Such data can be interchanged where appropriate so that the embodiments described herein can be implemented in a sequence other than that illustrated or described herein.

[0284] Furthermore, any embodiment or design described in this application as "exemplary" or "for example" should not be construed as being more preferred or advantageous than other embodiments or designs. Specifically, the use of terms such as "exemplary" or "for example" is intended to present the relevant concepts in a concrete manner for ease of understanding.

[0285] IV. The terms “comprising” and “having” and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are expressly listed, but may include other steps or units that are not expressly listed or that are inherent to such process, method, product or device.

[0286] V. In this application, "for indicating" can be understood as "enabling". "Enabling" can include direct enabling and indirect enabling. When describing information for enabling A, it can include whether the information directly enables A or indirectly enables A, but it does not mean that the information necessarily carries A.

[0287] The information that enables the information is called the information to be enabled. In the specific implementation process, there are many ways to enable the information to be enabled, such as, but not limited to, directly enabling the information to be enabled, such as the information to be enabled itself or its index. It can also be indirectly enabled by enabling other information, where there is a relationship between the other information and the information to be enabled. It can also enable only a part of the information to be enabled, while the other parts are known or pre-agreed upon. For example, enabling specific information can be achieved by using a pre-agreed (e.g., protocol-defined) arrangement of various pieces of information, thereby reducing enabling overhead to some extent. Simultaneously, common parts of various pieces of information can be identified and enabled uniformly to reduce the enabling overhead caused by individually enabling the same information.

[0288] VI. In this application, "predefined" may include preconfiguration. For example, predefining certain information means that the information is calculated or received in advance before performing an action that uses the information. The "predefined" can be implemented by pre-storing corresponding codes, tables, or other means that can be used to indicate relevant information in the device (e.g., in a controller or vehicle). This application does not limit the specific implementation method.

[0289] VII. The term "storage" or "preservation" in this application can refer to storage in one or more memory devices. These memory devices can be separately configured or integrated into an encoder, decoder, processor, or communication device. Alternatively, some memory devices can be separately configured, while others can be integrated into a decoder, processor, or communication device. The type of memory can be any form of storage medium, and this is not limited.

[0290] 8. In the schematic diagrams in the accompanying drawings of this application, the dashed arrows or boxes indicate optional steps or optional modules.

[0291] 9. Unless otherwise stated, " / " indicates that the objects before and after are in an "or" relationship. For example, A / B can mean A or B. In this application, "and / or" is merely a description of the relationship between the related objects, indicating that there can be three relationships. For example, A and / or B can mean: A exists alone, A and B exist simultaneously, and B exists alone. A and B can be singular or plural.

Claims

1. A communication method, characterized in that, include: Generate a first protocol data unit (PDU), the first PDU including a first service data unit (SDU) segment, the first SDU segment being one of M SDU segments obtained by segmenting a second SDU segment, where M is an integer and M≥2; The second SDU segment includes at least one of N SDU segments obtained by segmenting the SDU, where N is a positive integer. The N SDU segments correspond to N target identifiers, and the N target identifiers are used to provide security protection for the PDUs corresponding to the N SDU segments. The first PDU is protected by using the target identifier corresponding to the first SDU segment, and the target identifier corresponding to the first SDU segment is different from the N target identifiers.

2. The method according to claim 1, characterized in that, The target identifier corresponding to the first SDU segment is different from the target identifiers corresponding to the other SDU segments among the M SDU segments.

3. The method according to claim 1 or 2, characterized in that, The target identifier corresponding to the first SDU segment is different from all of the N target identifiers, including: the target identifier corresponding to the first SDU segment is increased by 1 based on the N target identifiers.

4. The method according to any one of claims 1-3, characterized in that, The target identifier includes a PDU sequence number, which is used to indicate the sequence number of the SDU segment.

5. The method according to claim 1 or 2, characterized in that, The target identifier includes segment offset values ​​and segment data lengths. The segment offset value is used to indicate the position of the first byte of the SDU segment within the SDU. The segmented data length is used to indicate the data length of the SDU segment.

6. The method according to claim 1 or 2, characterized in that, The target identifier includes the segment offset value and the number of retransmissions; The segment offset value is used to indicate the position of the first byte of the SDU segment within the SDU. The retransmission count indicates the number of times the content of the SDU segment is retransmitted.

7. The method according to claim 1 or 2, characterized in that, The target identifier includes the PDU sequence number and the number of retransmissions. The PDU sequence number is used to indicate the sequence number of the SDU segment. The retransmission count indicates the number of times the content of the SDU segment has been retransmitted.

8. The method according to claim 4 or 7, characterized in that, The first PDU also includes one or more of the following: the PDU sequence number of the first SDU segment, the segment offset value of the first SDU segment, and the number of retransmissions of the first SDU segment included in the first PDU.

9. The method according to any one of claims 1-8, characterized in that, The step of using the target identifier corresponding to the first SDU segment to perform security protection on the first PDU includes: The first PDU is protected by the target identifier and global frame number (GFN) corresponding to the first SDU segment, and the GFN is associated with the SDU.

10. The method according to claim 9, characterized in that, The method of using the target identifier and GFN corresponding to the first SDU segment to perform security protection on the first PDU includes: The first PDU is encrypted based on the target identifier, GFN, and encryption key corresponding to the first SDU segment.

11. The method according to claim 9, characterized in that, The method of using the target identifier and GFN corresponding to the first SDU segment to perform security protection on the first PDU includes: A check code is generated based on the target identifier, GFN, integrity protection key, and information contained in the first PDU segment; The check code is carried in the first PDU and is used to check the integrity of the information contained in the first PDU.

12. The method according to claim 9, characterized in that, The security protection of the first PDU using the target identifier and GFN corresponding to the first SDU segment includes: Based on the target identifier, GFN, authentication encryption key, and information contained in the PDU corresponding to the first SDU segment, the first PDU is encrypted to obtain a check code. The check code is carried in the first PDU and is used to check the integrity of the information contained in the first PDU.

13. A communication method, characterized in that, The communication method includes: Receive a first protocol data unit (PDU) from a first node. The first PDU includes a first service data unit (SDU) segment. The first SDU segment is one of M SDU segments obtained by segmenting a second SDU segment, where M is an integer and M≥2. The second SDU segment includes at least one of N SDU segments, where N is a positive integer. The N SDU segments correspond to N target identifiers, and the N target identifiers are used to provide security protection for the PDUs corresponding to the N SDU segments. The security of the first PDU is checked using the target identifier corresponding to the first SDU segment, and the target identifier corresponding to the first SDU segment is different from all of the N target identifiers.

14. The method according to claim 11, characterized in that, The target identifier corresponding to the first SDU segment is different from the target identifiers corresponding to the other SDU segments among the M SDU segments.

15. The method according to claim 13 or 14, characterized in that, The target identifier corresponding to the first SDU segment is different from all of the N target identifiers, including: the target identifier corresponding to the second SDU segment is increased by 1 based on the N target identifiers.

16. The method according to any one of claims 13-15, characterized in that, The target identifier includes a PDU sequence number, which is used to indicate the sequence number of the SDU segment.

17. The method according to claim 13 or 14, characterized in that, The target identifier includes segment offset values ​​and segment data lengths. The segment offset value is used to indicate the position of the first byte of the SDU segment within the SDU. The segmented data length is used to indicate the data length of the SDU segment.

18. The method according to claim 13 or 14, characterized in that, The target identifier includes the segment offset value and the number of retransmissions; The segment offset value is used to indicate the position of the first byte of the SDU segment within the SDU. The retransmission count indicates the number of times the content of the SDU segment is retransmitted.

19. The method according to claim 13 or 14, characterized in that, The target identifier includes the PDU sequence number and the number of retransmissions. The PDU sequence number is used to indicate the sequence number of the SDU segment. The retransmission count indicates the number of times the content of the SDU segment has been retransmitted.

20. The method according to claim 15 or 18, characterized in that, The first PDU also includes one or more of the following: the PDU sequence number of the first SDU segment, the segment offset value of the first SDU segment, and the number of retransmissions of the first SDU segment included in the first PDU.

21. The method according to any one of claims 13-20, characterized in that, The step of checking the security of the first PDU using the target identifier corresponding to the first SDU segment includes: The security of the first PDU is checked using the target identifier and global frame number (GFN) corresponding to the first SDU segment, where the GFN is associated with the SDU.

22. The method according to claim 21, characterized in that, The step of checking the security of the first PDU using the target identifier corresponding to the first SDU segment includes: The first PDU is decrypted based on the target identifier, GFN, and encryption key corresponding to the first SDU segment.

23. The method according to claim 21, characterized in that, The first PDU also carries a check code. The step of checking the security of the first PDU using the target identifier corresponding to the first SDU segment includes: Based on the target identifier, GFN, integrity protection key, and check code corresponding to the first SDU segment, the integrity of the information contained in the first PDU is checked.

24. The method according to claim 21, characterized in that, The first PDU also carries a check code. The step of checking the security of the first PDU using the target identifier corresponding to the first SDU segment includes: Based on the target identifier, GFN, authentication encryption key, information contained in the PDU, and the check code corresponding to the first SDU segment, the first PDU is decrypted and the integrity of the information contained in the first PDU is checked.

25. A communication device, characterized in that, The communication device includes a unit or module for performing the method according to any one of claims 1-12, or includes a unit or module for performing the method according to any one of claims 13-24.

26. A communication device, characterized in that, The communication device includes a processor and a memory, the memory being used to store computer instructions, and the processor being used to invoke the computer instructions stored in the memory to implement the method according to any one of claims 1-12, or to implement the method according to any one of claims 13-24.

27. A chip, characterized in that, It includes a processor and an interface circuit, wherein the interface circuit is used to receive signals from other communication devices and transmit them to the processor, or to send signals from the processor to other communication devices. The processor is configured to implement the method as described in any one of claims 1-12, or the method as described in any one of claims 13-24, through logic circuits or executing code instructions.

28. A communication system, characterized in that, The communication system includes a first node and a second node, wherein the first node is used to implement the method according to any one of claims 1-12, and the second node is used to implement the method according to any one of claims 13-24.

29. A readable storage medium, characterized in that, The readable storage medium is used to store a computer program that, when executed by a processor, causes a communication device including the processor to perform the method as described in any one of claims 1-24.

30. A computer program product, characterized in that, When the computer program product is executed by a processor, it causes a communication device including the processor to perform the method as described in any one of claims 1-24.

Images