Security information acquisition method, sending method, device, terminal and network side equipment

Abstract

The application discloses a security information acquisition method, a sending method, a device, a terminal and a network side equipment, and belongs to the technical field of communication. The security information acquisition method of the embodiment of the application comprises the following steps: a terminal receives a first message sent by a network side equipment, wherein the first message comprises security information of a MAC layer; and the terminal determines at least one of security algorithm information and a key of the MAC layer security based on the security information, wherein the key comprises at least one of an encryption key and an integrity protection key, and the security algorithm information comprises at least one of encryption algorithm information and integrity protection algorithm information.

Description

Technical Field

[0001] This application belongs to the field of communication technology, specifically relating to a secure information acquisition method, transmission method, apparatus, terminal, and network-side equipment. Background Technology

[0002] In communication systems, security can be improved by protecting certain communication content, such as by protecting certain communication content between the terminal and network-side equipment. However, current technologies only encrypt and protect the signaling radio bearer (SRB) and data radio bearer (DRB) transmitted between the terminal and network-side equipment, resulting in relatively poor communication security for the terminal. Summary of the Invention

[0003] This application provides a method for obtaining and sending secure information, an apparatus, a terminal, and a network-side device, which can solve the problem of poor communication security of terminals.

[0004] Firstly, a method for obtaining security information is provided, including:

[0005] The terminal receives a first message sent by the network-side device, the first message including security information from the Medium Access Control (MAC) layer;

[0006] The terminal determines at least one of the following based on the security information: security algorithm information and key for MAC layer security. The key includes at least one of the following: encryption key and integrity protection key. The security algorithm information includes at least one of the following: encryption algorithm information and integrity protection algorithm information.

[0007] Secondly, a method for sending secure information is provided, including:

[0008] The network-side device sends a first message to the terminal, which includes security information from the MAC layer.

[0009] Thirdly, a security information acquisition device is provided, comprising:

[0010] The receiving module is used to receive a first message sent by the network-side device, the first message including MAC layer security information;

[0011] The processing module is configured to determine at least one of the following based on the security information: security algorithm information and key for MAC layer security. The key includes at least one of the following: encryption key and integrity protection key. The security algorithm information includes at least one of the following: encryption algorithm information and integrity protection algorithm information.

[0012] Fourthly, a secure information transmission device is provided, comprising:

[0013] The sending module is used to send a first message to the terminal, the first message including security information of the Media Access Control (MAC) layer.

[0014] Fifthly, a security information acquisition device is provided, the device being configured to perform the steps of the method described in the first aspect.

[0015] In a sixth aspect, a security information transmission apparatus is provided, the apparatus being configured to perform the steps of the method described in the second aspect.

[0016] In a seventh aspect, a terminal is provided, including a processor and a memory, the memory storing a program or instructions executable on the processor, the program or instructions, when executed by the processor, implementing the steps of the method described in the first aspect.

[0017] Eighthly, a terminal is provided, including a processor and a communication interface, wherein the communication interface is used to receive a first message sent by a network-side device, the first message including security information of the Media Access Control (MAC) layer; the processor is used to determine at least one of security algorithm information and a key for MAC layer security based on the security information, the key including at least one of the following: an encryption key and an integrity protection key, and the security algorithm information including at least one of the following: encryption algorithm information and integrity protection algorithm information.

[0018] A ninth aspect provides a network-side device including a processor and a memory, the memory storing a program or instructions executable on the processor, the program or instructions, when executed by the processor, implementing the steps of the method as described in the second aspect.

[0019] In a tenth aspect, a network-side device is provided, including a processor and a communication interface, wherein the communication interface is used to send a first message to a terminal, the first message including security information of the Media Access Control (MAC) layer.

[0020] Eleventhly, a readable storage medium is provided, on which a program or instructions are stored, which, when executed by a processor, implement the steps of the method described in the first aspect, or implement the steps of the method described in the second aspect.

[0021] In a twelfth aspect, a wireless communication system is provided, comprising: a terminal and a network-side device, wherein the terminal is configured to perform the steps of the method described in the first aspect, and the network-side device is configured to perform the steps of the method described in the second aspect.

[0022] In a thirteenth aspect, a chip is provided, the chip including a processor and a communication interface coupled to the processor, the processor being configured to run a program or instructions to implement the steps of the method described in the first aspect, or to implement the steps of the method described in the second aspect.

[0023] In a fourteenth aspect, a computer program / program product is provided, which is stored in a storage medium and is executed by at least one processor to perform the steps of the method as described in the first aspect, or the computer program / program product is executed by at least one processor to perform the steps of the method as described in the second aspect.

[0024] In this embodiment, the terminal receives a first message sent by a network-side device. The first message includes MAC layer security information. Based on the security information, the terminal determines at least one of MAC layer security algorithm information and a key. The key includes at least one of the following: an encryption key and an integrity protection key. The security algorithm information includes at least one of the following: encryption algorithm information and integrity protection algorithm information. By determining at least one of the MAC layer security algorithm information and a key using the security information sent by the network-side device, MAC layer security protection is supported, thereby improving the terminal's communication security. Attached Figure Description

[0025] Figure 1 This is a block diagram of a wireless communication system applicable to embodiments of this application;

[0026] Figure 2 This is a schematic diagram of a protocol stack provided in an embodiment of this application;

[0027] Figure 3 This is a schematic diagram of another protocol stack provided in an embodiment of this application;

[0028] Figure 4 This is a flowchart of a security information acquisition method provided in an embodiment of this application;

[0029] Figure 5 This is a schematic diagram of a message provided in an embodiment of this application;

[0030] Figure 6 This is a schematic diagram of another message provided in an embodiment of this application;

[0031] Figure 7 This is a flowchart of a secure information transmission method provided in an embodiment of this application;

[0032] Figure 8 This is a schematic diagram of another secure information interaction provided in an embodiment of this application;

[0033] Figure 9 This is a schematic diagram of another secure information interaction provided in an embodiment of this application;

[0034] Figure 10 This is a schematic diagram of another secure information interaction provided in an embodiment of this application;

[0035] Figure 11 This is a schematic diagram of another secure information interaction provided in an embodiment of this application;

[0036] Figure 12 This is a schematic diagram of another secure information interaction provided in an embodiment of this application;

[0037] Figure 13 This is a schematic diagram of another secure information interaction provided in an embodiment of this application;

[0038] Figure 14 This is a structural diagram of a security information acquisition device provided in an embodiment of this application;

[0039] Figure 15 This is a structural diagram of a secure information transmission device provided in an embodiment of this application;

[0040] Figure 16 This is a structural diagram of a communication device provided in an embodiment of this application;

[0041] Figure 17 This is a structural diagram of a terminal provided in an embodiment of this application;

[0042] Figure 18 This is a structural diagram of a network-side device provided in an embodiment of this application. Detailed Implementation

[0043] The technical solutions of the embodiments of this application will be clearly described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application are within the scope of protection of this application.

[0044] The terms "first," "second," etc., used in this application are used to distinguish similar objects and not to describe a specific order or sequence. It should be understood that such terms can be used interchangeably where appropriate so that embodiments of this application can be implemented in orders other than those illustrated or described herein, and the objects distinguished by "first" and "second" are generally of the same class, not limited in number; for example, the first object can be one or more. Furthermore, "or" in this application indicates at least one of the connected objects. For example, the scope of protection for "A or B" covers at least three scenarios: Scenario 1: including A but not B; Scenario 2: including B but not A; Scenario 3: including both A and B. In addition, the terms "A and / or B," "at least one of A and B," and "at least one of A or B" also cover at least the above three scenarios. The character " / " generally indicates that the preceding and following objects are in an "or" relationship.

[0045] The term "instruction" in this application can be either a direct instruction (or explicit instruction) or an indirect instruction (or implicit instruction). A direct instruction can be understood as the sender explicitly informing the receiver of specific information, the required operation, or the requested result in the instruction sent. An indirect instruction can be understood as the receiver determining the corresponding information based on the instruction sent by the sender, or making a judgment and determining the required operation or requested result based on the judgment result.

[0046] It is worth noting that the technologies described in this application are not limited to Long Term Evolution (LTE) / LTE-Advanced (LTE-A) systems, but can also be used in other wireless communication systems, such as Code Division Multiple Access (CDMA), Time Division Multiple Access (TDMA), Frequency Division Multiple Access (FDMA), Orthogonal Frequency Division Multiple Access (OFDMA), Single-carrier Frequency-Division Multiple Access (SC-FDMA), or other systems. The terms "system" and "network" in this application are often used interchangeably, and the described technologies can be used with the systems and radio technologies mentioned above, as well as with other systems and radio technologies. The following description describes New Radio (NR) systems for illustrative purposes, and the term NR is used in most of the following description; however, these technologies can also be applied to systems other than NR systems, such as 6th generation (6G) radio systems. th Generation 6G communication system.

[0047] Figure 1This diagram illustrates a block diagram of a wireless communication system applicable to embodiments of this application. The wireless communication system includes a terminal 11 and a network-side device 12. The terminal 11 can also be referred to as User Equipment (UE), and can be a mobile phone, tablet computer, laptop computer, notebook computer, personal digital assistant (PDA), handheld computer, netbook, ultra-mobile personal computer (UMPC), mobile internet device (MID), augmented reality (AR), virtual reality (VR) device, robot, wearable device, flight vehicle, vehicle user equipment (VUE), shipboard equipment, pedestrian user equipment (PUE), smart home devices (home appliances with wireless communication capabilities, such as refrigerators, televisions, washing machines, or furniture), game consoles, personal computers (PCs), ATMs, or self-service machines, etc. Wearable devices include: smartwatches, smart bracelets, smart headphones, smart glasses, smart jewelry (smart bracelets, smart chains, smart rings, smart necklaces, smart anklets, smart anklets, etc.), smart wristbands, smart clothing, etc. Among these, in-vehicle devices can also be referred to as in-vehicle terminals, in-vehicle controllers, in-vehicle modules, in-vehicle components, in-vehicle chips, or in-vehicle units, etc. It should be noted that the specific type of terminal 11 is not limited in this application embodiment. Network-side equipment 12 may include access network equipment or core network equipment, wherein access network equipment may also be referred to as Radio Access Network (RAN) equipment, radio access network function, or radio access network unit. Access network equipment may include base stations, Wireless Local Area Network (WLAN) access points (APs), or Wireless Fidelity (WiFi) nodes, etc.Among them, base stations can be referred to as Node B (NB), Evolved Node B (eNB), Next Generation Node B (gNB), New Radio Node B (NR Node B), Access Point, Relay Base Station (RBS), Serving Base Station (SBS), Base Transceiver Station (BTS), Radio Base Station, Radio Transceiver, Basic Service Set (BSS), Extended Service Set (ESS), Home Node B (HNB), Home Evolved Node B, Transmit / Receive Point (TRP), Non-Terrestrial Network (NTN) equipment (such as satellite or high altitude platform stations). The term "base station" can be any suitable term in the field, such as "station" or any other appropriate term in the relevant field, as long as the same technical effect is achieved. The term "base station" is not limited to specific technical terms. It should be noted that the embodiments of this application only use the base station in the NR system as an example for introduction, and do not limit the specific type of base station.

[0048] Core network equipment, also known as core network nodes, core network functions, or core network elements, includes, but is not limited to, at least one of the following: Mobility Management Entity (MME), Access and Mobility Management Function (AMF), Session Management Function (SMF), User Plane Function (UPF), Policy Control Function (PCF), Policy and Charging Rules Function (PCRF), Edge Application Server Discovery Function (EASDF), Unified Data Management (UDM), Unified Data Repository (UDR), Home Subscriber Server (HSS), Centralized network configuration (CNC), Network Repository Function (NRF), Network Exposure Function (NEF), Local NEF (L-NEF), and Binding Support. Functions include: BSF (Broadcast Function), Application Function (AF), Location Management Function (LMF), Gateway Mobile Location Centre (GMLC), Network Data Analytics Function (NWDAF), Non-Terrestrial Network (NTN) equipment (e.g., satellite or high altitude platform station), Data Plane Function-Control (DPF-C), and Data Collection Coordination Function.DCCF), Data Plane Function-User (DPF-U), or Messaging Framework Adaptor Function (MFAF), etc. It should be noted that this application embodiment only uses core network equipment in the NR system as an example and does not limit the specific type of core network equipment. If the name of the core network equipment mentioned in this application embodiment changes in subsequent protocol versions (e.g., 6G), it will still be within the scope of protection of this application.

[0049] Optionally, the core network equipment can be implemented by one or more functional modules in a single device, or by multiple devices working together; this application does not specifically limit this. It is understood that the aforementioned functional modules can be network elements in hardware devices, software functional modules running on dedicated hardware, or virtualized functional modules instantiated on a platform (e.g., a cloud platform).

[0050] In some embodiments, the protocol stack of a mobile communication system is as follows: Figure 2 and 3 As shown, where, Figure 2 For the user plane protocol stack, Figure 3 This is the control plane protocol stack. The Packet Data Convergence Protocol (PDCP) layer at the sending end (terminal or network-side device) is responsible for encryption and / or integrity protection of higher-layer signaling (such as SRB) and data (such as DRB); the PDCP layer at the receiving end (network-side device or terminal) is responsible for decryption and / or integrity protection verification of the data received from the lower layers. If integrity protection (verification) is enabled, the receiving end's PDCP layer will deliver the processed signaling and data, after integrity protection verification, to the higher layers; if integrity protection (verification) is not enabled, the receiving end's PDCP layer will not perform integrity protection verification and will directly deliver the processed signaling and data (including at least PDCP header removal and potentially decryption if the sending end performed encryption) to the higher layers.

[0051] In some embodiments, the encryption function refers to the sending end generating a cipher (bit) stream based on encryption input parameters (serial number and key, etc.); performing operations on the cipher (bit) stream with the original plaintext data stream (bit stream) to obtain an encrypted data stream; and the receiving end, after receiving the encrypted data stream, performing the reverse operation of the sending end to obtain the decrypted data stream. Multiple encryption algorithms are supported; taking 5G as an example, these include, but are not limited to, 5G-EA0, 128-5G-EA1, 128-5G-EA2, 128-5G-EA3, 5G-EA4, 5G-EA5, 5G-EA6, or 5G-EA7.

[0052] In some embodiments, the integrity protection function refers to obtaining a bitstream of a preset length (e.g., 32 bits) based on input parameters (serial number, key, data to be protected, etc.), which is the Message Authentication Code for Integrity (MAC-I). Any change in the input parameters may lead to a change in the output MAC-I. The sending end sends the MAC-I (referred to as MAC-I-1) along with the data to be protected. After receiving it, the receiving end calculates the MAC-I (referred to as MAC-I-2) based on the data to be protected. The receiving end compares MAC-I-1 and MAC-I-2. If they are the same, it is considered that the data to be protected was sent by the expected sending end and has not been tampered with (assuming that the attacker does not have the key; therefore, it is impossible to generate the correct MAC-I after tampering with the data), that is, it passes the integrity verification. Among them, the integrity protection algorithm supports multiple types. Taking 5G as an example, it includes, but is not limited to, 5G-IA0, 128-5G-IA1, 128-5G-IA2, 128-5G-IA3, 5G-IA4, 5G-IA5, 5G-IA6, or 5G-IA7.

[0053] The following description, in conjunction with the accompanying drawings, details the security information acquisition method, transmission method, apparatus, terminal, and network-side device provided in this application through some embodiments and application scenarios.

[0054] Please see Figure 4 , Figure 4 This is a flowchart of a security information acquisition method provided in an embodiment of this application, such as... Figure 4 As shown, it includes the following steps:

[0055] Step 401: The terminal receives a first message sent by the network-side device, the first message including MAC layer security information.

[0056] The aforementioned security information may be information used to indicate MAC layer security protection, or it may include MAC security operation information, such as security algorithm information.

[0057] Step 402: The terminal determines at least one of the following based on the security information: MAC layer security algorithm information and key. The key includes at least one of the following: encryption key and integrity protection key. The security algorithm information includes at least one of the following: encryption algorithm information and integrity protection algorithm information.

[0058] The terminal may determine at least one of the following based on the security information: the security algorithm information and the key for MAC layer security:

[0059] The terminal determines the security algorithm information for MAC layer security based on the security information; or,

[0060] The terminal determines a secure MAC layer key based on the security information; or,

[0061] The terminal determines the security algorithm information and key for MAC layer security based on the security information.

[0062] For example, the terminal determines the security algorithm information based on the security information, and then derives the key based on the security algorithm information.

[0063] Specifically, given the security algorithm information, the terminal can perform security processing on the transmitted MAC CE based on the security algorithm information, and can also perform de-security processing on the received MAC CE based on the security algorithm information.

[0064] With a known key, the terminal can encrypt the sent MAC CE based on that key, and can decrypt the received MAC CE based on the security algorithm information.

[0065] Given the security algorithm information and key, the terminal can perform security processing on the transmitted MAC CE based on the security algorithm information and key, and can also perform de-security processing on the received MAC CE based on the security algorithm information and key.

[0066] The above-mentioned key includes at least one of encryption key and integrity protection key, which can be understood as: the above-mentioned key includes encryption key, or the above-mentioned key includes integrity protection key, or the above-mentioned key includes both encryption key and integrity protection key.

[0067] The encryption key mentioned above is an encryption key used in the encryption algorithm. For example, the encryption key is used by the network-side device to encrypt the MAC CE sent by the network-side device, and the terminal decrypts the MAC CE sent by the network-side device based on the encryption key. Alternatively, the encryption key is used by the terminal to encrypt the MAC CE sent by the network-side device, and the network-side device decrypts the MAC CE sent by the terminal based on the encryption key.

[0068] The aforementioned integrity protection key is a protection key used in the integrity protection algorithm. For example, the integrity protection key is used by the network-side device to perform integrity protection on the transmitted MAC CE, and the terminal verifies the MAC CE sent by the network-side device based on the integrity protection key. Alternatively, the integrity protection key is used by the terminal to perform integrity protection on the transmitted MAC CE, and the network-side device verifies the MAC CE sent by the terminal based on the integrity protection key.

[0069] The aforementioned security algorithm information, including at least one of encryption algorithm information and integrity protection algorithm information, can be understood as: security algorithm information, encryption algorithm information; or, the aforementioned security algorithm information includes integrity protection algorithm information; or, the aforementioned security algorithm information includes both encryption algorithm information and integrity protection algorithm information.

[0070] In other words, MAC layer security supports at least one of encryption and integrity protection.

[0071] The encryption algorithm information mentioned above can represent encryption algorithms. For example, taking a 5G system, it can include, but is not limited to: 5G-EA0, 128-5G-EA1, 128-5G-EA2, 128-5G-EA3, 5G-EA4, 5G-EA5, 5G-EA6, or 5G-EA7. There is no limitation on this. It can also be an encryption algorithm in 6G or 7G.

[0072] The above integrity protection algorithm information can represent integrity protection algorithms. For example, taking a 5G system, it can include, but is not limited to: 5G-IA0, 128-5G-IA1, 128-5G-IA2, 128-5G-IA3, 5G-IA4, 5G-IA5, 5G-IA6, or 5G-IA7. There is no limitation on this. It can also be an integrity protection algorithm in 6G or 7G.

[0073] The aforementioned MAC layer security, also known as MAC layer security protection or MAC layer security operation, can be at least one of MAC CE encryption and MAC CE integrity protection.

[0074] In this embodiment of the application, steps 401 and 402 can be referred to as the MAC layer security algorithm negotiation process.

[0075] In this embodiment, the terminal receives a first message sent by a network-side device. The first message includes MAC layer security information. Based on the security information, the terminal determines at least one of MAC layer security algorithm information and a key. The key includes at least one of the following: an encryption key and an integrity protection key. The security algorithm information includes at least one of the following: encryption algorithm information and integrity protection algorithm information. By determining at least one of the MAC layer security algorithm information and a key using the security information sent by the network-side device, MAC layer security protection is supported, thereby improving the terminal's communication security, such as enhancing communication security between the terminal and the network-side device.

[0076] As an optional implementation, the above method further includes at least one of the following:

[0077] The terminal receives a MACCE sent by the network-side device based on at least one of the aforementioned security algorithm information and key, wherein the MACCE is an encrypted and / or integrity-protected MACCE;

[0078] The terminal sends a MAC CE to the network-side device based on at least one of the aforementioned security algorithm information and key, wherein the MAC CE is an encrypted and / or integrity-protected MAC CE.

[0079] As an optional implementation, the security information is used to indicate at least one of the following:

[0080] Encryption algorithm information, integrity protection algorithm information, and first MAC-I.

[0081] Wherein, the aforementioned security information indicating at least one of encryption algorithm information, integrity protection algorithm information, and first MAC-I may be security information including at least one of encryption algorithm information, integrity protection algorithm information, and first MAC-I, or the aforementioned security information includes indication information of at least one of encryption algorithm information and integrity protection algorithm information, such as the identifier of the encryption algorithm, the identifier of the integrity protection algorithm, the parameters of the encryption algorithm, or the parameters of the integrity protection algorithm, etc.

[0082] It should be noted that, when the above security information is only used to indicate encryption algorithm information, the terminal can deduce integrity protection algorithm information based on the encryption algorithm information, such as when the terminal has a pre-obtained mapping relationship between integrity protection algorithm information and encryption algorithm information.

[0083] It should be noted that, when the aforementioned security information is only used to indicate integrity protection algorithm information, the terminal can deduce encryption algorithm information based on the integrity protection algorithm information. For example, if the terminal has a pre-existing mapping relationship between integrity protection algorithm information and encryption algorithm information, it can deduce the encryption algorithm information through this mapping relationship.

[0084] It should be noted that, when the above security information is only used to indicate the first MAC-I, the terminal can deduce encryption algorithm information and / or integrity protection algorithm information based on the first MAC-I. For example, if the terminal has obtained in advance the mapping relationship between the serial number or protected data corresponding to the first MAC-I and the integrity protection algorithm information and / or encryption algorithm information, the terminal can deduce the encryption algorithm information and / or integrity protection algorithm information based on the mapping relationship.

[0085] In the above embodiments, by indicating at least one of the encryption algorithm information, integrity protection algorithm information, and first MAC-I, the terminal can accurately determine at least one of the security algorithm information and key for MAC layer security.

[0086] As an optional implementation, the message type of the first message includes at least one of the following:

[0087] Radio Resource Control (RRC) messages and MAC CE (Control Element, CE).

[0088] In this implementation, security information of the MAC layer can be sent via RRC messages or MAC CE to support a more flexible negotiation process for the security algorithm of the MAC layer, so as to meet the needs of more scenarios or services.

[0089] In some implementations, the first message further includes at least one of the following:

[0090] Security information for SRB and security information for DRB.

[0091] The aforementioned security information for the SRB includes information used to negotiate the security algorithm for the SRB, such as at least one of the SRB's encryption algorithm information, integrity protection algorithm information, and MAC-I. Similarly, the aforementioned security information for the DRB includes information used to negotiate the security algorithm for the DRB, such as at least one of the DRB's encryption algorithm information, integrity protection algorithm information, and MAC-I.

[0092] In the case where the message type of the first message is an RRC message, the RRC message also includes security information of the SRB and the DRB; in the case where the message type of the first message is a MAC CE, the MAC CE also includes security information of the SRB and the DRB.

[0093] In this implementation, the security algorithm negotiation of the MAC layer, SRB and DRB can be achieved through the same first message, thereby eliminating the need to introduce additional messages and reducing transmission overhead.

[0094] In some implementations, the aforementioned MAC CE can be a novel MAC CE format, such as introducing a new Logical Channel Identity (LCID) value to identify the format and implement secure algorithm negotiation functions for the MAC layer. For example, a potential format design might be as follows: Figure 5 As shown, it includes at least one of the following:

[0095] R field: indicates at least one reserved bit.

[0096] The I field indicates which integrity algorithm, as defined in the protocol or RRC configuration, is configured for the terminal. The bit length of this field is fixed, for example, 2 bits. A value of 00 indicates the first integrity protection algorithm, 01 indicates the second integrity protection algorithm, and so on.

[0097] The E field indicates which encryption algorithm, as specified in the protocol or RRC configuration, is configured for the terminal. The bit length of this field is fixed; for example, 2 bits. A value of 00 indicates the first encryption algorithm, 01 indicates the second encryption algorithm, and so on.

[0098] MAC-I field: Represents the message verification code of the MAC CE. The MAC-I field is generated based on the integrity protection algorithm and integrity protection key of the MAC layer security. The length of the MAC-I field is agreed upon by the protocol or configured by the RRC message. Figure 5 Using the 32-bit standard agreed upon in the protocol as an example.

[0099] As an optional implementation, the terminal determines at least one of the following based on the security information: MAC layer security algorithm information and key:

[0100] If the first message passes the integrity protection check, the terminal determines at least one of the security algorithm information and key for MAC layer security based on the security information.

[0101] The first message passing the integrity protection check can be achieved by the terminal's PDCP layer or MAC layer performing the integrity protection check on the first message to determine that the first message passes the integrity protection check.

[0102] In this embodiment, since the terminal only determines at least one of the MAC layer security algorithm information and key based on the security information after the first message passes the integrity protection check, the MAC layer security algorithm information and key can be made more reliable, thereby further improving the communication security of the terminal.

[0103] It should be noted that, in this embodiment of the application, it is not limited to the terminal determining at least one of the MAC layer security algorithm information and key based on the security information when the first message passes the integrity protection check. For example, in some implementations, the integrity protection check of the first message may not be performed, that is, at least one of the MAC layer security algorithm information and key may be determined directly based on the first message, which can improve the negotiation efficiency.

[0104] As an optional implementation, if the first message is an RRC message and the first message passes the integrity protection check, the method further includes at least one of the following:

[0105] The terminal's RRC layer configures at least one of the security algorithm information and the key to the MAC layer;

[0106] The terminal's RRC layer indicates to the MAC layer that MAC layer security has been activated.

[0107] The configuration of at least one of the security algorithm information and the key by the RRC layer of the aforementioned terminal to the MAC layer may be as follows: when the RRC layer of the terminal determines the security algorithm information and the key based on the first message, it configures at least one of the security algorithm information and the key to the MAC layer. For example, the RRC layer of the terminal configures a MAC layer-secure encryption algorithm and a MAC layer-secure encryption key to the MAC layer of the terminal, and the RRC layer of the terminal configures a MAC layer-secure integrity protection algorithm and a MAC layer-secure integrity protection key to the MAC layer of the terminal.

[0108] Since the RRC layer configures at least one of the security algorithm information and the key to the MAC layer, the terminal's MAC layer can perform timely security protection.

[0109] The terminal's RRC layer indicating to the MAC layer that MAC layer security is activated can be achieved by the terminal's RRC layer determining that MAC layer security is activated upon receiving the first message or upon determining the security algorithm information and key, and then indicating to the MAC layer that MAC layer security is activated.

[0110] Since the terminal's RRC layer indicates to the MAC layer that MAC layer security has been activated, MAC layer security can be activated in a timely manner.

[0111] In some implementations, if the MAC layer obtains the security algorithm information and key, the MAC layer security is activated by default, which can save the terminal's interaction process.

[0112] As an optional implementation, the above method further includes at least one of the following:

[0113] If the first message passes the integrity protection check, the terminal sends a second message to the network-side device. The second message indicates at least one of the following: MAC layer security algorithm negotiation is completed, MAC layer security is activated, and a second MAC-I is performed.

[0114] If the first message fails the integrity protection check, the terminal sends a third message to the network-side device, the third message indicating at least one of the following: MAC layer security algorithm negotiation failed and MAC layer security was not activated.

[0115] The completion of the above-mentioned MAC layer security algorithm negotiation can be understood as the completion of negotiation of at least one of the MAC layer encryption algorithm and integrity protection algorithm.

[0116] The second or third message mentioned above can be an RRC message or a MAC CE. If the first message mentioned above is an RRC message, then the second or third message mentioned above is an RRC message. If the first message mentioned above is a MAC CE, then the second or third message mentioned above is a MAC CE.

[0117] In this implementation, the network-side device can be notified in a timely manner through the second or third message whether the MAC layer security algorithm has been negotiated or activated. If the negotiation is completed or activated, the network-side device can promptly adopt MAC layer security protection for the terminal. If the negotiation is not completed or activated, the network-side device can take corresponding actions based on its own implementation, such as sending a MAC CE that does not use MAC layer security to the terminal, or re-executing the negotiation or activation process.

[0118] As an optional implementation, if the first message fails the integrity protection check, the method further includes at least one of the following:

[0119] The terminal discards or ignores the first message;

[0120] The terminal determined that MAC layer security was not activated.

[0121] In this implementation, if the first message fails the integrity protection check, the first message is discarded or ignored and / or it is determined that MAC layer security is not activated. This ensures that at least one of the security algorithm information and key for MAC layer security is determined only if the first message passes the integrity protection check, and MAC layer security is activated, thereby further enhancing the communication security of the terminal.

[0122] As an optional implementation, the method further includes at least one of the following:

[0123] The terminal determines that MAC layer security has been activated based on the first message;

[0124] The terminal determines whether MAC layer security is activated or deactivated based on the fourth message.

[0125] The fourth message is used to activate or deactivate MAC layer security.

[0126] In this application embodiment, MAC layer security being activated can also be understood as enabling MAC layer security, or resuming MAC layer security, or configuring MAC layer security, or setting up configured MAC layer security.

[0127] In this embodiment of the application, deactivating MAC layer security can also be understood as disabling MAC layer security, suspending MAC layer security, deconfiguring MAC layer security, or releasing configured MAC layer security.

[0128] The aforementioned determination that MAC layer security is activated based on the first message can be either that the terminal is automatically activated when it obtains MAC layer security information, or that MAC layer security is automatically activated when the MAC layer algorithm negotiation process is completed based on the first message.

[0129] Since MAC layer security is activated based on the first message, transmission overhead can be reduced.

[0130] The message type of the fourth message mentioned above may include at least one of the following:

[0131] RRC messages and MAC CE.

[0132] In the case where the first message is an RRC message, the fourth message can be either an RRC message or a MAC CE message. In the case where the first message is a MAC CE message, the fourth message can be either an RRC message or a MAC CE message. This allows for a more flexible MAC layer security activation or deactivation process.

[0133] The fourth message mentioned above can be used to activate or deactivate MAC layer security. It can be used to activate or deactivate MAC layer security as a whole, that is, to activate or deactivate security for all MAC CEs. Here, "all MAC CEs" refers to all of at least one MAC CE that supports MAC layer security (or has MAC layer security protection requirements). Supporting MAC layer security or having MAC layer security protection requirements can be indicated by protocol agreement or RRC configuration to indicate which MAC CEs support MAC layer security or have MAC layer security protection requirements.

[0134] Alternatively, the fourth message mentioned above can be used to activate the security of all or part of MAC CE, or it can be used to deactivate the security of all or part of MAC CE.

[0135] The fourth message mentioned above allows for flexible activation or deactivation of MAC layer security, making the terminal's MAC layer security more flexible.

[0136] In some implementations, the fourth message includes at least one of the following:

[0137] MAC layer security indication information, said indication information being used for at least one of the following: activating the security of at least one MAC CE, and deactivating the security of at least one MAC CE;

[0138] Third MAC-I.

[0139] In cases where the aforementioned indication information is used to activate or deactivate the security of at least one MAC CE, the activated and deactivated MAC CEs are different MAC CEs. For example, the fourth message activating MAC layer security can be enabling at least one of integrity protection and encryption functions for at least one MAC CE, and the fourth message deactivating MAC layer security can be disabling at least one of integrity protection and encryption functions for at least one MAC CE. Here, the activated and deactivated MAC CEs are different MAC CEs. That is, in the same fourth message sent by the network-side device to the terminal, the security activation and deactivation indications will not be for the same MAC CE. Usually, the security activation indications are for some MAC CEs, and the deactivation indications are for others.

[0140] The third MAC-I mentioned above represents the message verification code of the fourth message. The third MAC-I can be generated based on the integrity protection algorithm and integrity protection key of the MAC layer security. The length of the MAC-I field in the fourth message is determined by the protocol or configured by the RRC message.

[0141] In some implementations, the MAC CE corresponding to the fourth message mentioned above is a new MAC CE format (introducing a new LCID value to identify this format), through which secure activation and / or deactivation functions at the MAC layer are achieved. A potential format design could be as follows: Figure 6 As shown, it includes at least one of the following:

[0142] R field: indicates at least one reserved bit.

[0143] The A / D field indicates which MAC CEs are activated or deactivated according to the protocol or RRC configuration. A bit value of 0 in the corresponding A / D field indicates that the corresponding MAC CE is deactivated, and a bit value of 1 indicates that the corresponding MAC CE is activated.

[0144] MAC-I field: Represents the message verification code of the aforementioned MAC CE. The MAC-I field is generated based on the integrity protection algorithm and integrity protection key of the MAC layer security. The length of the MAC-I field is agreed upon by the protocol or configured by the RRC message. Figure 6 The example uses the 32-bit standard agreed upon in the protocol.

[0145] In some implementations, the MAC CE corresponding to the fourth message mentioned above may include at least one of the following:

[0146] Semi-Persistent (SP) Channel State Information Reference Signal (CSI-RS) / CSI Interference Measurement (CSI-IM) Resource Set Activation / Deactivation MAC CE (SP CSI-RS / CSI-IM Resource Set Activation / Deactivation MAC CE);

[0147] Aperiodic CSI Trigger State Subselection MAC CE;

[0148] Transmission Configuration Indicator (TCI) states for UE-specific PDSCH MAC CE: Activation / Deactivation.

[0149] TCI State Indication for UE-specific PDCCH MAC CE;

[0150] SP CSI Reporting on PUCCH Activation / Deactivation MAC CE (SP CSI Reporting on PUCCH Activation / Deactivation MAC CE)

[0151] Enhanced SP CSI Reporting on PUCCH Activation / Deactivation MAC CE;

[0152] SP Sounding Reference Signal (SRS) activation / deactivation MAC CE;

[0153] Physical Uplink Control Channel (PUCCH) Spatial Relation Activation / Deactivation MAC CE;

[0154] Enhanced PUCCH Spatial Relation Activation / Deactivation MAC CE

[0155] Semi-continuous zero-power CSI-RS (Zero Power CSI-RS, SP ZP CSI-RS) resource set activation / deactivation MAC CE;

[0156] Recommended Bit Rate MAC CE;

[0157] Enhanced Spatial Relation Indication MAC CE for Semi-Continuous / Aperiodic SRS;

[0158] SRS Pathloss Reference RS Update MAC CE;

[0159] PUSCH Pathloss Reference RS Update MACCE;

[0160] Serving Cell Set-Based SRS Spatial Relation Indication MAC CE;

[0161] Semi-persistent positioning SRS activation / deactivation MAC CE;

[0162] Timing Delta MAC CE;

[0163] MAC CE (Guard Symbols MAC CEs);

[0164] Positioning Measurement Gap Activation / Deactivation Command MAC CE;

[0165] Positioning reference signal processing window (PPW) activation / deactivation command MAC CE;

[0166] MAC CE for Spatial Relation Activation / Deactivation for Multiple TRP PUCCH Repetition;

[0167] PUCCH Power Control Set Update for Multiple TRP PUCCH Repetition MAC CE;

[0168] Unified TCI States Activation / Deactivation MAC CE;

[0169] Differential Koffset MAC CE;

[0170] Solution 7: Timing Advance Offset MAC CE;

[0171] Downlink transmit power adjustment MAC CEs (DL TX Power Adjustment MAC CEs);

[0172] Child IAB-DU Restricted Beam Indication MACCE (Integrated Access and Backhaul-DataUnit, IAB-DU);

[0173] Timing Case Indication MAC CE;

[0174] Service Data Unit (SDU) Discard Activation / Deactivation MAC CE based on Policy Section Identifier (PSI);

[0175] Beam failure detection reference signal (BFD-RS) indicates MAC CE (BFD-RS Indication MAC CE).

[0176] IAB-MT Recommended Beam Indication MACCE (IAB-MT Recommended Beam Indication MAC CE)

[0177] Uplink power spectral density range adjustment MAC CE for Integrated Access and Backhaul (IAB);

[0178] Case 6 Timing Request MAC CE;

[0179] Neighbour Cell Relation (NCR) Backhaul Link Beam Indication MAC CEs;

[0180] NCR Access Link Beam Indication MAC CE;

[0181] Enhanced Unified TCI States Activation / Deactivation MAC CE;

[0182] L1 / L2 triggered Mobility (LTM) cell switch command MAC CE;

[0183] Enhanced L1 / L2 triggered mobility handover cell handover command (Enhanced LTM Cell SwitchCommand MAC CE);

[0184] Event Triggered L1 Measurement Report (MACCE);

[0185] Candidate Cell TCI States Activation / Deactivation MAC CE.

[0186] The fourth message can activate the security of some of the aforementioned MAC CEs, or deactivate the security of another portion of the MAC CEs; alternatively, the fourth message can activate the security of all of the aforementioned MAC CEs, or deactivate the security of all of the aforementioned MAC CEs.

[0187] In some implementations, the terminal determines whether MAC layer security is activated or deactivated based on a fourth message, including:

[0188] If the fourth message passes the integrity protection check, it is determined whether MAC layer security is activated or deactivated based on the fourth message.

[0189] In this embodiment, since the terminal only determines whether MAC layer security is activated or deactivated based on the fourth message after the fourth message passes the integrity protection check, the activation or deactivation of MAC layer security can be made more reliable, further improving the communication security of the terminal.

[0190] It should be noted that, in this embodiment of the application, the terminal is not limited to determining whether the MAC layer security is activated or deactivated based on the fourth message only when the fourth message passes the integrity protection check. For example, in some implementations, the integrity protection check of the fourth message may not be performed, that is, the MAC layer security may be determined directly based on the fourth message.

[0191] As an optional implementation, if the message type of the fourth message is an RRC message and the fourth message passes the integrity protection check, the method further includes at least one of the following:

[0192] When the fourth message is used to activate the security of the first MAC CE, the RRC layer of the terminal indicates to the MAC layer that the security of the first MAC CE has been activated;

[0193] In the case where the fourth message is used to deactivate the security of the second MAC CE, the RRC layer of the terminal indicates to the MAC layer that the security of the second MAC CE has been deactivated;

[0194] When the fourth message is used to activate MAC layer security, the terminal's RRC layer configures at least one of the security algorithm information and the key to the MAC layer;

[0195] In the case where the fourth message is used to deactivate MAC layer security, the terminal's RRC layer instructs the MAC layer to release at least one of the security algorithm information and the key.

[0196] Wherein, the first MAC CE is one or more MAC CEs that activate security in the fourth message, and the second MAC CE is one or more MAC CEs that deactivate security in the fourth message. The fourth message can simultaneously activate the security of the first MAC CE and deactivate the security of the second MAC CE.

[0197] In the case where the fourth message is used to activate MAC layer security, the terminal's RRC layer configuring at least one of the security algorithm information and the key to the MAC layer can be the case where the fourth message is used to activate the security of all MAC CEs, and the terminal's RRC layer configuring at least one of the security algorithm information and the key to the MAC layer.

[0198] In the case where the fourth message is used to deactivate MAC layer security, the terminal's RRC layer instructs the MAC layer to release at least one of the security algorithm information and the key.

[0199] In the above implementation, when the fourth message is an RRC message, the RRC layer can interact with the MAC CE in a timely manner, so that the MAC layer can activate or deactivate the MAC layer in a timely manner and release at least one of the security algorithm information and the key, thus saving MAC layer resources.

[0200] In some embodiments, the method further includes:

[0201] If the fourth message fails the integrity protection check, the terminal discards or ignores the fourth message; or,

[0202] If the fourth message fails the integrity protection check, the terminal discards or ignores the MAC layer security indication information in the fourth message.

[0203] The aforementioned MAC layer security indication information is used for at least one of the following: activating the security of at least one MAC CE, and deactivating the security of at least one MAC CE.

[0204] In this implementation, the terminal discards or ignores the fourth message if it fails the integrity protection check, in order to avoid erroneous activation or deactivation of MAC layer security and further improve the reliability of MAC layer security.

[0205] The aforementioned discarding or ignoring of the MAC layer security indication information in the fourth message may involve discarding or ignoring a portion of the indication in the fourth message, thereby allowing some scenarios or business terminals to perform corresponding operations based on other content indicated in the fourth message.

[0206] In some embodiments, the method further includes:

[0207] If the fourth message passes the integrity protection check, the terminal sends a fifth message to the network-side device, which indicates that MAC layer security activation or deactivation is complete.

[0208] In this embodiment, the network-side device is promptly notified of the completion of MAC layer security activation or deactivation via the aforementioned fifth message, enabling the network-side device to promptly transmit MAC layer securely with the terminal or promptly release the corresponding MAC layer secure resources, thereby improving the processing performance of the network-side device.

[0209] As an optional implementation, the above method further includes:

[0210] The terminal sends a sixth message to the network-side device, the sixth message being used to request activation or deactivation of MAC layer security.

[0211] The message type of the sixth message mentioned above may include at least one of the following:

[0212] RRC messages, MAC CE, Layer 1 (L1) signaling;

[0213] L1 signaling can be a dedicated preamble, a scheduling request (SR), or a wake-up signal (WUS).

[0214] In some implementations, the sixth message is sent by the terminal on demand.

[0215] The sixth message mentioned above allows the terminal to proactively request activation or deactivation of MAC layer security. If the network-side device receives the sixth message, it can send the fourth message to the terminal, and the network-side device will then re-initiate the MAC layer security activation or deactivation process. This makes MAC layer security more suitable for the terminal's current needs, thereby improving the overall performance of the terminal.

[0216] In some implementations, the activation or deactivation of the aforementioned MAC layer security can also be determined by the network-side device.

[0217] In this embodiment, the terminal receives a first message sent by a network-side device. The first message includes MAC layer security information. Based on the security information, the terminal determines at least one of MAC layer security algorithm information and a key. The key includes at least one of the following: an encryption key and an integrity protection key. The security algorithm information includes at least one of the following: encryption algorithm information and integrity protection algorithm information. By determining at least one of the MAC layer security algorithm information and a key using the security information sent by the network-side device, MAC layer security protection is supported, thereby improving the terminal's communication security.

[0218] Please see Figure 7 , Figure 7 This is a flowchart of a secure information transmission method provided in an embodiment of this application, such as... Figure 7 As shown, it includes the following steps:

[0219] Step 701: The network-side device sends a first message to the terminal, the first message including security information of the Media Access Control (MAC) layer.

[0220] Optionally, the security information is used to indicate at least one of the following:

[0221] Encryption algorithm information, integrity protection algorithm information, and the first integrity-based Message Authentication Code (MAC-I).

[0222] Optionally, the message type of the first message includes at least one of the following:

[0223] Radio Resource Control (RRC) messages and MAC Control Unit (CE).

[0224] Optionally, the first message further includes at least one of the following:

[0225] Security information for signaling radio bearers (SRBs) and data radio bearers (DRBs).

[0226] Optionally, the method further includes:

[0227] The network-side device receives a second message sent by the terminal, the second message indicating at least one of the following: MAC layer security algorithm negotiation completed, MAC layer security activated, and a second MAC-I; or...

[0228] The network-side device receives a third message sent by the terminal, the third message indicating at least one of the following: MAC layer security algorithm negotiation failed and MAC layer security was not activated.

[0229] Optionally, the first message may also be used to activate MAC layer security; or,

[0230] The method further includes:

[0231] The network-side device sends a fourth message to the terminal, which is used to activate or deactivate MAC layer security.

[0232] Optionally, the fourth message includes at least one of the following:

[0233] MAC layer security indication information, said indication information being used for at least one of the following: activating the security of at least one MAC CE, and deactivating the security of at least one MAC CE;

[0234] Third MAC-I.

[0235] Optionally, the method further includes:

[0236] The network-side device receives a fifth message sent by the terminal, which is used to indicate that MAC layer security activation or deactivation is complete.

[0237] Optionally, the method further includes:

[0238] The network-side device receives a sixth message sent by the terminal, which is used to request activation or deactivation of MAC layer security.

[0239] It should be noted that this embodiment is as a comparison with... Figure 4 The implementation methods of the network-side devices shown in the embodiments can be found in the following examples. Figure 4 To avoid repetition, the relevant descriptions of the embodiments shown will not be repeated in this embodiment.

[0240] The methods provided in the embodiments of this application are illustrated below through multiple examples:

[0241] In one embodiment provided in this application, a "MAC security algorithm negotiation process" is defined through the RRC protocol. This process enables the default activation of MAC layer security and facilitates inter-layer interaction between terminals.

[0242] The main idea of ​​this embodiment is to place the negotiation process of the MAC security algorithm in the RRC protocol definition, and automatically activate the MAC layer security when the algorithm negotiation process is successful, thereby achieving minimal changes to the protocol. Among them, the security algorithm for MAC security is configured and negotiated independently, and because the execution entity of MAC security is in the MAC layer, after the RRC layer completes the execution and confirms the activation of the MAC layer security, it is also necessary to send a corresponding security activation instruction to the MAC layer in order to promptly notify the MAC layer to enable the security function.

[0243] When the terminal is in RRC connection state, execute as follows: Figure 8 As shown, a series of steps:

[0244] Step 1: The terminal receives the first RRC message sent by the RAN node (i.e., the case where the first message is an RRC message). The first RRC message is used by the RAN node to initiate a MAC layer secure algorithm negotiation and / or security activation process to the terminal. The first RRC message includes at least one of the following: MAC layer secure encryption algorithm, MAC layer secure integrity protection algorithm, and MAC-I.

[0245] It should be noted that the first RRC message can be a protocol-defined RRC message combined with a new indication field, such as a Security Mode Command carrying a MAC security algorithm indication field. Alternatively, it can be a dedicated RRC message, such as introducing a new message, the MAC Security Command, where... Figure 8 The Security Mode Command is used as an example.

[0246] It should also be noted that the first RRC message further includes at least one of the following: integrity protection algorithms for SRB and DRB, and encryption algorithms for SRB and DRB.

[0247] It should also be noted that the first RRC message is not encrypted but is protected for integrity, and the MAC-I in the first RRC message is calculated and generated based on the SRB / RRC integrity protection algorithm and the SRB / RRC integrity protection key.

[0248] Step 2a: When the terminal receives the first RRC message, the terminal's RRC layer requests the terminal's PDCP layer to perform an integrity protection check on the first RRC message.

[0249] In some implementations, before requesting the terminal's PDCP layer to perform an integrity protection check on the first RRC message, the terminal's RRC layer needs to perform a series of operations, including: deriving the base station key (e.g., the K...).NB The SRB / RRC integrity protection key (e.g., the K) is derived based on the SRB / RRC integrity protection algorithm and base station key in the first RRC message. RRCint key).

[0250] In some implementations, when the terminal's RRC layer requests the terminal's PDCP layer to perform an integrity protection check on the first RRC message, it also needs to indicate the SRB / RRC integrity protection algorithm and the SRB / RRC integrity protection key in the first RRC message to the terminal's PDCP layer. Subsequently, the terminal's RRC layer receives the integrity protection check instruction from the terminal's PDCP layer to confirm whether the first RRC message has passed the integrity protection check.

[0251] Step 2b: If the first RRC message passes the integrity protection check, the terminal performs at least one of the following actions:

[0252] The MAC-layer secure encryption key is derived from the MAC-layer secure encryption algorithm in the first RRC message.

[0253] The MAC layer secure integrity protection key is derived based on the MAC layer secure integrity protection algorithm in the first RRC message.

[0254] It is assumed that the terminal's MAC layer security has been activated;

[0255] The phrase "considering that the terminal's MAC layer security is activated" also includes the inter-layer interaction between the terminal's RRC layer and MAC layer, specifically including at least one of the following:

[0256] The terminal's RRC layer indicates to the terminal's MAC layer that security has been activated;

[0257] The terminal's RRC layer configures the terminal's MAC layer with MAC-secure encryption algorithms and MAC-secure encryption keys;

[0258] The terminal's RRC layer configures the MAC layer secure integrity protection algorithm and MAC layer secure integrity protection key to the terminal's MAC layer.

[0259] If the first RRC message fails the integrity protection check, the terminal performs the following actions:

[0260] It is assumed that the terminal's MAC layer security is not activated; that is, the MAC CE transmission does not enable integrity protection and encryption functions.

[0261] Step 3: If the first RRC message passes the integrity protection check, the terminal sends a second RRC message to the RAN node. The second RRC message is used by the terminal to confirm to the RAN node that the MAC layer security algorithm negotiation is complete. The second RRC message includes a MAC-I.

[0262] It should be noted that the second RRC message can be a protocol-defined RRC message, such as Security Mode Command Complete. Alternatively, it can be a special RRC message, such as introducing a new message, MAC Security Command Complete. Figure 8 Take Security ModeCommand Complete as an example.

[0263] It should also be noted that the second RRC message is not encrypted but is protected for integrity, and the MAC-I in the second RRC message is generated based on the SRB / RRC integrity protection algorithm and the SRB / RRC key.

[0264] If the first RRC message fails the integrity protection check, the terminal sends a third RRC message to the RAN node. The third RRC message is used by the terminal to confirm to the RAN node that the MAC layer security algorithm negotiation and / or security activation process has failed.

[0265] It should be noted that the third RRC message can be a pre-defined RRC message, such as a Security Mode Command Failure RRC message. Alternatively, it can be a new RRC message, such as a MAC Security Command Failure RRC message. Figure 8 The Security ModeCommand Failure is used as an example.

[0266] In some implementations, the third RRC message is not securely protected, i.e., it is neither encrypted nor protected for integrity.

[0267] In some implementations, this embodiment does not limit the order in which steps 2a and 3 are executed. Figure 8 As an example only, one possibility is to execute step 2a first and then step 3.

[0268] In another embodiment provided in this application, the negotiation process of the MAC security algorithm is defined through the MAC protocol, and the completion of the process activates the MAC layer security by default.

[0269] The main idea of ​​this embodiment is: the core idea is similar to the previous embodiment. Compared with the previous embodiment, the entire "MAC security algorithm negotiation process and MAC layer security activation / deactivation process" are defined in the same layer of the MAC layer, which shortens the signaling interaction latency and avoids inter-layer interaction.

[0270] Specifically, the terminal is in RRC connected state, such as... Figure 9 As shown, a series of steps are performed:

[0271] Step 1: The terminal receives the first target MAC CE (i.e., the MAC CE corresponding to the first message mentioned above) sent by the RAN node. The first target MAC CE is used by the RAN node to initiate a MAC layer secure algorithm negotiation and / or security activation process to the terminal. The first target MAC CE includes at least one of the following: MAC layer secure encryption algorithm, MAC layer secure integrity protection algorithm, and MAC-I (Message Authentication Code-Integrity).

[0272] In some implementations, the first target MAC CE is a novel MAC CE format (introducing a new LCID value to identify the format), through which the secure algorithm negotiation function of the MAC layer is implemented. A potential format design is as follows: Figure 5 As shown, it includes at least one of the following:

[0273] R field: indicates at least one reserved bit.

[0274] The I field indicates which integrity algorithm, as defined in the protocol or RRC configuration, is configured for the terminal. The bit length of this field is fixed, for example, 2 bits. A value of 00 indicates the first integrity protection algorithm, 01 indicates the second integrity protection algorithm, and so on.

[0275] The E field indicates which encryption algorithm, as specified in the protocol or RRC configuration, is configured for the terminal. The bit length of this field is fixed; for example, 2 bits. A value of 00 indicates the first encryption algorithm, 01 indicates the second encryption algorithm, and so on.

[0276] MAC-I field: Represents the message verification code of the first target MAC CE. The MAC-I field is generated based on the MAC layer security integrity protection algorithm and integrity protection key. The length of the MAC-I field is agreed upon by the protocol or configured by the RRC message. Figure 5 Using the 32-bit standard agreed upon in the protocol as an example.

[0277] In some implementations, the first target MAC CE is not encrypted but is protected for integrity, and the MAC-I carried in the first target MAC CE is generated by calculating based on the MAC layer secure integrity protection algorithm and the MAC layer secure integrity protection key.

[0278] Step 2a: When the terminal receives the first target MAC CE, the MAC layer of the terminal performs an integrity protection check on the first target MAC CE.

[0279] In some implementations, before the terminal's MAC layer performs an integrity protection check on the first target MAC CE, a series of operations are required, including: deriving the base station key (e.g., the K...). NB The MAC security integrity protection key (e.g., the K key) is derived based on the integrity protection algorithm indicated by the first target MAC CE and the base station key. MACint key).

[0280] Step 2b: If the first target MAC CE passes the integrity protection check, the terminal performs at least one of the following actions:

[0281] The MAC-layer secure encryption key is derived based on the MAC-layer secure encryption algorithm in the first target MAC CE.

[0282] It is believed that the terminal's MAC layer security has been activated.

[0283] If the first target MAC CE fails the integrity protection check, the terminal performs the following actions:

[0284] Discard or ignore the first target MAC CE

[0285] It is assumed that the terminal's MAC layer security is not activated; that is, integrity protection and encryption functions are not enabled for MAC CE transmissions.

[0286] Step 3: If the first target MAC CE passes the integrity protection check, the terminal sends a second target MAC CE (i.e., the second message mentioned above, specifically the MAC CE corresponding to the second message) to the RAN node. The second target MAC CE is used by the terminal to confirm with the RAN node that the MAC layer security algorithm negotiation is completed. The second target MAC CE includes a MAC-I.

[0287] In some implementations, the second target MAC CE is a new MAC CE format (introducing a new LCID value to identify the format). The second target MAC CE is not encrypted but is protected for integrity, and the MAC-I of the second target MAC CE is generated based on the integrity protection algorithm and the integrity protection key of the MAC layer.

[0288] If the first target MAC CE fails the integrity protection check, the terminal sends a third MAC CE (i.e., the third message mentioned above, specifically the MAC CE corresponding to the third message) to the RAN node. The third MAC CE is used by the terminal to confirm to the RAN node that the MAC layer security algorithm negotiation and / or security activation process has failed.

[0289] In some implementations, the third MAC CE is a new MAC CE format (introducing a new LCID value to identify the format), and the fifth MAC CE is not securely protected (i.e., not encrypted and not protected for integrity), therefore it does not carry any valid content (payload).

[0290] In some implementations, the third MAC CE and the second target MAC CE can be designed with the same MAC CE format (e.g., distinguished by carrying different fields or different values ​​of the same field during actual transmission), or they can be designed with different MAC CE formats (e.g., distinguished by LCID values). This invention is not limited thereto.

[0291] In another embodiment provided in this application, the "MAC security algorithm negotiation process" and the "MAC layer security activation / deactivation process" are defined through the RRC protocol, as well as the inter-layer interaction of the terminal.

[0292] The main idea of ​​this embodiment is: this embodiment is a... Figure 8 Improvements to the illustrated embodiments, and Figure 8 The difference in the illustrated embodiment is that an additional RRC procedure for MAC layer security activation / deactivation is introduced, while Figure 8 The illustrated embodiment does not define a separate process for MAC layer security activation; instead, it uses a default method to automatically activate MAC layer security (and it will never be deactivated). Compared to Figure 8 The illustrated embodiment implements flexible control over MAC layer security activation / deactivation. For example, the RAN node can enable or disable MAC security on demand for certain terminals (e.g., operating in CA mode) or for certain specific conditions (e.g., energy-saving factors, service types, etc.), achieving a balance between communication security requirements and energy-saving requirements.

[0293] Specifically, the terminal is in RRC connected state, such as... Figure 10 As shown, a series of steps are performed:

[0294] Step 1: Same Figure 8 Step 1 in the illustrated embodiment.

[0295] Step 2a: Same Figure 8 Step 2a in the illustrated embodiment.

[0296] Step 2b: If the first RRC message passes the integrity protection check, the terminal performs at least one of the following actions:

[0297] The MAC-layer secure encryption key is derived from the MAC-layer secure encryption algorithm in the first RRC message.

[0298] The MAC layer secure integrity protection key is derived based on the MAC layer secure integrity protection algorithm in the first RRC message.

[0299] If the first RRC message fails the integrity protection check, the terminal performs the following actions:

[0300] It is assumed that the terminal's MAC layer security is not activated; that is, the MAC CE transmission does not enable integrity protection and encryption functions.

[0301] Step 3: Same Figure 8 Step 3 in the illustrated embodiment.

[0302] Step 4: The terminal receives the fourth RRC message (i.e. the fourth message mentioned above) sent by the RAN node. The fourth RRC message is used by the RAN node to initiate a MAC layer security activation or deactivation process to the terminal. The fourth RRC message includes MAC layer security activation or deactivation indication information.

[0303] It should be noted that the fourth RRC message can be a protocol-defined RRC message combined with a new indication field, such as an RRC reconfiguration message carrying a MAC security activation or deactivation indication field. Alternatively, it can be a dedicated RRC message, such as introducing a new message like a MAC security activation message. Figure 10 RRC Reconfiguration is used as an example.

[0304] In some implementations, the fourth RRC message is encrypted and integrity protected at the PDCP layer, and the MAC-I in the fourth RRC message is generated based on the SRB / RRC integrity protection algorithm and the SRB / RRC integrity protection key.

[0305] Step 5a: If the fourth RRC message includes a MAC layer security activation indicator or does not include a MAC layer security deactivation indicator, then the terminal performs at least one of the following actions:

[0306] It is assumed that the terminal's MAC layer security has been activated;

[0307] The phrase "considering the MAC layer security of the terminal to be activated" also includes inter-layer interaction, meaning the terminal further performs at least one of the following:

[0308] The terminal's RRC layer indicates to the terminal's MAC layer that security has been activated;

[0309] The RRC layer of the terminal configures the MAC layer with a MAC layer-secure encryption algorithm and a MAC layer-secure encryption key.

[0310] The terminal's RRC layer configures the MAC layer with a MAC layer-secure integrity protection algorithm and a MAC layer-secure integrity protection key.

[0311] Step 5b: If the fourth RRC message includes a MAC layer security deactivation indicator or does not include a MAC layer security activation indicator, then the terminal performs at least one of the following actions:

[0312] It is believed that the terminal's MAC layer security has been deactivated;

[0313] The phrase "considering the MAC layer security of the terminal to be deactivated" also includes inter-layer interaction, meaning that the terminal execution includes at least one of the following:

[0314] The terminal's RRC layer indicates to the terminal's MAC layer that security has been deactivated;

[0315] The RRC layer of the terminal instructs the MAC layer of the terminal to release the configured MAC layer secure encryption algorithm and MAC layer secure encryption key. Based on this instruction, the MAC layer of the terminal releases the configured MAC layer secure encryption algorithm and MAC layer secure encryption key.

[0316] The terminal's RRC layer instructs the terminal's MAC layer to release the configured MAC layer secure integrity protection algorithm and MAC layer secure integrity protection key. Based on this instruction, the terminal's MAC layer releases the configured MAC layer secure encryption algorithm and MAC layer secure encryption key.

[0317] Step 6: The terminal sends a fifth RRC message to the RAN node (i.e., the fifth message mentioned above). The fifth RRC message is used by the terminal to confirm to the RAN node that the MAC layer security activation or deactivation process is complete.

[0318] It should be noted that the fifth RRC message can be a pre-defined RRC message, such as an RRC Reconfiguration Complete message. Alternatively, it can be a new RRC message, such as a MAC Security Activation Complete message. Figure 10 RRC Reconfiguration is used as an example.

[0319] In some implementations, the fifth RRC message is encrypted and integrity protected at the PDCP layer, and the MAC-I in the fifth RRC message is generated based on the SRB / RRC integrity protection algorithm and the SRB / RRC integrity protection key.

[0320] In another embodiment provided in this application, the "MAC security algorithm negotiation process" is defined through the RRC protocol and the "MAC layer security activation / deactivation process" is defined through the MAC protocol, as well as the inter-layer interaction of the terminal.

[0321] The main idea of ​​this embodiment is: the core idea is similar. Figure 10 The illustrated embodiment also achieves the benefits of enabling / disabling secure MAC layer activation / deactivation indication and flexible control, but with... Figure 10 The difference in the illustrated embodiment is that, Figure 10 The illustrated embodiment introduces an RRC procedure for MAC layer security activation, while this embodiment defines security activation and deactivation at the MAC layer itself. Therefore, compared to... Figure 10 The advantage of the method shown in the embodiment is that it avoids inter-layer interaction within the terminal and reduces the overall interaction latency between the terminal and the RAN node.

[0322] Specifically, the terminal is in RRC connected state, such as... Figure 11 As shown, a series of steps are performed:

[0323] Step 1: Same Figure 8 Step 1 in the illustrated embodiment.

[0324] Step 2a: Same Figure 8 Step 2a in the illustrated embodiment.

[0325] Step 2b: Same Figure 8 Step 2b in the illustrated embodiment.

[0326] Step 3: Same Figure 8 Step 2b in the illustrated embodiment.

[0327] Step 4: The terminal receives the fourth MAC CE (i.e. the fourth message mentioned above) sent by the RAN node. The fourth MAC CE is used by the RAN node to initiate a MAC layer security activation or deactivation process to the terminal. The fourth MAC CE includes at least one of MAC layer security activation or deactivation indication information and MAC-I.

[0328] In some implementations, the fourth MAC CE is a new MAC CE format (introducing a new LCID value to identify the format), through which secure activation and / or deactivation functions at the MAC layer are achieved. A potential format design is as follows: Figure 6 As shown, it includes at least one of the following:

[0329] R field: indicates at least one reserved bit.

[0330] The A / D field indicates which MAC CEs are activated or deactivated according to the protocol or RRC configuration. A bit value of 0 in the corresponding A / D field indicates that the corresponding MAC CE is deactivated, and a bit value of 1 indicates that the corresponding MAC CE is activated.

[0331] MAC-I field: Represents the message verification code of the fourth MAC CE. The MAC-I field is generated based on the MAC layer secure integrity protection algorithm and integrity protection key. The length of the MAC-I field is agreed upon by the protocol or configured by the RRC message. Figure 6 Using the 32-bit standard agreed upon in the protocol as an example.

[0332] In some implementations, the fourth MAC CE is always securely protected, meaning that the transmission of the fourth MAC CE is enabled by default with at least one of MAC layer integrity protection and encryption functions.

[0333] Step 5a: If the fourth MAC CE includes a first field, and the value of the first field indicates that MAC layer security is activated, then the terminal performs at least one of the following actions:

[0334] It is assumed that the terminal's MAC layer security has been activated;

[0335] The phrase "considering the MAC layer security of the terminal to be activated" also includes inter-layer interaction, meaning the terminal further performs at least one of the following:

[0336] The MAC layer of the terminal obtains the configured MAC layer secure encryption algorithm and MAC layer secure encryption key from the RRC layer of the terminal;

[0337] The terminal's MAC layer obtains the configured MAC layer secure integrity protection algorithm and MAC layer secure integrity protection key from the terminal's RRC layer.

[0338] Step 5b: If the fourth MAC CE includes a first field, and the value of the first field indicates that MAC layer security is deactivated, then the terminal performs at least one of the following actions:

[0339] It is believed that the terminal's MAC layer security has been deactivated.

[0340] The terminal's MAC layer releases the configured MAC layer secure encryption algorithm and MAC layer secure encryption key.

[0341] The terminal's MAC layer releases the configured MAC layer secure encryption algorithm and MAC layer secure encryption key.

[0342] It should be noted that before step 5, the terminal may perform integrity protection verification and / or decryption on the fourth MAC CE. The fourth MAC CE will only be processed after the integrity protection verification and / or decryption are successful, i.e., steps 5a / 4b will be executed. If the integrity protection verification on the fourth MAC CE fails, the fourth MAC CE will be ignored or discarded, i.e., steps 5a / 4b will not be executed.

[0343] Step 6: The terminal sends a fifth MAC CE (i.e., the fifth message mentioned above) to the RAN node. The fifth MAC CE is used by the terminal to confirm to the RAN node that the MAC layer security activation or deactivation process is complete.

[0344] It should be noted that the fifth MAC CE is a new MAC CE format (introducing a new LCID value to identify this format), and the fifth MAC CE does not carry a valid content payload.

[0345] In some implementations, step 6 is optional in this embodiment. If step 6 is omitted or not supported, it can be assumed that the confirmation of the fourth MAC CE is achieved through a low-level feedback mechanism (e.g., HARQ feedback).

[0346] In some implementations, the fifth MAC CE is always securely protected, regardless of whether the MAC layer security is activated or deactivated. That is, the transmission of the fifth MAC CE is enabled by default with at least one of the MAC layer integrity protection and encryption functions.

[0347] In another embodiment provided in this application, the "MAC security algorithm negotiation process" and the "MAC layer security activation / deactivation process" are defined through the MAC protocol.

[0348] The main idea of ​​this embodiment is: this embodiment is a... Figure 9 Improvements to the illustrated embodiments, and Figure 9 The difference in the illustrated embodiment is that an additional MAC procedure for MAC layer security activation / deactivation is introduced, while Figure 9 The illustrated embodiment does not define a separate process for MAC layer security activation; instead, it uses a default method to automatically activate MAC layer security (and it will never be deactivated). Compared to Figure 9 The illustrated embodiment implements flexible control over MAC layer security activation / deactivation. For example, the RAN node can enable or disable MAC security on demand for certain terminals (e.g., operating in CA mode) or for certain specific conditions (e.g., energy-saving factors, service types, etc.), achieving a balance between communication security requirements and energy-saving requirements.

[0349] Specifically, the terminal is in RRC connected state, such as... Figure 12 As shown, a series of steps are performed:

[0350] Step 1: Same Figure 9 Step 1 in the illustrated embodiment.

[0351] Step 2a: Same Figure 9 Step 2a in the illustrated embodiment.

[0352] Step 2b: Same Figure 9 Step 2b in the illustrated embodiment.

[0353] Specifically, in this embodiment, the terminal only performs the action of "deriving the MAC layer secure encryption key based on the MAC layer secure encryption algorithm in the first MAC CE". The action of "considering the terminal's MAC layer security activated" is determined first through the reception and processing of the fourth MAC CE, and then in subsequent step 5.

[0354] Step 3: Same Figure 9 Step 3 in the illustrated embodiment.

[0355] Step 4: Same Figure 11 Step 4 in the illustrated embodiment.

[0356] Step 5a: If the fourth MAC CE includes a first field, and the value of the first field indicates that MAC layer security is activated, then the terminal performs at least one of the following actions:

[0357] It is believed that the terminal's MAC layer security has been activated.

[0358] Step 5b: If the fourth MAC CE includes a first field, and the value of the first field indicates that MAC layer security is deactivated, then the terminal performs at least one of the following actions:

[0359] It is believed that the terminal's MAC layer security has been deactivated.

[0360] Step 6: Same Figure 11 Step 6 in the illustrated embodiment.

[0361] In another embodiment provided in this application, the terminal requests the RAN node to enable or disable MAC layer security on demand.

[0362] The main idea of ​​this embodiment is to enable the terminal-assisted network to make better control decisions regarding MAC layer security activation / deactivation. For example, the RAN node's decision can also take into account terminal-side reported needs (such as terminal power saving, capability updates, etc.) to make a better security decision. This is primarily aimed at... Figure 10 , Figure 11 and Figure 12 The illustrated embodiment supports further improvements to the "MAC layer secure activation / deactivation process".

[0363] like Figure 13 As shown, before performing step 4, the terminal sends auxiliary information to the RAN node requesting MAC layer security activation or deactivation. The auxiliary information is carried in one of the following ways: sixth RRC message, sixth MAC CE, and L1 signaling (e.g., dedicated preamble, SR, or WUS signal).

[0364] Figure 13 The example uses an RRC message format (e.g., the sixth RRC message), where... Figure 13 One of the embodiments may be Figure 10 , Figure 11 or Figure 12 The example shown.

[0365] This application's embodiments introduce new security functions at the MAC layer to support encryption and / or integrity protection for some security-sensitive MAC CEs. While supporting MAC layer security, the main focus is on how the terminal and RAN node negotiate the MAC layer security algorithm and the process for MAC security activation.

[0366] The solution provided in this application can support on-demand security protection for some security-sensitive MAC CEs, thereby improving the security of wireless communication systems. Furthermore, by supporting the mechanism of enabling or disabling MAC layer security on demand, a compromise is achieved between ensuring communication security and energy efficiency.

[0367] The security information acquisition method provided in this application can be executed by a security information acquisition device. This application uses an example of a security information acquisition device executing the security information acquisition method to illustrate the security information acquisition device provided in this application.

[0368] The secure information sending method provided in this application can be executed by a secure information sending device. This application uses a secure information sending device executing the secure information sending method as an example to illustrate the secure information sending device provided in this application.

[0369] This application provides a security information acquisition device. As an example, the security information acquisition device may be a communication device or a component within a communication device, such as a chip. The communication device may be a terminal, a network-side device, or a server, etc. Exemplarily, the terminal may include, but is not limited to, the type of terminal 11 listed above, and the network-side device may include, but is not limited to, the type of network-side device 12 listed above. This application does not impose specific limitations.

[0370] A security information acquisition or transmission device includes a receiving module, a transmitting module, and a processing module. These modules can be implemented in software or hardware. When implemented in hardware, the processing module can be implemented by a processor. For example, the processor can include general-purpose processors, special-purpose processors, etc., such as central processing units (CPUs), microprocessors, digital signal processors (DSPs), artificial intelligence (AI) processors, graphics processing units (GPUs), application-specific integrated circuits (ASICs), network processors (NPs), field-programmable gate arrays (FPGAs), or other programmable logic devices, gate circuits, transistors, discrete hardware components, etc. The receiving and transmitting modules can be implemented by a communication interface, which can include one or more of the following: transceivers, pins, circuits, buses, radio frequency units, etc.

[0371] For details, see Figure 14 When the security information acquisition device is a terminal or a component within a terminal, the security information acquisition device 1400 includes:

[0372] The receiving module 1401 is used to receive a first message sent by the network-side device, the first message including security information of the Media Access Control (MAC) layer;

[0373] Processing module 1402 is used to determine at least one of the following based on the security information: security algorithm information and key for MAC layer security. The key includes at least one of the following: encryption key and integrity protection key. The security algorithm information includes at least one of the following: encryption algorithm information and integrity protection algorithm information.

[0374] Optionally, the security information is used to indicate at least one of the following:

[0375] Encryption algorithm information, integrity protection algorithm information, and the first integrity-based Message Authentication Code (MAC-I).

[0376] Optionally, the message type of the first message includes at least one of the following:

[0377] Radio Resource Control (RRC) messages and MAC Control Unit (CE).

[0378] Optionally, the first message further includes at least one of the following:

[0379] Security information for signaling radio bearers (SRBs) and data radio bearers (DRBs).

[0380] Optionally, the processing module 1402 is configured to determine at least one of the security algorithm information and key for MAC layer security based on the security information if the first message passes the integrity protection check.

[0381] Optionally, if the first message is an RRC message and the first message passes the integrity protection check, the processing module 1402 is further configured to perform at least one of the following:

[0382] The terminal's RRC layer configures at least one of the security algorithm information and the key to the MAC layer;

[0383] The terminal's RRC layer indicates to the MAC layer that MAC layer security has been activated.

[0384] Optionally, the apparatus further includes a transmitting module, the transmitting module being used for at least one of the following:

[0385] If the first message passes the integrity protection check, a second message is sent to the network-side device. The second message indicates at least one of the following: MAC layer security algorithm negotiation is completed, MAC layer security is activated, and a second MAC-I is performed.

[0386] If the first message fails the integrity protection check, a third message is sent to the network-side device, the third message indicating at least one of the following: MAC layer security algorithm negotiation failed and MAC layer security was not activated.

[0387] Optionally, if the first message fails the integrity protection check, the processing module 1402 is further configured to perform at least one of the following:

[0388] Discard or ignore the first message;

[0389] It has been determined that MAC layer security is not activated.

[0390] Optionally, the processing module 1402 is further configured to perform at least one of the following:

[0391] Based on the first message, it is determined that MAC layer security has been activated;

[0392] The fourth message determines whether MAC layer security is activated or deactivated.

[0393] The fourth message is used to activate or deactivate MAC layer security.

[0394] Optionally, the fourth message includes at least one of the following:

[0395] MAC layer security indication information, said indication information being used for at least one of the following: activating the security of at least one MAC CE, and deactivating the security of at least one MAC CE;

[0396] Third MAC-I.

[0397] Optionally, the processing module 1402 is configured to determine whether MAC layer security is activated or deactivated based on the fourth message if the fourth message passes the integrity protection check.

[0398] Optionally, the message type of the fourth message includes at least one of the following:

[0399] RRC messages and MAC CE;

[0400] If the message type of the fourth message is an RRC message, and the fourth message passes the integrity protection check, the processing module 1402 is further configured to perform at least one of the following:

[0401] When the fourth message is used to activate the security of the first MAC CE, the RRC layer of the terminal indicates to the MAC layer that the security of the first MAC CE has been activated;

[0402] In the case where the fourth message is used to deactivate the security of the second MAC CE, the RRC layer of the terminal indicates to the MAC layer that the security of the second MAC CE has been deactivated;

[0403] When the fourth message is used to activate MAC layer security, the terminal's RRC layer configures at least one of the security algorithm information and the key to the MAC layer;

[0404] In the case where the fourth message is used to deactivate MAC layer security, the terminal's RRC layer instructs the MAC layer to release at least one of the security algorithm information and the key.

[0405] Optionally, the processing module 1402 is also used for:

[0406] If the fourth message fails the integrity protection check, the fourth message is discarded or ignored; or...

[0407] If the fourth message fails the integrity protection check, the MAC layer security indication information in the fourth message is discarded or ignored.

[0408] Optionally, the sending module of the device is further configured to send a fifth message to the network-side device if the fourth message passes the integrity protection check, the fifth message being used to indicate that MAC layer security activation or deactivation is complete.

[0409] Optionally, the sending module of the device is further configured to send a sixth message to the network-side device, the sixth message being used to request activation or deactivation of MAC layer security.

[0410] The aforementioned security information acquisition device can enhance the communication security of the terminal.

[0411] The security information acquisition device provided in this application embodiment can achieve... Figure 4 The various processes implemented in the method embodiments shown achieve the same technical effects, and will not be described again here to avoid repetition.

[0412] For details, see Figure 15 When the security information transmitting device is a network-side device or a component within a network-side device, the security information transmitting device 1500 includes:

[0413] The sending module 1501 is used to send a first message to the terminal, the first message including security information of the Media Access Control (MAC) layer.

[0414] Optionally, the security information is used to indicate at least one of the following:

[0415] Encryption algorithm information, integrity protection algorithm information, and the first integrity-based Message Authentication Code (MAC-I).

[0416] Optionally, the message type of the first message includes at least one of the following:

[0417] Radio Resource Control (RRC) messages and MAC Control Unit (CE).

[0418] Optionally, the first message further includes at least one of the following:

[0419] Security information for signaling radio bearers (SRBs) and data radio bearers (DRBs).

[0420] Optionally, the device further includes a receiving module, the receiving module being used for:

[0421] The terminal receives a second message indicating at least one of the following: MAC layer security algorithm negotiation is complete; MAC layer security is activated; and a second MAC-I is performed; or...

[0422] The terminal receives a third message indicating at least one of the following: MAC layer security algorithm negotiation failed and MAC layer security was not activated.

[0423] Optionally, the first message may also be used to activate MAC layer security; or,

[0424] The sending module 1501 is also used to send a fourth message to the terminal, the fourth message being used to activate or deactivate MAC layer security.

[0425] Optionally, the fourth message includes at least one of the following:

[0426] MAC layer security indication information, said indication information being used for at least one of the following: activating the security of at least one MAC CE, and deactivating the security of at least one MAC CE;

[0427] Third MAC-I.

[0428] Optionally, the receiving module of the device is used to receive a fifth message sent by the terminal, the fifth message being used to indicate that MAC layer security activation or deactivation is complete.

[0429] Optionally, the receiving module of the device is used to receive a sixth message sent by the terminal, the sixth message being used to request activation or deactivation of MAC layer security.

[0430] The aforementioned security information transmission device can enhance the communication security of the terminal.

[0431] The security information transmission device provided in this application embodiment can achieve... Figure 7 The various processes implemented in the method embodiments shown achieve the same technical effects, and will not be described again here to avoid repetition.

[0432] like Figure 16 As shown in the illustration, this application also provides a communication device 1600, including a processor 1601 and a memory 1602. The memory 1602 stores a program or instructions that can run on the processor 1601. For example, when the communication device 1600 is a terminal, the program or instructions executed by the processor 1601 implement the various steps of the above-described security information acquisition method embodiment and achieve the same technical effect. When the communication device 1600 is a network-side device, the program or instructions executed by the processor 1601 implement the various steps of the above-described security information acquisition method embodiment and achieve the same technical effect. To avoid repetition, further details are omitted here.

[0433] This application embodiment also provides a terminal, including a processor and a communication interface, wherein the communication interface is coupled to the processor, and the processor is used to run programs or instructions to implement, for example... Figure 4 or Figure 7The steps in the method embodiment shown are illustrated. This terminal embodiment corresponds to the above-described terminal-side method embodiment. All implementation processes and methods of the above-described method embodiments can be applied to this terminal embodiment and achieve the same technical effect. The terminal can be... Figure 14 The security information acquisition device shown. Specifically, Figure 17 A schematic diagram of the hardware structure of a terminal to implement an embodiment of this application.

[0434] The terminal 1700 includes, but is not limited to, at least some of the following components: radio frequency unit 1701, network module 1702, audio output unit 1703, input unit 1704, sensor 1705, display unit 1706, user input unit 1707, interface unit 1708, memory 1709, and processor 1710.

[0435] Those skilled in the art will understand that the terminal 1700 may also include a power supply (such as a battery) for supplying power to various components. The power supply may be logically connected to the processor 1710 through a power management system, thereby enabling functions such as managing charging, discharging, and power consumption through the power management system. Figure 17 The terminal structure shown does not constitute a limitation on the terminal. The terminal may include more or fewer components than shown, or combine certain components, or have different component arrangements, which will not be elaborated here.

[0436] It should be understood that, in this embodiment, the input unit 1704 may include a graphics processor 17041 and a microphone 17042. The graphics processor 17041 processes image data of still images or videos obtained by an image capture device (such as a camera) in video capture mode or image capture mode. The display unit 1706 may include a display panel 17061, which may be configured in the form of a liquid crystal display, an organic light-emitting diode, or the like. The user input unit 1707 includes at least one of a touch panel 17071 and other input devices 17072. The touch panel 17071 is also called a touch screen. The touch panel 17071 may include a touch detection device and a touch controller. Other input devices 17072 may include, but are not limited to, physical keyboards, function keys (such as volume control buttons, power buttons, etc.), trackballs, mice, and joysticks, which will not be described in detail here.

[0437] In this embodiment, after receiving downlink data from the network-side device, the radio frequency unit 1701 can transmit it to the processor 1710 for processing; in addition, the radio frequency unit 1701 can send uplink data to the network-side device. Typically, the radio frequency unit 1701 includes, but is not limited to, antennas, amplifiers, transceivers, couplers, low-noise amplifiers, duplexers, etc.

[0438] The memory 1709 can be used to store software programs or instructions, as well as various data. The memory 1709 may primarily include a first storage area for storing programs or instructions and a second storage area for storing data. The first storage area may store the operating system, application programs or instructions required for at least one function (such as sound playback, image playback, etc.). Furthermore, the memory 1709 may include volatile memory or non-volatile memory. The non-volatile memory may be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. Volatile memory can be random access memory (RAM), static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous linked dynamic random access memory (SLDRAM), and direct memory bus RAM (DRRAM). The memory 1709 in this embodiment includes, but is not limited to, these and any other suitable types of memory.

[0439] Processor 1710 may include one or more processing units; optionally, processor 1710 integrates an application processor and a modem processor, wherein the application processor mainly handles operations involving the operating system, user interface, and applications, and the modem processor mainly handles wireless communication signals, such as a baseband processor. It is understood that the aforementioned modem processor may also not be integrated into processor 1710.

[0440] The radio frequency unit 1701 is used to receive a first message sent by the network-side device, the first message including security information of the Media Access Control (MAC) layer.

[0441] The processor 1710 is configured to determine, based on the security information, at least one of security algorithm information and a key for MAC layer security, wherein the key includes at least one of the following: an encryption key and an integrity protection key, and the security algorithm information includes at least one of the following: encryption algorithm information and integrity protection algorithm information.

[0442] Optionally, the security information is used to indicate at least one of the following:

[0443] Encryption algorithm information, integrity protection algorithm information, and the first integrity-based Message Authentication Code (MAC-I).

[0444] Optionally, the message type of the first message includes at least one of the following:

[0445] Radio Resource Control (RRC) messages and MAC Control Unit (CE).

[0446] Optionally, the first message further includes at least one of the following:

[0447] Security information for signaling radio bearers (SRBs) and data radio bearers (DRBs).

[0448] Optionally, determining at least one of the security algorithm information and key based on the security information for MAC layer security includes:

[0449] If the first message passes the integrity protection check, at least one of the security algorithm information and key for MAC layer security is determined based on the security information.

[0450] Optionally, if the first message is an RRC message and the first message passes the integrity protection check, the processor 1710 is further configured to perform at least one of the following:

[0451] The terminal's RRC layer configures at least one of the security algorithm information and the key to the MAC layer;

[0452] The terminal's RRC layer indicates to the MAC layer that MAC layer security has been activated.

[0453] Optionally, the radio frequency unit 1701 is also used for at least one of the following:

[0454] If the first message passes the integrity protection check, a second message is sent to the network-side device. The second message indicates at least one of the following: MAC layer security algorithm negotiation is completed, MAC layer security is activated, and a second MAC-I is performed.

[0455] If the first message fails the integrity protection check, a third message is sent to the network-side device, the third message indicating at least one of the following: MAC layer security algorithm negotiation failed and MAC layer security was not activated.

[0456] Optionally, if the first message fails the integrity protection check, the processor 1710 further performs at least one of the following:

[0457] Discard or ignore the first message;

[0458] It has been determined that MAC layer security is not activated.

[0459] Optionally, the processor 1710 is also used for at least one of the following:

[0460] Based on the first message, it is determined that MAC layer security has been activated;

[0461] The fourth message determines whether MAC layer security is activated or deactivated.

[0462] The fourth message is used to activate or deactivate MAC layer security.

[0463] Optionally, the fourth message includes at least one of the following:

[0464] MAC layer security indication information, said indication information being used for at least one of the following: activating the security of at least one MAC CE, and deactivating the security of at least one MAC CE;

[0465] Third MAC-I.

[0466] Optionally, determining whether MAC layer security is activated or deactivated based on the fourth message includes:

[0467] If the fourth message passes the integrity protection check, it is determined whether MAC layer security is activated or deactivated based on the fourth message.

[0468] Optionally, the message type of the fourth message includes at least one of the following:

[0469] RRC messages and MAC CE;

[0470] If the message type of the fourth message is an RRC message, and the fourth message passes the integrity protection check, the processor 1710 further performs at least one of the following:

[0471] When the fourth message is used to activate the security of the first MAC CE, the RRC layer of the terminal indicates to the MAC layer that the security of the first MAC CE has been activated;

[0472] In the case where the fourth message is used to deactivate the security of the second MAC CE, the RRC layer of the terminal indicates to the MAC layer that the security of the second MAC CE has been deactivated;

[0473] When the fourth message is used to activate MAC layer security, the terminal's RRC layer configures at least one of the security algorithm information and the key to the MAC layer;

[0474] In the case where the fourth message is used to deactivate MAC layer security, the terminal's RRC layer instructs the MAC layer to release at least one of the security algorithm information and the key.

[0475] Optionally, the processor 1710 is also used for:

[0476] If the fourth message fails the integrity protection check, the fourth message is discarded or ignored; or...

[0477] If the fourth message fails the integrity protection check, the MAC layer security indication information in the fourth message is discarded or ignored.

[0478] Optionally, the radio frequency unit 1701 is also used for:

[0479] If the fourth message passes the integrity protection check, the terminal sends a fifth message to the network-side device. The fifth message is used to indicate that MAC layer security activation or deactivation is complete.

[0480] Optionally, the radio frequency unit 1701 is also used for:

[0481] A sixth message is sent to the network-side device, the sixth message being used to request activation or deactivation of MAC layer security.

[0482] The aforementioned terminals can enhance terminal communication security.

[0483] It is understood that the implementation process of each implementation method mentioned in this embodiment can refer to the relevant description of the method embodiment and achieve the same or corresponding technical effect. To avoid repetition, it will not be described again here.

[0484] This application embodiment also provides a network-side device, including a processor and a communication interface, wherein the communication interface is coupled to the processor, and the processor is used to run programs or instructions to implement, for example... Figure 7 The steps of the method embodiment shown are illustrated. This network-side device embodiment corresponds to the above-described receiving or transmitting end method embodiment. All implementation processes and methods of the above-described method embodiments can be applied to this network-side device embodiment and can achieve the same technical effect.

[0485] Specifically, embodiments of this application also provide a network-side device, which can be... Figure 15 The security information transmission device shown. Figure 18As shown, the network-side device 1800 includes: an antenna 1801, a radio frequency (RF) device 1802, a baseband device 1803, a processor 1804, and a memory 1805. The antenna 1801 is connected to the RF device 1802. In the uplink direction, the RF device 1802 receives information through the antenna 1801 and transmits the received information to the baseband device 1803 for processing. In the downlink direction, the baseband device 1803 processes the information to be transmitted and sends it to the RF device 1802. The RF device 1802 processes the received information and transmits it through the antenna 1801.

[0486] The method executed by the network-side device in the above embodiments can be implemented in the baseband device 1803, which includes a baseband processor.

[0487] The baseband device 1803 may, for example, include at least one baseband board on which multiple chips are disposed, such as... Figure 18 As shown, one of the chips is, for example, a baseband processor, which is connected to the memory 1805 via a bus interface to call the program or instructions in the memory 1805 to execute the network-side device operations shown in the above method embodiment.

[0488] The network-side device may also include a network interface 1806, such as a Common Public Radio Interface (CPRI).

[0489] The radio frequency device 1802 is used to send a first message to the terminal, the first message including security information of the Media Access Control (MAC) layer.

[0490] Optionally, the security information is used to indicate at least one of the following:

[0491] Encryption algorithm information, integrity protection algorithm information, and the first integrity-based Message Authentication Code (MAC-I).

[0492] Optionally, the message type of the first message includes at least one of the following:

[0493] Radio Resource Control (RRC) messages and MAC Control Unit (CE).

[0494] Optionally, the first message further includes at least one of the following:

[0495] Security information for signaling radio bearers (SRBs) and data radio bearers (DRBs).

[0496] Optionally, the radio frequency device 1802 is further configured to receive a second message sent by the terminal, the second message indicating at least one of the following: MAC layer security algorithm negotiation completed, MAC layer security activated, and a second MAC-I; or,

[0497] The network-side device receives a third message sent by the terminal, the third message indicating at least one of the following: MAC layer security algorithm negotiation failed and MAC layer security was not activated.

[0498] Optionally, the first message may also be used to activate MAC layer security; or,

[0499] The radio frequency device 1802 is also used to send a fourth message to the terminal, the fourth message being used to activate or deactivate MAC layer security.

[0500] Optionally, the fourth message includes at least one of the following:

[0501] MAC layer security indication information, said indication information being used for at least one of the following: activating the security of at least one MAC CE, and deactivating the security of at least one MAC CE;

[0502] Third MAC-I.

[0503] Optionally, the radio frequency device 1802 is further configured to receive a fifth message sent by the terminal, the fifth message being used to indicate that MAC layer security activation or deactivation is complete.

[0504] Optionally, the radio frequency device 1802 is also configured to receive a sixth message sent by the terminal, the sixth message being used to request activation or deactivation of MAC layer security.

[0505] The aforementioned network-side equipment can enhance the communication security of terminals.

[0506] Furthermore, the network-side device 1800 in this embodiment of the application also includes: a program or instructions stored in a memory 1805 and executable on a processor 1804, wherein the processor 1804 calls the program or instructions in the memory 1805 to execute. Figure 15 The methods executed by each module shown achieve the same technical effect, and to avoid repetition, they will not be described in detail here.

[0507] This application also provides a readable storage medium storing a program or instructions. When the program or instructions are executed by a processor, they implement the various processes of the above-described security information acquisition method or security information transmission method embodiments and achieve the same technical effect. To avoid repetition, they will not be described again here.

[0508] The processor mentioned above is either the processor in the terminal described in the above embodiments or the processor in the network-side device. The readable storage medium includes computer-readable storage media, such as computer read-only memory (ROM), random access memory (RAM), magnetic disk, or optical disk. In some examples, the readable storage medium may be a non-transient readable storage medium.

[0509] This application embodiment also provides a chip, which includes a processor and a communication interface. The communication interface is coupled to the processor. The processor is used to run programs or instructions to implement the various processes of the above-described security information acquisition method or security information sending method embodiments, and can achieve the same technical effect. To avoid repetition, it will not be described again here.

[0510] It should be understood that the chip mentioned in the embodiments of this application may also be referred to as a system-on-a-chip, system chip, chip system, or system-on-a-chip, etc.

[0511] This application also provides a computer program / program product, which is stored in a storage medium and executed by at least one processor to implement the various processes of the above-described security information acquisition method or security information transmission method embodiments, and can achieve the same technical effect. To avoid repetition, it will not be described again here.

[0512] This application also provides a wireless communication system, including: a terminal and a network-side device, wherein the terminal can be used to perform the steps of the security information acquisition method described above, and the network-side device can be used to perform the steps of the security information transmission method described above.

[0513] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element. Furthermore, it should be noted that the scope of the methods and apparatuses in the embodiments of this application is not limited to performing functions in the order shown or discussed, but may also include performing functions substantially simultaneously or in the reverse order, depending on the functions involved. For example, the described methods may be performed in a different order than described, and various steps may be added, omitted, or combined. Additionally, features described with reference to certain examples may be combined in other examples.

[0514] From the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of computer software products plus necessary general-purpose hardware platforms, and of course, they can also be implemented by hardware. The computer software product is stored in a storage medium (such as ROM, RAM, magnetic disk, optical disk, etc.), and the computer software product includes several instructions to cause the terminal or network-side device to execute the methods described in the various embodiments of this application.

[0515] The embodiments of this application have been described above with reference to the accompanying drawings. However, this application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other implementations under the guidance of this application without departing from the spirit and scope of the claims. All of these implementations are within the protection scope of this application.

Claims

1. A method for acquiring security information, characterized in that, include: The terminal receives a first message sent by the network-side device, the first message including security information of the Media Access Control (MAC) layer; The terminal determines at least one of the following based on the security information: security algorithm information and key for MAC layer security. The key includes at least one of the following: encryption key and integrity protection key. The security algorithm information includes at least one of the following: encryption algorithm information and integrity protection algorithm information.

2. The method according to claim 1, characterized in that, The security information is used to indicate at least one of the following: Encryption algorithm information, integrity protection algorithm information, and the first integrity-based Message Authentication Code (MAC-I).

3. The method according to claim 1 or 2, characterized in that, The message type of the first message includes at least one of the following: Radio Resource Control (RRC) messages and MAC Control Unit (CE).

4. The method according to any one of claims 1 to 3, characterized in that, The first message also includes at least one of the following: Security information for signaling radio bearers (SRBs) and data radio bearers (DRBs).

5. The method according to any one of claims 1 to 4, characterized in that, The terminal determines at least one of the security algorithm information and key for MAC layer security based on the security information, and further includes: If the first message passes the integrity protection check, the terminal determines at least one of the security algorithm information and key for MAC layer security based on the security information.

6. The method according to claim 5, characterized in that, If the first message is an RRC message and the first message passes the integrity protection check, the method further includes at least one of the following: The terminal's RRC layer configures at least one of the security algorithm information and the key to the MAC layer; The terminal's RRC layer indicates to the MAC layer that MAC layer security has been activated.

7. The method according to claim 5 or 6, characterized in that, The method further includes at least one of the following: If the first message passes the integrity protection check, the terminal sends a second message to the network-side device. The second message indicates at least one of the following: MAC layer security algorithm negotiation is completed, MAC layer security is activated, and a second MAC-I is performed. If the first message fails the integrity protection check, the terminal sends a third message to the network-side device, the third message indicating at least one of the following: MAC layer security algorithm negotiation failed and MAC layer security was not activated.

8. The method according to any one of claims 5 to 7, characterized in that, If the first message fails the integrity protection check, the method further includes at least one of the following: The terminal discards or ignores the first message; The terminal determined that MAC layer security was not activated.

9. The method according to any one of claims 1 to 8, characterized in that, The method further includes at least one of the following: The terminal determines that MAC layer security has been activated based on the first message; The terminal determines whether MAC layer security is activated or deactivated based on the fourth message. The fourth message is used to activate or deactivate MAC layer security.

10. The method according to claim 9, characterized in that, The fourth message includes at least one of the following: MAC layer security indication information, said indication information being used for at least one of the following: activating the security of at least one MAC CE, and deactivating the security of at least one MAC CE; Third MAC-I.

11. The method according to claim 9 or 10, characterized in that, The terminal determines whether MAC layer security is activated or deactivated based on the fourth message, including: If the fourth message passes the integrity protection check, it is determined whether MAC layer security is activated or deactivated based on the fourth message.

12. The method according to any one of claims 9 to 11, characterized in that, The message type of the fourth message includes at least one of the following: RRC messages and MAC CE; If the message type of the fourth message is an RRC message, and the fourth message passes the integrity protection check, the method further includes at least one of the following: When the fourth message is used to activate the security of the first MAC CE, the RRC layer of the terminal indicates to the MAC layer that the security of the first MAC CE has been activated; In the case where the fourth message is used to deactivate the security of the second MAC CE, the RRC layer of the terminal indicates to the MAC layer that the security of the second MAC CE has been deactivated; When the fourth message is used to activate MAC layer security, the terminal's RRC layer configures at least one of the security algorithm information and the key to the MAC layer; In the case where the fourth message is used to deactivate MAC layer security, the terminal's RRC layer instructs the MAC layer to release at least one of the security algorithm information and the key.

13. The method according to any one of claims 9 to 12, characterized in that, The method further includes: If the fourth message fails the integrity protection check, the terminal discards or ignores the fourth message; or, If the fourth message fails the integrity protection check, the terminal discards or ignores the MAC layer security indication information in the fourth message.

14. The method according to any one of claims 9 to 13, characterized in that, The method further includes: If the fourth message passes the integrity protection check, the terminal sends a fifth message to the network-side device, which indicates that MAC layer security activation or deactivation is complete.

15. The method according to any one of claims 1 to 14, characterized in that, The method further includes: The terminal sends a sixth message to the network-side device, the sixth message being used to request activation or deactivation of MAC layer security.

16. A method for sending secure information, characterized in that, include: The network-side device sends a first message to the terminal, the first message including security information of the Media Access Control (MAC) layer.

17. The method according to claim 16, characterized in that, The security information is used to indicate at least one of the following: Encryption algorithm information, integrity protection algorithm information, and the first integrity-based Message Authentication Code (MAC-I).

18. The method according to claim 16 or 17, characterized in that, The message type of the first message includes at least one of the following: Radio Resource Control (RRC) messages and MAC Control Unit (CE).

19. The method according to claim 18, characterized in that, The RRC message also includes at least one of the following: Security information for signaling radio bearers (SRBs) and data radio bearers (DRBs).

20. The method according to any one of claims 16 to 19, characterized in that, The method further includes: The network-side device receives a second message sent by the terminal, the second message indicating at least one of the following: MAC layer security algorithm negotiation completed, MAC layer security activated, and a second MAC-I; or... The network-side device receives a third message sent by the terminal, the third message indicating at least one of the following: MAC layer security algorithm negotiation failed and MAC layer security was not activated.

21. The method according to any one of claims 16 to 20, characterized in that, The first message is also used to activate MAC layer security; or, The method further includes: The network-side device sends a fourth message to the terminal, which is used to activate or deactivate MAC layer security.

22. The method according to claim 21, characterized in that, The fourth message includes at least one of the following: MAC layer security indication information, said indication information being used for at least one of the following: activating the security of at least one MAC CE, and deactivating the security of at least one MAC CE; Third MAC-I.

23. The method according to claim 21 or 22, characterized in that, The method further includes: The network-side device receives a fifth message sent by the terminal, which is used to indicate that MAC layer security activation or deactivation is complete.

24. The method according to any one of claims 16 to 23, characterized in that, The method further includes: The network-side device receives a sixth message sent by the terminal, which is used to request activation or deactivation of MAC layer security.

25. A security information acquisition device, characterized in that, include: The receiving module is used to receive a first message sent by the network-side device, the first message including security information of the Media Access Control (MAC) layer; The processing module is configured to determine at least one of the following based on the security information: security algorithm information and key for MAC layer security. The key includes at least one of the following: encryption key and integrity protection key. The security algorithm information includes at least one of the following: encryption algorithm information and integrity protection algorithm information.

26. The apparatus according to claim 25, characterized in that, The apparatus further includes a transmitting module, the transmitting module being used for at least one of the following: If the first message passes the integrity protection check, a second message is sent to the network-side device. The second message indicates at least one of the following: MAC layer security algorithm negotiation is completed, MAC layer security is activated, and a second MAC-I is performed. If the first message fails the integrity protection check, a third message is sent to the network-side device, the third message indicating at least one of the following: MAC layer security algorithm negotiation failed and MAC layer security was not activated.

27. The apparatus according to claim 25 or 26, characterized in that, The processing module is also used for at least one of the following: Based on the first message, it is determined that MAC layer security has been activated; The fourth message determines whether MAC layer security is activated or deactivated. The fourth message is used to activate or deactivate MAC layer security.

28. A security information transmission device, characterized in that, include: The sending module is used to send a first message to the terminal, the first message including security information of the Media Access Control (MAC) layer.

29. The apparatus according to claim 28, characterized in that, The device further includes a receiving module, the receiving module being used for: The terminal receives a second message indicating at least one of the following: MAC layer security algorithm negotiation is complete; MAC layer security is activated; and a second MAC-I is performed; or... The terminal receives a third message indicating at least one of the following: MAC layer security algorithm negotiation failed and MAC layer security was not activated.

30. The apparatus according to claim 28 or 29, characterized in that, The first message is also used to activate MAC layer security; or, The sending module is also used to send a fourth message to the terminal, the fourth message being used to activate or deactivate MAC layer security.

31. A terminal, characterized in that, It includes a processor and a memory, the memory storing a program or instructions that can run on the processor, the program or instructions being executed by the processor to implement the steps of the security information acquisition method as described in any one of claims 1 to 15.

32. A network-side device, characterized in that, It includes a processor and a memory, the memory storing a program or instructions that can run on the processor, the program or instructions being executed by the processor to implement the steps of the secure information transmission method as described in any one of claims 16 to 24.

33. A readable storage medium, characterized in that, The readable storage medium stores a program or instructions that, when executed by a processor, implement the steps of the secure information acquisition method as described in any one of claims 1 to 15, or the steps of the secure information transmission method as described in any one of claims 16 to 24.

34. A computer program product, characterized in that, The computer program product is stored in a storage medium and is executed by at least one processor to implement the steps of the secure information acquisition method as claimed in any one of claims 1 to 15, or to implement the steps of the secure information transmission method as claimed in any one of claims 16 to 24.

Images