Communication method and apparatus

Abstract

The application discloses a communication method and device, and belongs to the technical field of communication. In the method, a first node deployed on an NTN device can use a key corresponding to a routing path of data for signing, thereby improving the security of data transmission in an NTN scenario. In addition, in the above scheme, the routing path and the key have a corresponding relationship, and the first node can determine the key based on the corresponding relationship and the determined routing path. Therefore, the above scheme supports different routing paths to be configured with different keys, thereby further enhancing the security of data transmission.

Description

Technical Field

[0001] This application relates to the field of communications, and more specifically, to a communication method and apparatus. Background Technology

[0002] In non-terrestrial network (NTN) scenarios, NTN equipment, such as satellites, is introduced into the communication system. NTN equipment can communicate with core network equipment through NTN gateways, and it can also communicate with terminal devices. Because the distance between NTN equipment and terminal devices is much greater, the signal coverage of network equipment deployed on NTN equipment is also much larger than that of current terrestrial networks. Taking uplink transmission as an example, data sent by a terminal device can pass through one or more NTN devices and terrestrial gateways before reaching the serving network.

[0003] However, improving the security of data transmission in NTN scenarios is an urgent problem to be solved. Summary of the Invention

[0004] This application provides a communication method and apparatus that can improve the security of data transmission.

[0005] Firstly, a communication method is provided. The method provided in the first aspect can be executed by a first node deployed on a first NTN device. Unless otherwise specified, the first node in this application can be a communication device (e.g., an access network device), a component within the communication device (e.g., a processor, chip, or chip system), or a logic module or software capable of implementing some or all of the functions of the communication device. For ease of description, the following description uses the first node as the executing entity.

[0006] For example, the method includes: receiving data from a previous hop node; determining information of a first routing path based on the data, wherein nodes on the first routing path are used to transmit the data, and the information of the first routing path has a correspondence with a first key; generating first signature information using the first key; and sending the data, the first signature information, and the information of the first routing path to a second node on the first routing path.

[0007] Based on the above scheme, the first node deployed on the NTN device can use the key corresponding to the data routing path to sign, thereby improving the security of data transmission in the NTN scenario. For example, the data mentioned above can be sent by the terminal to the landing network element through the first routing path. The network element used for verification (hereinafter referred to as the verification network element) can obtain the signature information and verify its validity; or, the verification network element can obtain information generated based on the signature information and verify the validity of the generated information. In this way, if the verification network element finds a verification anomaly, it can determine that the routing path of the data from the terminal to the landing network element has been tampered with, introducing an untrusted node. Therefore, the above scheme can protect the security of data transmission between the terminal and the landing network element. In addition, there is a correspondence between the routing path and the key in the above scheme, and the first node can determine the key based on the correspondence and the determined routing path. Therefore, the above scheme supports configuring different keys for different routing paths, thereby further enhancing the security of data transmission.

[0008] In some implementations, before generating the first signature information using the first key, the method further includes: determining to perform a secure signature based on first information, wherein the first information is at least one of first location information, first address information, or information of the terminal sending the data, wherein the first location information is used to indicate the location of the terminal sending the data, the location indicated by the terminal, or the location of a landing network element, wherein the landing network element is a network element deployed on the ground for receiving the data, and the first address information is used to indicate the address of the terminal.

[0009] Based on the above scheme, the first node can determine whether to perform a secure signature based on the first information. Based on this determination, the first node can decide to perform a secure signature, thereby improving security; or it can decide not to perform a secure signature, thereby saving processing overhead and reducing data transmission latency.

[0010] In some implementations, the first node is configured with a mapping relationship between the first information and the first security policy; wherein, determining to perform a security signature based on the first information includes: determining the first security policy based on the mapping relationship and the first information, wherein the first security policy is used to instruct to perform a security signature.

[0011] Based on the above scheme, the first node can determine which security policy to use based on the mapping relationship, thereby deciding whether to perform a secure signature. This scheme is easy to implement and has low processing overhead.

[0012] In some implementations, before generating the first signature information using the first key, the method further includes: determining, based on the first information, to perform a secure signature, and determining that the node processing the data is located at the location indicated by the first location information, wherein the first information is at least one of first location information, first address information, or information of the terminal sending the data, wherein the first location information is used to indicate the location of the terminal sending the data, the location indicated by the terminal, or the location of the landing network element, wherein the landing network element is a terrestrial network element used to receive the data, and the first address information is used to indicate the address of the terminal.

[0013] Based on the above scheme, the first node can determine whether to perform a secure signature and whether to select a node at the location indicated by the first location information to process the data, based on the first information. Based on these determinations, the first node can either perform a secure signature and send data to a node at a specific location, thereby improving security; or it can decide not to perform a secure signature and have no special requirements for the location of the next-hop node, thereby reducing processing complexity.

[0014] In some implementations, the first node is configured with a mapping relationship between the first information and the second security policy; wherein, determining to perform a secure signature and to determine that the node processing the data is at the location indicated by the first location information based on the first information includes: determining the second security policy based on the mapping relationship and the first information, wherein the second security policy is used to indicate to perform a secure signature and to indicate that the node processing the data is at the location indicated by the first location information.

[0015] Based on the above scheme, the first node can determine which security policy to use based on the mapping relationship, thereby determining whether to perform a secure signature and whether there are any special requirements for the location of the next-hop node. This scheme is easy to implement and has low processing overhead.

[0016] In some implementations, before generating the first signature information using the first key, the method further includes: receiving first indication information from the previous hop node, the first indication information being used to indicate the performance of a secure signature.

[0017] Based on the above scheme, the first instruction information can trigger the first node to perform a secure signature, thereby enabling the first node to perform a secure signature on demand, effectively balancing security and processing overhead (or transmission latency).

[0018] In some implementations, the first indication information is further used to indicate that the node processing the data is at the location indicated by the first location information, wherein the first location information is used to indicate the location of the terminal sending the data, the location indicated by the terminal, or the location of the landing network element, wherein the landing network element is a network element deployed on the ground for receiving the data, and the first address information is used to indicate the address of the terminal.

[0019] Based on the above scheme, the first instruction information can trigger the first node to select the node at the position indicated by the first position information to process the data, thereby enabling the first node to restrict the position of the node processing the data as needed, effectively balancing security and processing complexity.

[0020] In some implementations, the first node is configured with a third security policy, which is used to indicate that the node processing the data is at the location indicated by the first location information. The determination of the first routing path information based on the data includes: determining the first routing path information based on the third security policy and the data, wherein the nodes on the first routing path are at the locations indicated by the first location information.

[0021] Based on the above scheme, the first node can determine whether to select a node at the location indicated by the first location information to process data based on the third security policy. This allows the first node to send data to nodes at specific locations, thereby improving security. If the first node uses other policies (e.g., the first security policy), it does not need to have special requirements regarding the location of the next-hop node, thus reducing processing complexity.

[0022] In some implementations, before using the first key to generate the first signature information, the method further includes: receiving first configuration information, which is used to configure at least one of the following: the correspondence between the information of the first routing path and the first key, the first key, the information of the first routing path, the information of the second node, or first time information, wherein the first time information is used to indicate the validity period of the first routing path.

[0023] The first node can be configured with a routing path, enabling it to send data to the next-hop node within that path. Compared to flooding (i.e., sending data to all next-hop nodes), this implementation avoids the first node sending data to all next-hop nodes, thus saving overhead. Furthermore, in NTN scenarios, some NTN devices may be unable to communicate with each other. Therefore, the next-hop node temporarily determined by the first node may not be able to route data to the final network element via other NTN devices. This implementation, by pre-planning a complete routing path, avoids situations where data cannot be routed to the final network element, thereby reducing packet loss.

[0024] In NTN scenarios, communication between NTN devices can be unstable. Therefore, the validity period of the routing path configured on the first node can adapt to the needs of NTN scenarios, avoiding situations where data cannot be routed to the destination network element, thereby reducing data packet loss rate.

[0025] In some implementations, before receiving the first configuration information, the method further includes: receiving information about a second routing path and second time information, wherein the second routing path is a routing path with the destination network element as the landing network element, and the second time information is used to indicate the validity period of the second routing path; determining, based on the second time information, that the validity period of the second routing path has expired; and sending a first request message, the first request message being used to request an update to the second routing path, wherein the first routing path is a routing path updated based on the first request message with the destination network element as the landing network element.

[0026] As an example, the first routing path could be the routing path updated by the first node based on the first request information. For instance, the first node updating the routing path based on the first request information can be understood as the first node sending the first request information.

[0027] Based on the above scheme, when the validity period of the routing path expires, the first node can request to update the routing path, thereby avoiding the situation where data cannot be routed to the landing network element through the invalid routing path and reducing the data packet loss rate.

[0028] In some implementations, the first request information is also used to request an update of the key corresponding to the routing path of the destination network element as the landing network element.

[0029] Based on the above scheme, when the validity period of the routing path expires, the first node can request to update the key corresponding to the routing path, thereby further improving the security of data transmission.

[0030] In some implementations, the method further includes sending a second instruction message to the second node, the second instruction message being used to instruct the second node to perform a secure signature.

[0031] In some implementations, using the first key to generate first signature information includes: generating the first signature information based on a first signature method using the first key; wherein, the method further includes: indicating information about the first signature method to the second node.

[0032] In some implementations, the method further includes receiving third indication information, which is used to instruct the use of the first signature method for secure signing.

[0033] Secondly, a communication method is provided. The method provided in this application can be executed by a terminal. Unless otherwise specified, the terminal in this application can be a communication device (e.g., a terminal device), a component within a communication device (e.g., a processor, chip, or chip system), or a logic module or software capable of implementing some or all of the functions of the communication device. For ease of description, the following description uses a terminal as the executing entity.

[0034] For example, the method includes: sending fourth information to a first node deployed on a first NTN device, the fourth information being used to trigger the first node to perform a secure signature; and sending data to the first node.

[0035] This application does not limit the execution order of the operations of sending the fourth information and sending data. For example, the terminal may send the fourth information first and then send the data; or it may send the data first and then send the fourth information; or it may send the fourth information and the data simultaneously.

[0036] Based on the above scheme, the fourth piece of information can trigger the first node to perform a secure signature, thereby enabling the first node to perform secure signatures on demand, effectively balancing security and processing overhead (or transmission latency).

[0037] In some implementations, the fourth information is also used to trigger the first node to send the data to the node at the location indicated by the first location information.

[0038] Based on the above scheme, the fourth information can trigger the first node to select the node at the position indicated by the first position information to process the data, thereby enabling the first node to restrict the position of the node processing the data as needed, effectively balancing security and processing complexity.

[0039] In some implementations, the fourth information is at least one of the following: first location information; first address information; information of the terminal; or, first indication information, which is used to indicate secure signing, and / or, which is used to indicate that the node processing the data is at the location indicated by the first location information.

[0040] The first address information is used to indicate the address of the terminal. The first location information is used to indicate the location of the terminal, the location indicated by the terminal, or the location of the landing network element, wherein the landing network element is a network element deployed on the ground for receiving the data.

[0041] In some implementations, before sending the fourth information to the first node deployed on the first NTN device, the method further includes: receiving fourth indication information from a third network element, the fourth indication information being used to indicate secure signing, and / or, the fourth indication information being used to indicate that the node processing the data is at the location indicated by the first location information.

[0042] For example, the terminal can obtain the aforementioned fourth indication information during the protocol data unit (PDU) session establishment process. For instance, the fourth indication information can be carried in the PDU session establishment acceptance message.

[0043] Thirdly, a communication method is provided. The execution subject of the method provided in this application can be a verification network element. Unless otherwise specified, the verification network element in this application can be a communication device (e.g., a core network device), a component within the communication device (e.g., a processor, chip, or chip system), or a logic module or software capable of implementing some or all of the functions of the communication device. For ease of description, the following description uses the verification network element as the execution subject.

[0044] For example, the method includes: obtaining second signature information and information of a first routing path, wherein the information of the first routing path has a correspondence with a verification key; and using the verification key to verify the second signature information.

[0045] In some examples, the verification network element can be implicitly instructed to verify the second signature information. For instance, the second signature information can implicitly instruct the verification network element to verify the second signature information. Based on the second signature information, the verification network element can determine the information of the first node from the first path information, thereby obtaining the verification key to verify the second signature information.

[0046] In other examples, the verification network element can be explicitly instructed to verify the second signature information. In some possible implementations, the verification network element is a local network element, and the method further includes: the verification network element receiving indication information #1 from the second node. This indication information #1 can be used to instruct the verification network element to verify the second signature information.

[0047] In some possible implementations, the verification network element is a different network element from the landing network element, and the method further includes: the landing network element sending indication information #1 to the verification network element. This indication information #1 can be used to instruct the verification network element to verify the second signature information.

[0048] In other words, the aforementioned instruction information #1 can explicitly instruct the verification network element to verify the second signature information. In other words, instruction information #1 can be information that has the function of "instructing the verification network element to verify the second signature information." This application does not limit the specific form of instruction information #1. For example, instruction information #1 can be the first instruction information or the second instruction information in this application.

[0049] Based on the above scheme, the verification network element can determine the verification key based on the routing path information. Therefore, the above scheme supports configuring different keys for different routing paths, thereby enhancing security.

[0050] In some implementations, the method further includes: if the second signature information fails verification, sending a third message, the third message being used to instruct updating the first routing path and / or updating the key corresponding to the first routing path.

[0051] Based on the above scheme, if the verification network element fails, it can request an update of the routing path and / or the key corresponding to the routing path, thereby further enhancing security.

[0052] In some implementations, the third information includes information about the first routing path.

[0053] In some implementations, before obtaining the second signature information and the first routing path information, the method further includes: receiving second configuration information, which is used to configure at least one of the following: the correspondence between the information of the first routing path and the verification key, the information of the first routing path, the verification key, or first time information, wherein the first time information is used to indicate the validity period of the first routing path.

[0054] In some implementations, before receiving the second configuration information, the method further includes: receiving information about a second routing path and second time information, wherein the second routing path is a routing path with the destination network element as the landing network element, and the second time information is used to indicate the validity period of the second routing path; determining, based on the second time information, that the validity period of the second routing path has expired; and sending first request information, the first request information being used to request the second routing path, wherein the first routing path is a routing path with the destination network element as the landing network element, updated based on the first request information.

[0055] In some implementations, the method further includes: receiving information of a first signature method; wherein, verifying the second signature information using the verification key includes: verifying the second signature information based on the first signature method using the verification key.

[0056] The beneficial effects of the above implementation method are similar to those of some implementation methods in the first aspect, and will not be repeated here.

[0057] Fourthly, a communication method is provided. The execution subject of the method provided in this application can be a second network element. Unless otherwise specified, the second network element in this application can be a communication device (e.g., core network equipment or third-party equipment), a component within the communication device (e.g., a processor, chip, or chip system), or a logic module or software capable of implementing some or all of the functions of the communication device. As an example, the second network element can be called a security network element or other names. For ease of description, the following description uses the example of the execution subject being a second network element.

[0058] For example, the method includes: obtaining the number of nodes N on the first routing path, where N is an integer greater than 1; and obtaining N keys based on the number of nodes N, where the N keys are keys used for signing by the N nodes on the first routing path.

[0059] Based on the above scheme, the second network element can obtain a corresponding number of keys based on the number of nodes on the routing path, thereby generating keys for each node on the routing path.

[0060] In some implementations, obtaining the number N of nodes on the first routing path includes: receiving second information from a first network element, the second information indicating the number N of nodes on the first routing path, wherein the first routing path is determined by the first network element.

[0061] In some implementations, the method further includes sending the N keys to the first network element.

[0062] In some implementations, obtaining the number of nodes N on the first routing path includes: obtaining information about the first routing path, wherein the information about the first routing path includes information about N nodes; and determining the number of nodes on the first routing path to be N based on the information about the first routing path.

[0063] In some implementations, the method further includes: sending the N keys to the N nodes respectively based on the information of the N nodes.

[0064] In some implementations, the N keys include a first key, wherein the method further includes: sending first configuration information to a first node among the N nodes, the first configuration information being used to configure at least one of the following: the correspondence between the information of the first routing path and the first key, the information of the first routing path, the information of the second node, or first time information, wherein the first time information is used to indicate the validity period of the first routing path, and the second node is the next-hop node of the first node on the first routing path.

[0065] In some implementations, the method further includes sending information about the first routing path and a verification key to the verification network element, wherein the verification key is used to verify the secure signature obtained based on the signature key.

[0066] Fifthly, a communication method is provided. The execution entity of the method provided in the fifth aspect can be a first network element. Unless otherwise specified, the first network element in this application can be a communication device (e.g., core network equipment or third-party equipment), a component within the communication device (e.g., a processor, chip, or chip system), or a logic module or software capable of implementing some or all of the functions of the communication device. As an example, the first network element can be called a path node controller or other names. For ease of description, the following description uses the example of the first network element as the execution entity.

[0067] For example, the method includes: determining a first routing path based on information of a landing network element, wherein the landing network element is the last hop node of the first routing path, and the number of nodes on the first routing path is N; and sending second information to a second network element, the second information being used to indicate the number of nodes N on the first routing path, where N is an integer greater than 1.

[0068] Based on the above scheme, the first network element can plan a complete routing path and configure a complete routing path for the first node, or the next-hop node of the first node on the planned routing path. In an NTN scenario, some NTN devices may not be able to communicate with each other. Therefore, without the above scheme, the first node may need to temporarily determine the next-hop node after receiving data. However, the temporarily determined next-hop node may not be able to route the data to the landing network element through other NTN devices. The above scheme, by planning a complete routing path in advance, can avoid the situation where data cannot be routed to the landing network element, thereby reducing the data packet loss rate. In addition, the first network element can indicate the number of nodes to the second network element, thereby assisting the second network element in generating keys.

[0069] In some implementations, the method further includes: receiving N keys from the second network element; and sending the N keys to the N nodes respectively based on the information of the N nodes on the first routing path.

[0070] In some implementations, the N keys include a first key, wherein the method further includes: sending first configuration information to a first node among the N nodes, the first configuration information being used to configure at least one of the following: the correspondence between the information of the first routing path and the first key, the information of the first routing path, the information of the second node, or first time information, wherein the first time information is used to indicate the validity period of the first routing path, and the second node is the next-hop node of the first node on the first routing path.

[0071] In some implementations, before sending the first configuration information to the first node among the N nodes, the method further includes: receiving first request information from the first node, the first request information being used to request an update of the routing path to the destination network element as the landing network element.

[0072] In some implementations, before sending the first configuration information to the first node among the N nodes, the method further includes: obtaining information about a second routing path and second time information, wherein the second routing path is a routing path with the destination network element as the landing network element, and the second time information is used to indicate the validity period of the second routing path; and determining, based on the second time information, that the validity period of the second routing path has expired.

[0073] In some implementations, the first routing path is determined based on the information of the landing network element, including: determining the first routing path based on the information of the landing network element and the first signature method, wherein the nodes on the first routing path support the first signature method.

[0074] In some implementations, the method further includes: determining a first signature method based on the capability information of the nodes on the first routing path, wherein the first signature method is a signature method supported by the capability information; and sending third indication information to the first node on the first routing path, the third indication information being used to instruct the use of the first signature method for secure signing.

[0075] Sixthly, a communication method is provided. The execution entity of the method provided in the sixth aspect can be a first network element. Unless otherwise specified, the first network element in this application can be a communication device (e.g., core network equipment or third-party equipment), a component within the communication device (e.g., a processor, chip, or chip system), or a logic module or software capable of implementing some or all of the functions of the communication device. As an example, the first network element can be called a path node controller or other names. For ease of description, the following description uses the example of the first network element as the execution entity.

[0076] For example, the method includes: determining a first routing path based on information of a landing network element, wherein the landing network element is the last hop node of the first routing path; sending first configuration information to a first node on the first routing path, the first configuration information being used to configure at least one of the following: the correspondence between the information of the first routing path and a first key, the information of the first routing path, the information of a second node, or first time information, wherein the first time information is used to indicate the validity period of the first routing path, and the second node is the next hop node of the first node on the first routing path.

[0077] The aforementioned beneficial effects can be found in the beneficial effects of the corresponding implementation method in the first aspect, and will not be repeated here.

[0078] In a seventh aspect, a communication device is provided, including a processing circuit (or processor) and an input / output interface (also referred to as an interface circuit), the input / output interface being used for inputting and / or outputting signals, and the processing circuit being used to execute any one of the first to sixth aspects, or any possible implementation of any one of the first to sixth aspects.

[0079] In some implementations, the processing circuitry is used to communicate with other devices via interface circuitry and to execute any of the first to sixth aspects, or any possible implementation of any of the first to sixth aspects.

[0080] Eighthly, a communication device is provided. This communication device may include units, modules, or means for performing the functions of the communication device.

[0081] In some implementations, the communication device may include modules, units, or means for performing the methods / operations / steps / actions described in the first aspect and any possible implementation of the first aspect. These modules, units, or means may be hardware circuits, software, or a combination of hardware circuits and software.

[0082] For example, the device includes a transceiver unit and a processing unit. The transceiver unit is used to receive data from the previous hop node; the processing unit is used to determine information of a first routing path based on the data, wherein nodes on the first routing path are used to transmit the data, and the information of the first routing path has a correspondence with a first key; the processing unit is also used to generate first signature information using the first key; the transceiver unit is also used to send the data, the first signature information, and the information of the first routing path to a second node on the first routing path.

[0083] In some implementations, the processing unit is further configured to: determine to perform a secure signature based on first information, wherein the first information is at least one of first location information, first address information, or information of the terminal sending the data, wherein the first location information is used to indicate the location of the terminal, the location indicated by the terminal, or the location of a landing network element, the landing network element being a network element deployed on the ground for receiving the data, and the first address information is used to indicate the address of the terminal.

[0084] In some implementations, the first node is configured with a mapping relationship between the first information and the first security policy; wherein, the processing unit is specifically used to: determine the first security policy based on the mapping relationship and the first information, the first security policy being used to instruct the performance of a secure signature.

[0085] In some implementations, the processing unit is further configured to: determine, based on the first information, to perform a secure signature, and to determine that the node processing the data is located at the location indicated by the first location information, wherein the first information is at least one of first location information, first address information, or information of the terminal sending the data, wherein the first location information is used to indicate the location of the terminal sending the data, the location indicated by the terminal, or the location of the landing network element, the landing network element being a terrestrial network element used to receive the data, and the first address information is used to indicate the address of the terminal.

[0086] In some implementations, the first node is configured with a mapping relationship between the first information and the second security policy; wherein, the processing unit is specifically used to: determine the second security policy based on the mapping relationship and the first information, the second security policy being used to instruct secure signing and to instruct the node processing the data to be at the position indicated by the first location information.

[0087] In some implementations, the transceiver unit is also used to: receive first indication information from the previous hop node, the first indication information being used to instruct secure signing.

[0088] In some implementations, the first node is configured with a third security policy, which is used to indicate that the node processing the data is at the location indicated by the first location information. The processing unit is specifically used to: determine the information of the first routing path based on the third security policy and the data, wherein the node on the first routing path is at the location indicated by the first location information.

[0089] In some implementations, the transceiver unit is further configured to: receive first configuration information, which is configured to configure at least one of the following: the correspondence between the information of the first routing path and the first key, the first key, the information of the first routing path, the information of the second node, or first time information, wherein the first time information is used to indicate the validity period of the first routing path.

[0090] In some implementations, the transceiver unit is further configured to receive information about the second routing path and second time information, the second time information being used to indicate the validity period of the second routing path; the processing unit is further configured to determine, based on the second time information, that the validity period of the second routing path has expired; the transceiver unit is further configured to send a first request information, the first request information being used to request an update to the second routing path, wherein the first routing path is a routing path updated based on the first request information, with the destination network element being the landing network element.

[0091] In some implementations, the transceiver unit is also used to: send a second indication message to the second node, the second indication message being used to instruct the second node to perform a secure signature.

[0092] In some implementations, the processing unit is specifically used to: generate the first signature information using the first key based on the first signature method; wherein, the transceiver unit is also used to: indicate the information of the first signature method to the second node.

[0093] In some implementations, the transceiver unit is also used to: receive third indication information, which is used to instruct the use of the first signature method for secure signing.

[0094] In some implementations, the communication device may include modules, units, or means for performing the methods / operations / steps / actions described in the second aspect and any possible implementation of the second aspect, which may be hardware circuits, software, or a combination of hardware circuits and software.

[0095] For example, the device includes a transceiver unit. The transceiver unit is configured to send fourth information to a first node deployed on a first NTN device, the fourth information being used to trigger the first node to perform a secure signature; the transceiver unit is also configured to send data to the first node.

[0096] In some implementations, the transceiver unit is further configured to: receive fourth indication information from a third network element, the fourth indication information being used to indicate secure signing of the first path information, and / or, the fourth indication information being used to indicate that the node processing the data is at the position indicated by the first location information.

[0097] In some implementations, the communication device may include modules, units, or means for performing the methods / operations / steps / actions described in the third aspect and any possible implementation of the third aspect, which may be hardware circuits, software, or a combination of hardware circuits and software.

[0098] For example, the device includes a transceiver unit and a processing unit. The transceiver unit is used to acquire second signature information and information about a first routing path, wherein the information about the first routing path has a correspondence with a verification key; the processing unit is used to verify the second signature information using the verification key.

[0099] In some implementations, the transceiver unit is also used to: send third information if the second signature information fails to be verified, the third information being used to instruct the updating of the first routing path and / or the updating of the key corresponding to the first routing path.

[0100] In some implementations, the transceiver unit is further configured to: receive second configuration information, which is used to configure at least one of the following: the correspondence between the information of the first routing path and the verification key, the information of the first routing path, the verification key, or first time information, wherein the first time information is used to indicate the validity period of the first routing path.

[0101] In some implementations, the first routing path is a routing path with the destination network element as the landing network element. The transceiver unit is further configured to: receive information about a second routing path and second time information, wherein the second routing path is a routing path with the destination network element as the landing network element, and the second time information is used to indicate the validity period of the second routing path; the processing unit is further configured to determine, based on the second time information, that the validity period of the second routing path has expired; and the transceiver unit is further configured to send a first request message, which requests an update to the second routing path, wherein the first routing path is a routing path updated based on the first request message, with the destination network element as the landing network element.

[0102] In some implementations, the transceiver unit is further configured to: receive information of the first signature method; wherein, the processing unit is specifically configured to: verify the second signature information using the verification key based on the first signature method.

[0103] In some implementations, the communication device may include modules, units, or means for performing the methods / operations / steps / actions described in the fourth aspect and any possible implementation of the fourth aspect, which may be hardware circuits, software, or a combination of hardware circuits and software.

[0104] For example, the device includes a processing unit. Optionally, the device further includes a transceiver unit. The processing unit or transceiver unit is configured to obtain the number of nodes N on the first routing path, where N is an integer greater than 1; the processing unit is also configured to obtain N keys based on the number of nodes N, where the N keys are keys used for signing by the N nodes on the first routing path.

[0105] In some implementations, the transceiver unit is specifically used to: receive second information from the first network element, the second information being used to indicate the number N of nodes on the first routing path, wherein the first routing path is determined by the first network element.

[0106] In some implementations, the transceiver unit is also used to send the N keys to the first network element.

[0107] In some implementations, the processing unit is specifically used to: obtain information about the first routing path, wherein the information about the first routing path includes information about N nodes; and determine the number of nodes on the first routing path as N based on the information about the first routing path.

[0108] In some implementations, the transceiver unit is also used to: send the N keys to the N nodes respectively based on the information of the N nodes.

[0109] In some implementations, the N keys include a first key, wherein the transceiver unit is further configured to: send first configuration information to a first node among the N nodes, the first configuration information being configured to configure at least one of the following: the correspondence between the information of the first routing path and the first key, the information of the first routing path, the information of the second node, or first time information, wherein the first time information is used to indicate the validity period of the first routing path, and the second node is the next-hop node of the first node on the first routing path.

[0110] In some implementations, the transceiver unit is also used to: send information about the first routing path and a verification key to the verification network element, wherein the verification key is used to verify the secure signature obtained based on the signature key.

[0111] In some implementations, the communication device may include modules, units, or means for performing the methods / operations / steps / actions described in the fifth aspect and any possible implementation of the fifth aspect, which may be hardware circuits, software, or a combination of hardware circuits and software.

[0112] For example, the device includes a transceiver unit and a processing unit. The processing unit is used to determine a first routing path based on information of a landing network element, wherein the landing network element is the last hop node of the first routing path, and the number of nodes on the first routing path is N; the transceiver unit is used to send second information to a second network element, the second information being used to indicate the number of nodes N on the first routing path, where N is an integer greater than 1.

[0113] In some implementations, the transceiver unit is also used to: receive N keys from the second network element; the transceiver unit is also used to send the N keys to the N nodes respectively based on the information of the N nodes on the first routing path.

[0114] In some implementations, the N keys include a first key, wherein the transceiver unit is further configured to: send first configuration information to a first node among the N nodes, the first configuration information being configured to configure at least one of the following: the correspondence between the information of the first routing path and the first key, the information of the first routing path, the information of the second node, or first time information, wherein the first time information is used to indicate the validity period of the first routing path, and the second node is the next-hop node of the first node on the first routing path.

[0115] In some implementations, the transceiver unit is also used to: receive first request information from the first node, the first request information being used to request an update of the routing path from the destination network element to the landing network element.

[0116] In some implementations, the transceiver unit is further configured to: obtain information about the second routing path and second time information, wherein the second routing path is a routing path with the destination network element as the landing network element, and the second time information is used to indicate the validity period of the second routing path; the processing unit is further configured to determine, based on the second time information, that the validity period of the second routing path has expired.

[0117] In some implementations, the processing unit is specifically used to: determine the first routing path based on the information of the landing network element and the first signature method, wherein the nodes on the first routing path support the first signature method.

[0118] In some implementations, the processing unit is further configured to: determine a first signature method based on the capability information of the nodes on the first routing path, wherein the first signature method is a signature method supported by the capability information; the transceiver unit is further configured to send third indication information to the first node on the first routing path, the third indication information being used to instruct the use of the first signature method for secure signing.

[0119] In some implementations, the communication device may include modules, units, or means for performing the methods / operations / steps / actions described in the sixth aspect and any possible implementation of the sixth aspect, which may be hardware circuits, software, or a combination of hardware circuits and software.

[0120] For example, the device includes a transceiver unit and a processing unit. The processing unit is used to determine a first routing path based on information of a landing network element, wherein the landing network element is the last hop node of the first routing path; the transceiver unit is used to send first configuration information to a first node on the first routing path, the first configuration information being used to configure at least one of the following: the correspondence between the information of the first routing path and a first key, the information of the first routing path, the information of a second node, or first time information, wherein the first time information is used to indicate the validity period of the first routing path, and the second node is the next hop node of the first node on the first routing path.

[0121] Ninthly, a computer-readable storage medium is provided that stores a computer program or instructions that, when executed, cause any one of the first to sixth aspects, or any possible implementation of any one of the first to sixth aspects, to be executed (or implemented).

[0122] In a tenth aspect, a computer program product is provided, comprising a computer program or instructions that, when executed, cause any one of the first to sixth aspects, or any possible implementation of any one of the first to sixth aspects, to be executed (or implemented).

[0123] Eleventhly, a communication device is provided, comprising a processor for executing (or implementing) any of the first to sixth aspects, or any possible implementation of any of the first to sixth aspects, by executing a computer program (or computer-executable instructions) stored in a memory, and / or by logic circuitry.

[0124] In one possible implementation, the device also includes a memory. In another possible implementation, the processor and memory are integrated together. In yet another possible implementation, the memory is located outside the device. The processor may include one or more processors.

[0125] In some possible implementations, the memory may be used to store part or all of the necessary computer program or instructions for implementing any of the first to sixth aspects, or for any possible implementation of any of the first to sixth aspects, to provide the functionality.

[0126] In one possible implementation, the communication device further includes a communication interface for communicating with other devices, such as transmitting or receiving data and / or signals. Exemplarily, the communication interface may be a transceiver, circuit, bus, module, input / output interface, or other types of communication interface.

[0127] In one implementation, the communication device of the seventh, eighth or eleventh aspect mentioned above may be a terminal device or a communication module in a terminal device, or a chip or chip system in a terminal device.

[0128] In one implementation, the communication device of the seventh, eighth or eleventh aspect mentioned above may be an access network device or a communication module in the access network device, or a chip or chip system in the access network device.

[0129] In one implementation, the communication device of the seventh, eighth or eleventh aspect mentioned above may be a core network device or a communication module in the core network device, or a chip or chip system in the core network device.

[0130] In one implementation, the communication device in the seventh, eighth, or eleventh aspect mentioned above can be a third-party device or a communication module in a third-party device, or a chip or chip system in a third-party device.

[0131] In a twelfth aspect, a chip is provided, including a processor for invoking a computer program or computer instructions in a memory to cause the processor to execute or implement any of the first to sixth aspects described above, or any possible implementation of any of the first to sixth aspects.

[0132] In some implementations, the processor is coupled to the memory via an interface.

[0133] In a thirteenth aspect, a communication system is provided, comprising at least one of the following: a first node, a terminal, a verification network element, a second network element, or a third network element. The first node is configured to execute the first aspect and any possible implementation thereof. The terminal is configured to execute the second aspect and any possible implementation thereof. The verification network element is configured to execute the third aspect and any possible implementation thereof. The second network element is configured to execute the fourth aspect and any possible implementation thereof. The first network element is configured to execute the fifth aspect and any possible implementation thereof, or to execute the sixth aspect and any possible implementation thereof.

[0134] The description of the beneficial effects of any of the seventh to thirteenth aspects can be referred to the description of the corresponding beneficial effects of the first to sixth aspects. Attached Figure Description

[0135] Figure 1 It is a schematic block diagram of a communication system.

[0136] Figure 2 This is a schematic diagram of another communication system.

[0137] Figure 3 This is a schematic flowchart of a communication method provided in an embodiment of this application.

[0138] Figure 4 This is a schematic flowchart illustrating another communication method provided in an embodiment of this application.

[0139] Figure 5 This is a schematic flowchart illustrating another communication method provided in the embodiments of this application.

[0140] Figure 6 This is a schematic flowchart of a communication method provided in an embodiment of this application.

[0141] Figure 7 This is a schematic flowchart illustrating another communication method provided in an embodiment of this application.

[0142] Figure 8 This is a schematic flowchart of a communication method provided in an embodiment of this application.

[0143] Figure 9 This is a schematic flowchart illustrating another communication method provided in an embodiment of this application.

[0144] Figure 10 This is a schematic flowchart illustrating another communication method provided in the embodiments of this application.

[0145] Figure 11 This is a schematic block diagram of a communication device provided in an embodiment of this application.

[0146] Figure 12 This is a schematic diagram of another communication device provided in an embodiment of this application.

[0147] Figure 13 This is a schematic diagram of a chip system provided in an embodiment of this application.

[0148] Figure 14 This is a schematic diagram of another chip system provided in an embodiment of this application. Detailed Implementation

[0149] In this application, unless otherwise specified or in case of logical conflict, the terminology and / or descriptions of different embodiments are consistent and can be referenced by each other. Technical features in different embodiments can be combined to form new embodiments based on their inherent logical relationships.

[0150] I. In this application, "at least one" means one or more, and "more than one" means two or more. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can mean: A exists alone, A and B exist simultaneously, or B exists alone, where A and B can be singular or plural. In the textual description of this application, the character " / " generally indicates that the preceding and following related objects are in an "or" relationship. "At least one of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one of a, b, and c can mean: a, or, b, or, c, or, a and b, or, a and c, or, b and c, or, a, b, and c. Here, a, b, and c can each be single or multiple.

[0151] II. In this application, the terms "first," "second," and various numerical designations (e.g., #1, #2, etc.) indicate distinctions made for ease of description and are not intended to limit the scope of the embodiments of this application. For example, first information and second information can distinguish different messages, rather than being used to describe a specific order or sequence. It should be understood that such described objects can be interchanged where appropriate to describe solutions other than those in the embodiments of this application.

[0152] Third, in this application, descriptions such as "when," "under the circumstances," and "if" all refer to the device taking corresponding actions or being in a corresponding position under certain objective circumstances. They are not time-limited, nor do they require the device to perform a judgment action when implementing it, nor do they imply any other limitations.

[0153] IV. In this application, "instruction" or "for instruction" can include both direct (or explicit) and indirect (or implicit) instruction. When describing instruction information as indicating A, it can include whether the instruction information directly or indirectly indicates A, but does not necessarily mean that the instruction information carries A. For example, in the case of indirect (or implicit) instruction, the receiving end of the instruction information can obtain A based on the parameters indicated by the instruction information, combined with other rules or parameters, or through deduction.

[0154] V. The indication methods involved in the embodiments of this application should be understood to cover various methods that enable the party to be indicated to obtain the information to be indicated. The information to be indicated can be sent as a whole or divided into multiple sub-information and sent separately. Moreover, the sending period and / or sending time of these sub-information can be the same or different. This application does not limit the sending method, for example.

[0155] VI. In this application, "protocol" can refer to standard protocols in the field of communications, such as 5G protocols, new radio (NR) protocols, and related protocols applied to future communication systems; this application does not limit this term. "Predefined" can include predefined terms, such as protocol definitions. "Preconfiguration" can be implemented by pre-storing corresponding codes, tables, or other means that can be used to indicate relevant information in the device; this application does not limit the implementation method.

[0156] VII. In this application, "communication" can also be described as "data transmission," "information transmission," "data processing," etc. "Transmission" includes "sending" and "receiving." For example, transmission can be uplink transmission, such as a terminal device sending a signal to a network device; transmission can also be downlink transmission, such as a network device sending a signal to a terminal device; transmission can also be sidelink transmission, such as a terminal device sending a signal to another terminal device. For example, "transmission" can be air interface level transmission, or it can be signal transmission from a chip input (I) / output (O) port, rather than air interface level transmission.

[0157] 8. In this application, terms such as “message”, “information”, “signal” or “information element (IE)” can be used interchangeably. There are no restrictions on the name of the message or information, as long as it can achieve the corresponding function.

[0158] 9. "Sending information to XX (device)" can be understood as the destination of the information being that device. This can include sending information directly or indirectly to that device. "Receiving information from XX (device), or receiving information from XX (device)" can be understood as the source of the information being that device. This can include receiving information directly or indirectly from that device. Information may undergo necessary processing between the source and destination, such as format changes, but the destination can understand the valid information from the source. Similar expressions in this application can be understood in a similar way, and will not be repeated here. Furthermore, "sending" can also be understood as the "output" of the chip interface, and "receiving" can also be understood as the "input" of the chip interface. In other words, "sending" or "receiving" can occur between devices, for example, between network devices and terminal devices via an air interface. "Sending" or "receiving" can also occur within a device, for example, between components, modules, chips, software modules, or hardware modules within the device via a bus, wiring, or interface.

[0159] 10. In this application, terms such as "exemplarily" and "for example" are used to indicate examples, illustrations, or descriptions to present concepts in a specific manner. Any embodiment or design described as an "example" in this application should not be construed as being more preferred or advantageous than other embodiments or designs. In the embodiments of this application, the terms "of," "corresponding (relevant)," "corresponding," and "associated" may sometimes be used interchangeably, and it should be noted that their intended meanings are consistent unless their distinctions are emphasized.

[0160] XI. In this application, configuration can be signaling configuration or can be described as configuring signaling. For example, signaling configuration includes configuration using signaling sent by network devices, which can be radio resource control (RRC) messages, downlink control information (DCI) messages, or system information blocks (SIBs), etc. Another example is signaling configuration between network devices. These network devices can include access network devices, core network devices, or management plane devices, etc. Optionally, signaling configuration can also be configured to terminal devices or network devices by pre-configured signaling, or configured to terminal devices or network devices through pre-configuration. Here, pre-configuration means defining or configuring the values ​​of corresponding parameters in advance using a protocol, and storing them in the terminal device or network device during communication. The pre-configured messages can be modified or updated when the terminal device or network device is connected to the network.

[0161] 12. This application will present various aspects, embodiments, or features relating to systems that may include multiple devices, components, modules, etc. Each system may include devices, components, modules, etc., other than those illustrated, and / or may not include all and all of the devices, components, modules, etc. discussed in conjunction with the accompanying drawings.

[0162] Thirteen, the business scenarios described in the embodiments of this application are for the purpose of more clearly illustrating the technical solutions of the embodiments of this application, and do not constitute a limitation on the technical solutions provided in the embodiments of this application. As those skilled in the art will know, with the emergence of new business scenarios, the technical solutions provided in the embodiments of this application are also applicable to similar technical problems.

[0163] XIV. In the various embodiments of this application, the sequence number of each process does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application. The terms "comprising," "including," "having," and their variations all mean "including but not limited to," unless otherwise specifically emphasized.

[0164] The technical solutions of this application embodiment can be applied to various communication systems, including but not limited to: Long Term Evolution (LTE) systems, NR systems, and other fifth-generation (5G) communication systems. th This includes various mobile communication systems such as 5G, narrowband Internet of Things (NB-IoT), enhanced machine-type communication (eMTC), enhanced mobile broadband (eMBB), ultra-reliable low latency communications (URLLC), satellite communication systems, LTE-machine-to-machine (LTE-M) systems, and other systems that evolve after 5G, such as future mobile communication systems.

[0165] As an example, satellite communication systems may include high altitude platform station (HAPS) communication or NTN systems such as unmanned aerial vehicles (UAVs). Alternatively, satellite communication systems may include integrated communication and navigation (ICAN) systems, global navigation satellite systems (GNSS), or ultra-dense low-Earth orbit (LEO) satellite communication systems.

[0166] The embodiments of this application are described below with reference to the accompanying drawings.

[0167] Figure 1 It is a schematic block diagram of a communication system. For example... Figure 1As shown, this communication system uses the 5G system (5GS) as an example. As an example, this communication system consists of three parts: the terminal part, the data network (DN) part, the radio access network (RAN) part, and the core network (CN) part.

[0168] The following is a brief introduction to the network elements of each part.

[0169] 1. Terminal section:

[0170] The terminal portion may include one or more terminals. In the embodiments of this application, a terminal may be a device for implementing the functions of a terminal device, or a device capable of supporting the terminal device in implementing those functions, such as a chip or chip system, which may be installed in the terminal device. The chip system may consist of chips, or may include chips and other discrete components.

[0171] Terminal equipment can be a device that provides voice and / or data connectivity to users. Terminal equipment can be deployed on land, including indoors or outdoors, handheld or vehicle-mounted; it can also be deployed on water (such as ships); and it can be deployed in the air (such as airplanes, balloons, and satellites). Terminal equipment can also be referred to as user equipment (UE), access terminal, terminal, subscriber unit, user station, mobile station, mobile station (MS), mobile terminal (MT), remote station, remote terminal, mobile device, user terminal, wireless network equipment, user agent, or user device. In this application embodiment, terminal devices include, but are not limited to: cellular phones, mobile phones, wireless data cards, wireless modems, tablets, laptop computers, notebook computers, handheld computers, mobile internet devices (MIDs), computers with wireless transceiver capabilities, cordless phones, session initiation protocol (SIP) phones, smartphones, wireless local loop (WLL) stations, personal digital assistants (PDAs), handsets or handheld devices with wireless communication capabilities, computing devices or other devices connected to wireless modems, vehicle-mounted devices (e.g., cars, bicycles, electric vehicles, airplanes, ships, trains, high-speed trains, etc.), wearable devices (e.g., smartwatches, smart bracelets, pedometers, smart glasses, etc.), satellite terminals, terminal devices in the Internet of Things or the Internet of Vehicles, as well as terminals of any form in future networks, relay user equipment, or terminals in future evolved public land mobile networks (PLMNs), etc.Terminal devices can also be virtual reality (VR) devices, augmented reality (AR) devices, smart point-of-sale (POS) machines, customer-premises equipment (CPE), light UE, reduced capability UE (REDCAP UE), machine type communication (MTC) terminals, terminal devices in industrial control, terminal devices in self-driving, terminal devices in telemedicine, terminal devices in smart grids, wireless terminals in transportation safety, terminal devices in smart cities, terminal devices in smart homes, tactile terminal devices, smart home devices (e.g., refrigerators, televisions, air conditioners, electricity meters, etc.), smart robots, robotic arms, workshop equipment, wireless terminals in self-driving, or flying devices (e.g., smart robots, hot air balloons, drones, airplanes), etc. The terminal device can also be a vehicle device, such as a complete vehicle device, an in-vehicle module, an in-vehicle chip, an on-board unit (OBU), or a telematics box (T-BOX). The terminal device can also be other devices with terminal functions; for example, it can be a device that functions as a terminal in device-to-device (D2D) communication. This application does not limit the scope of the embodiments in this regard.

[0172] 2. Data Network Section:

[0173] The data network portion may include a Data Network (DN). A DN can be a network used to provide data transmission. For example, a DN may include networks used by carrier services (such as the Internet Protocol (IP) Multimedia Subsystem (IMS)), the Internet, or third-party service networks. A DN can also be called a Packet Data Network (PDN), and is typically a network located outside the carrier's network, such as a third-party network.

[0174] 3. The (R)AN portion may include one or more access network elements. In the embodiments of this application, an access network element may be a device for implementing the functions of an access network device, or a device capable of supporting the access network device in implementing those functions, such as a chip or chip system, which may be installed in the access network device. A chip system may consist of chips or may include chips and other discrete components. In the NTN scenario, Figure 1 The RAN in this context can be deployed on NTN devices. As an example, NTN devices can include satellites or high-altitude platforms.

[0175] Access network equipment can be any device with wireless transceiver capabilities. For example, access network equipment can be a base station used to connect terminal devices to a radio access network (RAN). Access network equipment is sometimes also referred to as access network element, access network node, RAN node, RAN, access network (AN) node, or AN. It is understood that the names of devices with access network functionality may differ in systems employing different wireless access technologies. For ease of description, devices providing wireless communication access functionality to terminal devices can be collectively referred to as base stations or RANs. Exemplarily, access network equipment includes, but is not limited to, various forms of macro base stations, micro base stations or indoor stations, pico base stations, small stations, balloon stations, relay stations, access points, etc. Access network equipment can include evolved node Bs (eNBs or eNodeBs) in LTE, access points (APs), wireless relay nodes, wireless backhaul nodes, transmission points (TRPs or TPs), or transmission reception points (TRPs) in Wi-Fi systems. It can also include next-generation NodeBs (gNBs), next-generation RAN (NG-RAN) nodes or transmission points (TRPs or TPs) in 5G systems, one or a group of antenna panels (including multiple antenna panels) of a base station in a 5G system, and network nodes constituting a gNB or transmission point, such as baseband units (BBUs) or distributed units (DUs). Furthermore, it can include access network equipment, servers, or vehicle-mounted equipment in networks evolving after 5G. Access network equipment can also be modules or units that perform some of the functions of a base station; for example, it can be a central unit (CU) or a DU.

[0176] Access network devices and terminal devices can communicate via wireless links. The transmission link from the access network device to the terminal device can be called a downlink (DL) or downlink channel, used for transmitting downlink signals. The transmission link from the terminal device to the access network device can be called an uplink (UL) or uplink channel, used for transmitting uplink signals. The transmission link from one terminal device to another can be called a sidelink (SL) or sidelink channel, used for transmitting sidelink signals.

[0177] 4. CN section:

[0178] The CN portion may include, but is not limited to, the following network functions (NFs): network slice selection function (NSSF), network slice specific authentication and authorization function (NSSAAF), authentication server function (AUSF), unified data management (UDM), network exposure function (NEF), network repository function (NRF), policy control function (PCF), application function (AF), access and mobility management function (AMF), session management function (SMF), user plane function (UPF), and signaling control point (SCP). Figure 1 Partial NF is shown below. Figure 1 A brief introduction to the part of NF shown is provided.

[0179] 1) UPF network element:

[0180] A UPF network element can be used to implement at least one of the following: packet routing of user plane data, forwarding of user plane data, processing user plane paths for Protocol Data Unit (PDU) sessions, or processing quality of service (QoS) for user plane data. User data can access the DN through this network element. In the embodiments of this application, the UPF network element can be used to implement user plane functions.

[0181] 2) SMF network elements:

[0182] SMF network elements can be used to implement at least one of the following: session management, UE IP address allocation and management, selection, control or management of user plane functions (e.g., UPF network elements), configuration of flow control on the UPF to route traffic to the correct destination, policy control, QoS-related control, or downlink data notification, etc.

[0183] 3) PCF network element:

[0184] PCF network elements can be used to implement at least one of the following: a unified policy framework to guide network behavior, providing policy rule information to network elements (e.g., SMF network elements, RAN, etc.) or terminal devices.

[0185] Figure 1 Npcf, Nsmf, N3, N4, and N6 are interface serial numbers. For example, the meaning of these interface serial numbers can be found in the Third Generation Partner Program (3...). rd The meaning of the interface sequence number as defined in the Generation Partnership Project (3GPP) standard protocol is not limited in this application. It should be noted that... Figure 1 The interface names between the various network functions in this document are merely examples. In specific implementations, the interface names of this system architecture may be other names, and this application does not limit them. Furthermore, the names of the messages (or signaling) transmitted between the aforementioned network elements are also merely examples and do not constitute any limitation on the function of the messages themselves.

[0186] exist Figure 1 In the architecture shown, the interface between (R)AN and CN can also be called the NG interface (not shown in the figure). (R)AN and CN are connected through the NG interface. The NG interface can include the NG-C interface and the NG-U interface. The NG-C interface is the control plane interface, connecting (R)AN and AMF network elements, and is used to transmit control plane data. The NG-U interface is the user plane interface, connecting (R)AN and UPF, and is used to transmit user plane data.

[0187] Figure 1The network elements shown, such as SMF, UPF, or PCF, can be understood as network elements in the core network used to implement different functions, such as network slices that can be combined as needed. These core network elements can be independent devices or integrated into the same device to implement different functions. This application does not limit the specific form of the aforementioned network elements. Furthermore, the aforementioned network elements or functions can be physical entities in hardware devices, software instances running on dedicated hardware, or virtualized functions instantiated on a shared platform (e.g., a cloud platform). Simply put, an NF can be implemented by hardware or software.

[0188] Furthermore, the aforementioned naming is defined solely for the purpose of distinguishing different functions and should not constitute any limitation on this application. This application does not preclude the possibility of using other naming conventions in 5G networks and other future networks. For example, in future communication networks, some or all of the aforementioned network elements may retain the terminology used in 5G, or they may adopt other names, etc.

[0189] The various methods provided in the embodiments of this application can be applied to... Figure 1 The communication system shown. For example, the RAN node in the embodiments of this application can be... Figure 1 The (R)AN shown. Figure 1 The (R)AN in the middle can be deployed on NTN devices. Figure 1 The UPF in the system can be deployed on the ground.

[0190] In NTN scenarios, NTN devices such as satellites are introduced into communication systems. Because the distance between NTN devices and terminal devices is very long, the coverage area of ​​the signals transmitted by network devices deployed on NTN devices is much larger than that of current terrestrial networks. In some examples, NTN devices can provide access services to multiple countries. The following example uses satellites as the NTN device, combined with... Figure 2 Detailed introduction.

[0191] Figure 2 This is a schematic diagram of another communication system. STA#1 to STA#4 belong to a satellite access network, and the satellites in this network can communicate with each other via inter-satellite links (ISL). This satellite access network can provide access services to countries D, E, and F.

[0192] Satellites providing access services to multiple countries can communicate with the terrestrial core network via gateway stations. Optionally, the gateway stations connect to core network elements through a terrestrial routing network. For example, gateway stations i and j can communicate with... Figure 2The diagram illustrates satellite access network communication. Gateway station i can connect to a core network element (e.g., UPF) via routers i1 and i2. Gateway station j can connect to a core network element (e.g., UPF) via routers j1 and j2. Thus, terminals in countries D, E, and F can communicate with the core network element (e.g., UPF) sequentially via the satellite access network, gateway stations (including gateway station i or j), and the terrestrial routing network (including routers i1, i2, j1, or j2).

[0193] As an example, terrestrial core network elements can belong to the serving network. Thus, Figure 2 This can also be understood as terminals located in countries D, E, and F connecting to the service network via satellite access networks and gateways.

[0194] In some examples, the gateway station and service network may be deployed in the same country or in different countries. For example, the gateway station and service network may both be deployed in country D, country E, country F, or another country. Alternatively, the gateway station and service network may each be deployed in two of the following countries: country D, country E, country F, or another country.

[0195] In this application, the gateway station and the service network can be deployed one-to-one, meaning one gateway station connects to one service network. Alternatively, the gateway station and service network can be deployed in a many-to-one, one-to-many, or many-to-many manner; this application does not impose any limitations on this. As an example, one service network can correspond to one PLMN identifier (ID). Different service networks correspond to different PLMNIDs. The service network can be a visited network, a home network, or a combination of both. Taking a service network that is a combination of a visited network and a home network as an example, terminal data can first pass through the visited network and then through the home network.

[0196] Taking uplink transmission as an example, data sent by a terminal can successively pass through one or more satellites in the satellite access network and ground-based gateway stations to reach the service network. The one or more satellites and gateway stations traversed by the data can constitute a routing path (or part of a routing path). However, the routing path may be tampered with, resulting in poor data transmission security.

[0197] Therefore, improving the security of data transmission in NTN scenarios is an urgent problem to be solved.

[0198] In view of this, embodiments of this application provide a communication method. The first node in this method enhances the security of data transmission by performing a secure signature. A detailed description is provided below with reference to the accompanying drawings.

[0199] Figure 3This is a schematic flowchart of a communication method 300 provided in an embodiment of this application. Optional operations in method 300 are shown with dashed lines. Some nodes that may be involved in this application are described below.

[0200] Terminal: Unless otherwise specified, the terminal in this application can be a communication device (e.g., a terminal device), a component within a communication device (e.g., a processor, chip, or chip system), or a logic module or software capable of implementing some or all of the functions of the communication device. For ease of description, the following description uses a UE as an example of a terminal.

[0201] First Node: The first node can receive data from its upstream node and send data to its next-hop node. As an example, the first node can be deployed on a first NTN device, and its upstream node can be deployed on another NTN device different from the first NTN device. Alternatively, the upstream node of the first node can be a UE (User Equipment). The next-hop node of the first node can be referred to as the second node.

[0202] In some examples, the first node can sign to obtain the first signature information and send the first signature information to the second node.

[0203] Unless otherwise specified, the first node in this application can be a communication device (e.g., an access network device), a component within the communication device (e.g., a processor, chip, or chip system), or a logic module or software capable of implementing some or all of the functions of the communication device. For ease of description, the first node will be denoted as RAN#1 below.

[0204] Second Node: The second node can be the next-hop node of RAN#1. As an example, the second node can be deployed on a second NTN device. The second NTN device and the first NTN device can be different NTN devices.

[0205] In some examples, the second node can receive data and the first signature information from RAN#1 and send the data and the first signature information to its next-hop node. The next-hop node can be a node deployed on an NTN device (e.g., another NTN device different from the first and second NTN devices) or a terrestrial network element. As an example, the terrestrial network element can be a UPF or a gateway station. Exemplarily, a gateway station can be used to receive and transmit signals from the NTN device and establish a power supply link with the NTN device. A gateway station can also be called a gate station or other names, which are not limited in this application.

[0206] Unless otherwise specified, the second node in this application can be a communication device (e.g., an access network device), a component within the communication device (e.g., a processor, chip, or chip system), or a logic module or software capable of implementing some or all of the functions of the communication device. For ease of description, the second node will be referred to as RAN#2 below.

[0207] Verification network element: The verification network element can obtain the second signature information and verify its validity. In this application, the second signature information may refer to the signature information verified by the verification network element, which may be generated based on the first signature information. See section S372 and other related descriptions below for details.

[0208] In some examples, the verification network element can be a terminating network element (e.g., a gateway station or a UPF). This verification network element (i.e., the terminating network element) can receive the second signature information from the node preceding the verification network element.

[0209] In other examples, the verification network element can be a different network element from the landing network element. This verification network element can receive the second signature information from the landing network element.

[0210] Unless otherwise specified, the verification network element in this application may be a communication device (e.g., a core network device), a component in the communication device (e.g., a processor, chip, or chip system), or a logic module or software that can implement some or all of the functions of the communication device.

[0211] As an example, the verification network element can be a UPF, gateway station, SMF, other network elements involved in the current 3GPP protocol, or network elements added in future 3GPP protocols. The verification network element can also be called a security function network element or other names, which are not limited in this application.

[0212] It is understood that this application may also involve other nodes. These will be described in detail when introducing the various operations of this application later.

[0213] Before introducing the various operations of method 300, some descriptions in method 300 will be explained.

[0214] Method 300 describes the process by which data sent by the UE (denoted as data #1) is forwarded sequentially through at least one RAN node and finally reaches the destination network element (denoted as destination network element #1). For ease of description, the RAN nodes traversed by data #1 and the destination network element #1 can be referred to as the routing path. Thus, the RAN nodes traversed by data #1 and the destination network element #1 can be considered as nodes on the routing path. That is, the nodes on the routing path can include at least one RAN node and the destination network element #1. Optionally, the nodes on the routing path also include the UE.

[0215] The direction of this routing path is from the UE's next-hop node to the landing network element #1. In other words, the destination network element of this routing path is the landing network element #1.

[0216] For ease of description, if node #1 on the routing path sends data #1 directly or indirectly to node #2, it can be described as: node #1 is before node #2; correspondingly, node #2 is after node #1.

[0217] In this context, Node #1 sending data #1 "directly" to Node #2 can be understood as data #1 sent by Node #1 to Node #2 without passing through other nodes on the routing path, reaching Node #2 directly from Node #1. Thus, Node #1 can be called the "previous hop node" of Node #2; correspondingly, Node #2 can be called the "next hop node" of Node #1. Node #1 and Node #2 can be called "adjacent nodes"; or, in other words, Node #1 and Node #2 are "adjacent".

[0218] In this context, node #1 "indirectly" sends data #1 to node #2. This can be understood as data #1 sent by node #1 reaching node #2 through at least one intermediary node. Thus, the aforementioned at least one node can be referred to as a "node between node #1 and node #2"; or, in other words, "there is at least one node" between node #1 and node #2. Furthermore, nodes #1 and #2 can be referred to as "non-adjacent nodes." Or, in other words, node #1 and node #2 are "not adjacent."

[0219] The following describes the various operations of method 300.

[0220] S320, the UE transmits data (denoted as data #1). Correspondingly, RAN #1 receives data #1. RAN #1 can be deployed in the first NTN device.

[0221] Here, data #1 can be understood as data sent by the UE and received by RAN #1. Specifically, RAN #1 can receive data #1 from the upstream node of RAN #1.

[0222] In some examples, RAN#1 and UE can be adjacent nodes. In other words, the upstream node of RAN#1 can be the UE. Thus, S320 can be understood as the UE directly sending data #1 to RAN#1, and RAN#1 directly receiving data #1 from the UE.

[0223] In other examples, RAN#1 and the UE can be non-adjacent nodes. In other words, the upstream node of RAN#1 can be a different node from the UE. In this way, data #1 sent by the UE can be relayed through at least one node before finally reaching RAN#1.

[0224] For example, the UE can directly send data #1 to the upstream node of RAN#1; the upstream node of RAN#1 can receive data #1 and send data #1 back to RAN#1. RAN#1 can receive data #1 from the UE from the upstream node of RAN#1.

[0225] For example, a UE can send data #1 to a node (e.g., a RAN). This node can send data #1 directly to the upstream node of RAN #1, or indirectly to the upstream node of RAN #1 through at least one node. Furthermore, the upstream node of RAN #1 can receive data #1 and send data #1 back to RAN #1. RAN #1 can receive data #1 from the UE's upstream node.

[0226] S332, RAN#1 determines the information of the first routing path based on data #1.

[0227] The nodes on the first routing path can be used to transmit data #1. As an example, the first routing path can be a routing path with the destination network element being the landing network element #1. Exemplarily, the first routing path can also be understood as a routing path used to route data #1 from the UE to the landing network element #1. The first routing path can also be called a planned routing path, a preset routing path, or other names.

[0228] The following introduces two interpretations of the information of the first routing path, referred to as Routing Path Example 1 and Routing Path Example 2, respectively.

[0229] Example 1 of routing path information:

[0230] In example 1 of the routing path information, the information of the first routing path may include information about each node used to transmit data #1. For example, the information of the first routing path may include information about RAN #1, RAN #2, ..., and the information of the landing network element #1. Optionally, the information of the first routing path may also include information about the UE.

[0231] For example, the information of the landing network element #1 can be the ID of the landing network element #1 or the IP address of the landing network element #1. The landing network element #1 can be a gateway station or a UPF.

[0232] Example 2 of routing path information:

[0233] In example 2 of the routing path information, the information of the first routing path can be the identifier of the first routing path.

[0234] Unless otherwise specified, the information of the first routing path in this application can be understood as the complete routing path information in Example 1 of routing path information, or as the identifier of the routing path in Example 2 of routing path information, and will not be elaborated further hereafter.

[0235] The following is an example of the specific process of S332.

[0236] In some possible implementations, S332 includes: RAN#1 can obtain information about the destination network element #1 based on data #1; and determine the information of the first routing path based on the mapping relationship between the information of the destination network element #1 and the information of the first routing path. An example of RAN#1 obtaining information about the destination network element #1 is described below.

[0237] In some examples, RAN#1 can perform data radio resource (DRB) mapping based on data#1 to obtain the UPF IP address. For example, the UPF IP address can be information from the aforementioned terminating network element #1. As another example, RAN#1 can determine the UPF ID based on the mapping relationship between the UPF IP address and the UPF ID; where the UPF ID can be information from the aforementioned terminating network element #1. Yet another example, RAN#1 can determine the gateway station's ID (or gateway station's IP address) based on the mapping relationship between the UPF IP address and the gateway station's ID (or gateway station's IP address); where the gateway station's ID (or gateway station's IP address) can be information from the aforementioned terminating network element #1.

[0238] As an example, RAN#1 can obtain the mapping relationship between UPF IP address and UPF ID during the PDU session establishment process.

[0239] As an example, RAN#1 can obtain the ID (or IP address) of the gateway station corresponding to the UE during the UE registration process. Furthermore, RAN#1 can obtain the UPF IP address corresponding to the UE during the UE's PDU session establishment process. In this way, RAN#1 can obtain the mapping relationship between the UPF IP address and the gateway station ID (or IP address).

[0240] In other examples, data #1 may carry UE information (e.g., UE identifier), or RAN #1 may obtain UE information based on data #1. RAN #1 stores a mapping relationship between UE information and gateway IDs, so RAN #1 can determine the gateway ID based on the UE identifier. This gateway ID may be the information from the aforementioned landing network element #1.

[0241] As an example, RAN#1 can obtain the ID (or IP address) of the gateway station corresponding to the UE during the UE registration process and store the mapping relationship between the UE information and the gateway station ID.

[0242] For details on how RAN#1 obtains the mapping relationship between the information of the landing network element #1 and the information of the first routing path, please refer to S310 below. It will not be described in detail here.

[0243] In some examples, RAN#1 may also consider security policies when determining the information of the first routing path. That is, RAN#1 can determine the information of the first routing path based on the information of the landing network element #1 and the security policy. For details, please refer to Triggering Example 1 and Routing Path Determination Example 1 below, which will not be elaborated here.

[0244] S340, RAN#1 uses the first key (denoted as key #1) to generate the first signature information (denoted as signature information #1).

[0245] In some examples, there may be a correspondence between the information of the first routing path and the key #1. Thus, RAN#1 can determine the key #1 based on the correspondence between the information of the first routing path determined in S332 and the aforementioned key #1, thereby executing S340. How RAN#1 obtains the correspondence between the information of the first routing path and the key #1 is detailed in S310 below and will not be elaborated here.

[0246] The following examples of two signatures illustrate the meaning of key #1, denoted as Signature Example 1 and Signature Example 2, respectively.

[0247] Signature Example 1:

[0248] In signature example 1, key #1 can be a complete signature key. For example, signature information #1 generated using key #1 in RAN#1 can be complete signature information. Subsequent verification network elements can verify signature information #1 based on the public key (or verification key) corresponding to key #1.

[0249] For example, key #1 can be the private key of RAN#1. As an example, this private key can be used to prove or verify the identity of RAN#1. For instance, the private key of RAN#1 can correspond to the public key (or verification key) stored in the verification network element. RAN#1 uses this private key to sign, obtaining signature information #1. Subsequent verification network elements can verify the signature information #1 based on the public key corresponding to this private key, thereby verifying the identity of RAN#1.

[0250] Signature Example 2:

[0251] In signature example 2, key #1 can be a part of the complete signature key (denoted as signature key #1). Exemplarily, key #1 can be a private key component obtained by RAN#1. As an example, this private key component can be used to prove that RAN#1 is a node on the first routing path. For example, RAN#1 uses this private key to sign, obtaining signature information #1. Nodes after RAN#1 on the first routing path generate second signature information based on signature information #1. Verification of the second signature information by the verification network element determines that RAN#1 is a node on the first routing path. The signature information used to determine the second signature information can also be called intermediate signature information. For example, signature information #1 can be understood as the signature information used to determine the second signature information, and this signature information #1 can also be called intermediate signature information.

[0252] As an example, assume RAN#1 is the next-hop node of the UE, and data #1 is transmitted to the landing network element #1 via RAN#1 to RAN#i. Here, i can be an integer greater than 1. RAN#1 to RAN#i can each hold keys #1 to #i. These keys #1 to #i are all part of a complete signature key #1. Thus, RAN#1 can send the signature information #1 generated using key #1 to RAN#2; RAN#2 can process the signature information #1 based on key #2 to obtain signature information #2, and then send it to RAN#2's next-hop node. Similarly, RAN#i can eventually receive signature information #i-1 from RAN#i-1 and process it based on key #i to obtain signature information #i. Exemplarily, processing signature information based on a key can be understood as signing the signature information using the key.

[0253] As an example, keys #1 to #i can form a complete signature key #1. Thus, the signature information #i can be a complete signature. The verification network element can obtain this signature information #i and verify the signature information #i based on the public key (or verification key) corresponding to the complete signature key #1.

[0254] As another example, keys #1 to #i, together with the key of the landing network element #1, can form a complete signature key #1. Thus, the signature information #i may not be a complete signature. The landing network element #1 can obtain the signature information #i and process it based on its key to obtain signature information #i+1. The verification network element can obtain the signature information #i+1 and verify it based on the public key (or verification key) corresponding to the complete signature key #1.

[0255] The above introduced signature example 1 and signature example 2. The following is an example of information to be signed.

[0256] In some possible implementations, S340 may include: RAN#1 signing the information to be signed using key #1 to obtain signature information #1. As an example, the information to be signed may include at least one of path information, a random number, data #1, or UE information.

[0257] For example, path information may include information about the previous hop node of the RAN node, information about the RAN node itself, and information about the next hop node of the RAN node. For instance, the path information for RAN#1 (denoted as path information #1) may include: information about the previous hop node of RAN#1, information about RAN#1, and information about RAN#2.

[0258] The information of a node (e.g., the previous hop node of RAN#1, RAN#1, RAN#2, etc.) may include at least one of the following: the node's identifier (ID) or the node's address information (e.g., IP address). In some cases, the node may be deployed on an NTN device. Optionally, the node's information may also include at least one of the following: the ID of the NTN device where the node resides, or the address information of the NTN device where the node resides (e.g., IP address).

[0259] The random number can be generated by RAN#1 using the random(random, RAND) function, or obtained in other ways.

[0260] For example, UE information may include UEID, UEIP address, UE session ID, UE session core network (CN) tunnel information, or UE session access network (AN) tunnel information, etc. As an example, CN tunnel information (CNtunnelinfo) may include the UE session's UPFIP address, or the UE session's tunnel endpoint identifier (TEID) on the UPF side, etc. As an example, AN tunnel information (ANtunnelinfo) may include the UE session's RANIP address (e.g., the IP address of the UE's next-hop RAN node), or the UE session's TEID on the RAN side, etc.

[0261] For example, the UE IP address mentioned above can be an IP address assigned during the PDU session establishment process. The UE IP address mentioned above can also be understood as, or replaced by, a UE IP prefix.

[0262] In some examples, the UE can report its information to RAN#1; that is, data #1 can carry the UE's information. In other examples, RAN#1, core network elements, or other network elements can configure specific communication resources for the UE. In this way, RAN#1 can determine that data #1 received from that specific communication resource originates from the UE, thereby obtaining the UE's information. For example, the aforementioned communication resources may include time-frequency resources, radio bearers, or other communication resources that can embody the UE's information.

[0263] S350, RAN#1 sends data #1, signature information #1, and information about the first routing path to RAN#2 on the first routing path.

[0264] S360, RAN#2 sends data #1 and information about the first routing path to the landing network element #1. Correspondingly, the landing network element #1 receives data #1 and information about the first routing path from RAN#2.

[0265] In signature example 1, RAN#2 can also send signature information #1 to the landing network element #1.

[0266] In signature example 2, RAN#2 can also send signature information generated based on signature information #1 to the landing network element #1.

[0267] In some examples, RAN#2 and the landing network element #1 can be adjacent nodes. In other words, RAN#2 can be the upstream node of landing network element #1. Thus, S360 can include: RAN#2 directly sending data #1, signature information #1, and information of the first routing path to landing network element #1; landing network element #1 directly receiving data #1, signature information #1, and information of the first routing path from RAN#2.

[0268] In other examples, RAN#2 and the landing network element #1 may be non-adjacent nodes. In other words, RAN#2 is not the previous hop node of landing network element #1. Or, there is at least one node between RAN#2 and landing network element #1. Thus, S360 may include: RAN#2 sending data #1, signature information #1, and information about the first routing path to landing network element #1 through at least one node; landing network element #1 receiving data #1, signature information #1, and information about the first routing path from RAN#2 through at least one node.

[0269] In some possible implementations, each RAN node on the routing path of data #1 signs using the key corresponding to the first routing path.

[0270] In some examples of signature example 1, assume there are i RAN nodes on the routing path, where i is an integer greater than 1. Assume RAN#1 is the next-hop node of the UE, and RAN#i is the previous-hop node of the landing network element #1. RAN#1 can sign path information #1 based on RAN#1's key, obtaining signature information #1. RAN#2 can sign path information #2 based on RAN#2's key, obtaining signature information #2. Path information #2 can include information from RAN#1, RAN#2, and the next-hop node information of RAN#2. Similarly, RAN#i can sign path information #i based on RAN#i's key, obtaining signature information #i. Path information #i can include information from RAN#i-1 (i.e., the previous-hop node of RAN#i), RAN#i, and the landing network element #1.

[0271] Furthermore, in some possible implementations, each RAN node on the routing path of data #1 can send its path information and signature information to its next-hop node. Additionally, the RAN node can send the path information and signature information of all nodes preceding it to its next-hop node.

[0272] For example, RAN#2 can directly or indirectly send its path information and signature information, as well as the path information and signature information of all RAN nodes preceding RAN#2, to the landing network element #1. RAN#2 can receive the path information and signature information of all RAN nodes preceding RAN#2 from the node preceding RAN#2.

[0273] For example, assuming there are i RAN nodes on the routing path, RAN#1 can send data #1, path information #1, and signature information #1 to RAN#2. RAN#2 can send data #1, path information #1 to path information #2, and signature information #1 to signature information #2 to the next-hop node of RAN#2. And so on, RAN#i can send data #1, path information #1 to path information #i, and signature information #1 to signature information #i to the landing network element #1.

[0274] To facilitate understanding, a specific example is provided below. Assume the routing path includes a UE, RAN#1, RAN#2, and a landing network element #1. The actions of each node can then include steps 1) through 5), as detailed below:

[0275] 1) The UE executes S320, that is, sends data #1 to RAN#1.

[0276] 2) RAN#1 executes S340, that is, based on the key of RAN#1, signs the path information of RAN#1 (i.e., path information #1) to obtain the signature information of RAN#1 (i.e. signature information #1).

[0277] 3) RAN#1 sends data #1, path information #1 and signature information #1 to RAN#2.

[0278] 4) Based on the key of RAN#2, RAN#2 signs the path information of RAN#2 (denoted as path information #2) to obtain the signature information of RAN#2 (denoted as signature information #2).

[0279] 5) RAN#2 sends data#1, path information#1, signature information#1, path information#2 and signature information#2 to the landing network element#1.

[0280] In some possible implementations, the UE can sign the path information #0 (including the UE's information and the RAN#1's information) based on the UE's key to obtain second signature information (denoted as signature information #0). The UE can then send the path information #0 and signature information #0 to RAN#1.

[0281] In some examples of signature example 2, assume there are i RAN nodes on the routing path, where i is an integer greater than 1. Assume RAN#1 is the next-hop node for the UE, and data #1 is transmitted from RAN#1 to RAN#i and then to the landing network element #1. RAN#1 can generate signature information #1 based on key #1. RAN#2 can process signature information #1 based on key #2 to obtain signature information #2. Similarly, RAN#i can process signature information #i-1 based on key #i to obtain signature information #i.

[0282] Furthermore, in some possible implementations, each RAN node on the routing path of data #1 can send data #1, the signature information obtained by that RAN node, and the information of the first routing path to the next-hop node of that RAN node. As an example, the RAN node can determine the key used for secure signing based on the correspondence between the information of the first routing path and the key.

[0283] For example, RAN#1 can send data #1, signature information #1, and information about the first routing path to RAN#2. RAN#2 can process signature information #1 using key #2 based on the correspondence between the information about the first routing path and key #2 to obtain signature information #2; RAN#2 can then send data #1, signature information #2, and information about the first routing path to its next-hop node. Similarly, RAN#i can process signature information #i-1 using key #i based on the correspondence between the information about the first routing path and key #i to obtain signature information #i; RAN#i can then send data #1, signature information #i, and information about the first routing path to the terminating network element #1.

[0284] To facilitate understanding, a specific example is provided below. Assume the routing path includes a UE, RAN#1, RAN#2, and a landing network element #1. The actions of each node can then include steps 1) through 5), as detailed below:

[0285] 1) The UE executes S320, that is, sends data #1 to RAN#1.

[0286] 2) RAN#1 executes S340, which generates signature information (i.e., signature information #1) based on key #1.

[0287] 3) RAN#1 sends data #1, signature information #1, and information about the first routing path to RAN#2.

[0288] 4) Based on the information of the first routing path, RAN#2 determines key #2 and uses key #2 to sign signature information #1 to obtain signature information of RAN#2 (denoted as signature information #2).

[0289] 5) RAN#2 sends data#1, signature information#2 and information of the first routing path to the landing network element#1.

[0290] The following are two examples of triggering RAN#1 to execute S340, referred to as trigger example 1 and trigger example 2 respectively.

[0291] Trigger Example 1:

[0292] In some possible implementations, method 300 may also include S335 before S340.

[0293] S335, RAN#1 determines whether to perform a secure signature based on the first information.

[0294] The first information may include at least one of the following: first location information, first address information, or UE information. The meaning and acquisition method of the first location information are described below.

[0295] For example, the first location information can be used to indicate the location of the UE that sent data #1, the location indicated by the UE, or the location of the landing network element #1. As an example, the location indicated by the first location information can be one or more countries including the country where the UE is located, one or more regions including the area where the UE is located, one or more PLMNs including the PLMN that the UE accesses, or one or more networks including the UE's home network, etc.

[0296] The UE's location can be understood as its location when transmitting data #1. As a specific example, if the UE is in country D, region 1, or PLMN #1 when transmitting data #1, then the first location information can indicate country D, region 1, or PLMN #1.

[0297] The location indicated by the UE can be indicated by information in the UE's subscription data, information sent by the UE to RAN#1, or other means. The location indicated by the UE can also be understood as: the UE's preferred location, the UE's desired location, the UE's recommended location, or the UE's home network, etc.

[0298] The location of the landing network element #1 can be the country, region, or PLMN that the landing network element #1 is located in.

[0299] In some examples, the first location information may include a location identifier to indicate the aforementioned location. For example, the location identifier may include a country identifier, a region identifier, or a PLMN identifier. As an example, the country identifier may be a mobile country code (MCC), etc. The region identifier may be a tracking area code (TAC), etc. The PLMN identifier may include an identifier composed of an MCC and a mobile network code (MNC), etc.

[0300] The following describes three possible examples of RAN#1 obtaining the first location information. They are referred to as location information acquisition examples 1 to 3.

[0301] Location information acquisition example 1: RAN#1 obtains the first location information from the UE.

[0302] The above example of obtaining location information can be applied to situations where the UE is located as indicated by the first location information, the location indicated by the UE, or the location of the landing network element #1.

[0303] In some possible implementations, prior to S335, method 300 further includes: the UE sending indication information of the first location information to RAN#1. This indication information of the first location information can be used to indicate the first location information itself. For example, the indication information of the first location information can be the first location information itself; or, for example, the indication information of the first location information can be used to indicate a location (denoted as location #1), which belongs to the location indicated by the first location information. In other words, the location indicated by the first location information can include the location indicated by the indication information of the first location information.

[0304] In some possible implementations, RAN#1 can determine the first location information based on the indication information of the first location information. For example, the indication information of the first location information reported by the UE to RAN#1 can indicate country D. Location information #1 configured by RAN#1 indicates countries D and F, and location information #2 indicates countries E and G. In this way, RAN#1 can determine that the location indicated by the first location information is countries D and F, that is, the location indicated by location information #1, based on the indication information of the first location information.

[0305] For example, if the UE and RAN#1 are adjacent nodes, the UE can directly send indication information of the first location information to RAN#1.

[0306] For example, if the UE and RAN#1 are not adjacent nodes, the UE can send a first location information indication to its next-hop node. The UE's next-hop node will send the first location information indication directly to RAN#1 or through at least one node. In the above example, the UE may not be aware that RAN#1 will receive the first location information indication, but objectively, the UE will send the first location information indication to RAN#1 through one or more nodes. Therefore, the above example can also be understood as a case of "the UE sending a first location information indication to RAN#1".

[0307] In some examples, the UE can send the indication information of the first location information together with data #1 to RAN#1 in S320. For example, the indication information of the first location information and data #1 can be carried in a single message, or separately in multiple messages sent simultaneously.

[0308] In other examples, the UE can send the indication information of the first location information and data #1 to RAN#1 respectively. For example, the UE can send the indication information of the first location information to RAN#1 during the PDU session establishment procedure, registration procedure, registration request, or other procedures. When there is uplink data to be transmitted, the UE can execute S320, that is, send data #1 to RAN#1.

[0309] Location information acquisition example 2: RAN#1 obtains indication information of the first location information from core network elements such as SMF.

[0310] The above example of obtaining location information can be applied to situations where the first location information indicates the location of the UE, the location indicated by the UE, or the location of the landing network element #1.

[0311] In some possible implementations, prior to S335, method 300 also includes: RAN#1 obtaining indication information of the first location information from network elements such as SMF.

[0312] For example, during session establishment, registration, or other procedures, the UE can send indication information of the first location information to network elements such as the SMF. Furthermore, the SMF, AMF, and location management function (LMF) can obtain the indication information of the first location information by locating the UE on the network side. Network elements such as the SMF can send the indication information of the first location information to RAN#1 before S335.

[0313] In some examples, network elements such as the SMF also indicate the correspondence between the UE and the indication information of the first location information to RAN#1. For example, when the SMF or other network elements send the indication information of the first location information to RAN#1, they can carry the UE's information #1. In this way, RAN#1 can determine that the indication information of the first location information corresponds to the UE. Further, in S320, the data #1 sent by the UE to RAN#1 can carry the UE's information #2. RAN#1 can determine the indication information of the first location information based on the correspondence between the UE and the indication information of the first location information, as well as the UE's information #2. The UE's information #1 and UE's information #2 can be any of the information exemplified as "UE information" in the aforementioned S340. The UE's information #1 and UE's information #2 can be the same or different; this application does not limit this.

[0314] As an example, the SMF can send information to RAN#1 through the AMF. For instance, the SMF can indicate the correspondence between the UE and the indication information of the first location information to the AMF, and the AMF can then indicate the correspondence between the UE and the indication information of the first location information to RAN#1.

[0315] Location information acquisition example 3: RAN#1 determines the first location information based on its own coverage area.

[0316] The above example of obtaining location information 3 can be applied to situations where the UE is located as indicated by the first location information.

[0317] In some possible implementations, prior to S335, method 300 further includes: RAN#1 determining indication information of the first location information based on the coverage of RAN#1, thereby determining the first location information; or, RAN#1 may directly determine the first location information based on the coverage of RAN#1.

[0318] For example, if the coverage area of ​​RAN#1 is entirely within a certain country or region, intersects with a certain country or region, or completely covers a certain country or region, then RAN#1 can determine that the indication information of the first location information points to that country or region. The location indicated by the first location information may include that country or region.

[0319] For example, RAN#1 can use multiple beams to communicate with the UE. As an example, if the coverage area of ​​a certain beam entirely belongs to a certain country or region, intersects with a certain country or region, or completely covers a certain country or region, then RAN#1 can determine that the indication information of the first location information points to that country or region. The location indicated by the first location information may include that country or region.

[0320] For example, if RAN#1's signal covers (or is understood as accessing) a certain PLMN, then RAN#1 can determine that the indication information of the first location information indicates that PLMN. The location indicated by the first location information may include the PLMN.

[0321] The above describes three possible examples of RAN#1 obtaining the first location information. In this application, RAN#1 may also obtain the first location information in other ways, which are not limited here.

[0322] The meaning and acquisition method of the first address information are explained below.

[0323] For example, the first address information can be used to indicate the address of the UE. For instance, the first address information may include the UE's IP address. The first address information may also have other forms, which are not limited herein.

[0324] In some examples, RAN#1 and UE are adjacent nodes. In S320, the data #1 sent by the UE to RAN#1 may carry first address information. For example, in S320, the UE may send a data packet to RAN#1, where data #1 may be the payload part of the data packet, and the first address information may be carried in the source address field (e.g., the source IP address field) of the data packet.

[0325] In other examples, RAN#1 and the UE are not adjacent nodes. In S320, data #1 sent by the UE to its next-hop node can carry first address information; data #1 sent by the UE's next-hop node to RAN#1 can also carry first address information. RAN#1 can receive data #1 and first address information.

[0326] For an example of how the UE obtains the first address information, please refer to the following text, for example, Figure 4 Method 400 is shown.

[0327] The meaning and acquisition method of UE information are described in the relevant description in S340, and will not be repeated here.

[0328] The following example illustrates in detail how RAN#1 determines whether to perform a secure signature based on the first piece of information.

[0329] In some examples, RAN#1 may be configured with a mapping relationship (denoted as mapping relationship #1) between first information and a first security policy (denoted as policy #1). The first information may include at least one of first location information, first address information, or UE information.

[0330] For example, the mapping relationship #1 mentioned above could be pre-configured in RAN #1.

[0331] For example, SMF, PCF, other core network elements, or other third-party network elements can configure the aforementioned mapping relationship #1 to RAN#1. Here, a third-party network element can be understood as a network element that does not belong to the core network. In some possible implementations, PCF, SMF, operations, administration and maintenance (OAM), or other core network elements can obtain the updated mapping relationship #1 and distribute it to RAN#1. Here, "updated mapping relationship #1" can be understood as the mapping relationship between the updated first information and policy #1. For example, the updated first information may include updated first location information, where the first location information before and after the update can be different. Another example is that the updated first information may include updated first address information, where the first address information before and after the update can be different. As an example, PCF, SMF, OAM, or other core network elements can obtain the updated mapping relationship #1 from third-party network elements. For example, the act of updating mapping relationship #1 can be triggered by changes in laws and regulations, or 3GPP standards. For example, updating mapping relationship #1 can be periodic or timed. In some possible implementations, the UE can subscribe to security policy services, so that PCF, SMF, OAM, or other core network elements can obtain the updated mapping relationship #1 and distribute it to RAN #1.

[0332] Here, policy #1 can be used to instruct secure signing to be performed. In some possible implementations, S335 includes: RAN #1 determines policy #1 based on mapping relationship #1 and first information. Thus, RAN #1 can determine to perform secure signing based on policy #1, that is, execute S340.

[0333] In some possible implementations, RAN#1 can also determine, based on the first information, whether to impose location restrictions on the routing path of data #1.

[0334] The phrase "restricting the location of the routing path for data #1" can also be understood as: the routing path for data #1 meets security requirements; or, the node processing data #1 has location restriction requirements; or, the node processing data #1 meets security requirements; or, the node processing data #1 is located at the position indicated by the first location information.

[0335] In this application, unless otherwise specified, security requirements may also be replaced with: security requirements, secure routing requirements, secure routing requirements, location requirements, location requirements, data management requirements, data management requirements, data supervision requirements, or data supervision requirements.

[0336] For example, S335 may include: RAN#1 determining, based on the first information, whether the node processing data #1 has a location restriction; or, based on the first information, RAN#1 determining whether the node processing data #1 needs to meet security requirements; or, based on the first information, RAN#1 determining whether the node processing data #1 needs to be at the location indicated by the first location information.

[0337] As an example, if RAN#1 determines that the node processing data #1 has a location restriction, then it determines that the node processing data #1 is at the location indicated by the first location information; if RAN#1 determines that the node processing data #1 does not have a location restriction, then it determines that the node processing data #1 may or may not be at the location indicated by the first location information, and this application does not limit it.

[0338] The phrase "the node is located at the location indicated by the first location information" can be understood as follows: the node's coverage area falls entirely within the location indicated by the first location information (e.g., a country or region); or, the node's coverage area falls partially within the location indicated by the first location information; or, the node's coverage area completely covers the location indicated by the first location information. "The node is located at the location indicated by the first location information" can also be understood as the node being connected to the PLMN indicated by the first location information.

[0339] In some examples, RAN#1 can be configured with a mapping relationship (denoted as mapping relationship #2) between the first information and the second security policy (policy #2). For example, the mapping relationship #2 can be pre-configured in RAN#1. Alternatively, SMF, PCF, other core network elements, or other third-party network elements can configure the mapping relationship #2 for RAN#1.

[0340] Strategy #2 can be used to instruct secure signing and to indicate the location of the node processing the data as indicated by the location information corresponding to the data. The location information corresponding to the data can be understood as the location of the UE sending the data, the location indicated by the UE, or the location of the receiving network element #1.

[0341] In some examples, policy #2 can be a single policy that instructs secure signing and that the node processing the data be located at the position indicated by the location information corresponding to the data. In other examples, policy #2 can include multiple policies. For instance, one of the aforementioned policies (denoted as policy #b) could be the aforementioned policy #1, instructing secure signing. Another of the aforementioned policies (denoted as policy #c) could instruct that the node processing the data be located at the position indicated by the location information corresponding to the data.

[0342] In some possible implementations, S335 includes: RAN#1 determining policy #2 based on mapping relationship #2 and first information. Thus, RAN#1 can determine to perform a secure signature based on policy #2, i.e., execute S340; and RAN#1 can determine to send data #1, signature information #1, and first routing path information to the RAN located at the position indicated by the first location information based on policy #2. Let's assume that the RAN determined by RAN#1 to be at the position indicated by the first location information is RAN#2. In this case, the above example can be understood as RAN#2 determining to execute S340 and S350 based on policy #2.

[0343] In some possible implementations, RAN#1 can be configured with at least one policy. Two examples are described below, denoted as Policy Example 1 and Policy Example 2, respectively.

[0344] Strategy Example 1:

[0345] In some examples, the policies configured for RAN#1 may contain some or all of the following information:

[0346] Policy #0 indicates that secure signing should not be performed.

[0347] Strategy #1 instructs for secure signing.

[0348] Strategy #2 instructs for secure signing and specifies the location of the node processing the data, corresponding to the location information of the data.

[0349] Strategy #3 indicates that the node processing the data is located at the position indicated by the location information corresponding to the data.

[0350] In the above policy example 1, policies #0 to #3 can be two independent policies. As an example, SMF, PCF, other core network elements, or other third-party network elements can configure policies #0 to #3 for RAN#1.

[0351] For example, assume that strategy #1 has a mapping relationship with position #1 and position #2 (i.e., mapping relationship #1); strategy #2 has a mapping relationship with position #3 and position #4 (i.e., mapping relationship #2); and strategy #3 has a mapping relationship with position #5 and position #6 (denoted as mapping relationship #3).

[0352] For example, if the first location information indicates location #1 or location #2, S335 includes: RAN #1 determines to perform a security signature based on the mapping relationship #1 and the first location information, that is, S340 is executed.

[0353] For example, when the first location information indicates location #3 or location #4, S335 includes: RAN #1 determines to perform a security signature based on the mapping relationship #2 and the first location information, that is, S340 is executed, and RAN #1 determines to send data #1, signature information #1 and information of the first routing path to the RAN located at location #3 (or location #4) indicated by the first location information.

[0354] For example, if the first location information indicates location #5 (or location #6), method 300 further includes: RAN #1 determines, based on mapping relationship #3 and the first location information, to send data #1 to the RAN located at location #5 (or location #6) indicated by the first location information.

[0355] For example, assume that strategy #1 has a mapping relationship with address #1 and address #2 (i.e., mapping relationship #1); strategy #2 has a mapping relationship with address #3 and address #4 (i.e., mapping relationship #2); and strategy #3 has a mapping relationship with address #5 and address #6 (denoted as mapping relationship #3).

[0356] For example, if the first address information indicates address #1 or address #2, S335 includes: RAN #1 determines to perform a secure signature based on the mapping relationship #1 and the first address information, that is, S340 is executed.

[0357] For example, if the first address information indicates address #3 or address #4, S335 includes: RAN #1 determines to perform a security signature based on mapping relationship #2 and the first address information, that is, executes S340, and RAN #1 determines to send data #1, signature information #1 and information of the first routing path to the RAN at the location indicated by the first location information.

[0358] For example, if the first address information indicates address #5 or address #6, S335 includes: RAN #1 determines, based on mapping relationship #3 and the first address information, to send data #1 to the RAN located at the position indicated by the first location information. The method by which RAN #1 obtains the first location information can be found in Examples 1 to 3 of location information acquisition, and will not be repeated here.

[0359] For example, assume that there is a mapping relationship between policy #1 and UE information #1 and UE information #2 (i.e., mapping relationship #1); there is a mapping relationship between policy #2 and UE information #3 and UE information #4 (i.e., mapping relationship #2); and there is a mapping relationship between policy #3 and UE information #5 and UE information #6 (denoted as mapping relationship #3).

[0360] For example, if the UE information is UE information #1 or UE information #2, S335 includes: RAN #1 determines to perform a security signature based on the mapping relationship #1 and the UE information, that is, S340 is executed.

[0361] For example, if the UE information indicates UE information #3 or UE information #4, S335 includes: RAN #1 determines to perform a security signature based on the mapping relationship #2 and the UE information, that is, S340 is executed, and RAN #1 determines to send data #1, signature information #1 and information of the first routing path to the RAN at the location indicated by the first location information.

[0362] For example, if the UE information indicates UE information #5 or UE information #6, S335 includes: RAN #1 determines, based on mapping relationship #3 and UE information, to send data #1 to the RAN at the location indicated by the first location information.

[0363] Strategy Example 2:

[0364] In some examples, the policies configured for RAN#1 may contain some or all of the following information:

[0365] Strategy #a, no requirements.

[0366] Policy #b instructs for secure signing.

[0367] Strategy #c indicates the location of the node processing the data, as indicated by the location information corresponding to the data.

[0368] As an example, SMF, PCF, other core network elements, or other third-party network elements can configure the above policies #a to #c for RAN#1.

[0369] In this context, strategy #a can be understood as strategy #0 in strategy example 1. Strategy #b can be understood as strategy #1 in strategy example 1. Strategies #b and #c can be understood as strategy #2 in strategy example 1. In other words, strategy #2 can include strategy #b and strategy #c. Strategy #c can be understood as strategy #3.

[0370] For example, assume that strategy #b has a mapping relationship with position #1, position #2, position #3 and position #4 (i.e., mapping relationship #1); and strategy #c has a mapping relationship with position #3, position #4, position #5 and position #6 (i.e., mapping relationship #2).

[0371] For example, if the first location information indicates location #1 or location #2, S335 includes: RAN #1 determines the use policy #b based on the mapping relationship #1 and the first location information, thereby performing a secure signature, that is, executing S340.

[0372] For example, if the first location information indicates location #3 (or location #4), method 300 further includes: RAN #1 determines, based on mapping relationship #2 and the first location information, to use policy #b and policy #c to perform secure signing, and sends data #1, signature information #1 and information of the first routing path to the RAN located at location #3 (or location #4) indicated by the first location information.

[0373] For example, if the first location information indicates location #5 (or location #6), method 300 further includes: RAN #1 determines, based on mapping relationship #2 and the first location information, to use strategy #c to send data #1 to the RAN at location #5 (or location #6) indicated by the first location information.

[0374] For example, assume that strategy #b has a mapping relationship with address #1, address #2, address #3 and address #4 (i.e., mapping relationship #1); and strategy #c has a mapping relationship with address #3, address #4, address #5 and address #6 (i.e., mapping relationship #2).

[0375] For example, if the first address information indicates address #1 or address #2, S335 includes: RAN #1 determines the use policy #b based on the mapping relationship #1 and the first address information, thereby performing a secure signature, that is, executing S340.

[0376] For example, if the first address information indicates address #3 or address #4, method 300 further includes: RAN #1 determining, based on mapping relationship #2 and the first address information, to use policy #b and policy #c to perform secure signing, and sending data #1, signature information #1 and information of the first routing path to the RAN at the location indicated by the first location information.

[0377] For example, if the first address information indicates address #5 or address #6, method 300 further includes: RAN #1 determines the use strategy #c based on the mapping relationship #2 and the first address information, thereby sending data #1 to the RAN at the location indicated by the first location information.

[0378] For details on how RAN#1 obtains the first location information, please refer to Examples 1 to 3 for Location Information Acquisition, which will not be repeated here.

[0379] For example, assume that there is a mapping relationship between policy #b and UE information #1, UE information #2, UE information #3 and UE information #4 (i.e., mapping relationship #1); and that there is a mapping relationship between policy #c and UE information #3, UE information #4, UE information #5 and UE information #6 (i.e., mapping relationship #2).

[0380] For example, if the UE information is UE information #1 or UE information #2, S335 includes: RAN #1 determines the use policy #b based on the mapping relationship #1 and the UE information, thereby performing a secure signature, that is, executing S340.

[0381] For example, if the UE information is UE information #3 or UE information #4, method 300 further includes: RAN #1 determining, based on mapping relationship #2 and UE information, to use policy #b and policy #c to perform secure signing, and sending data #1, signature information #1 and information of the first routing path to the RAN at the location indicated by the first location information.

[0382] For example, if the UE information is UE information #5 or UE information #6, method 300 further includes: RAN #1 determines the use strategy #c based on the mapping relationship #2 and the first address information, thereby sending data #1 to the RAN at the location indicated by the first location information.

[0383] Triggering Example 1 was described above. As can be seen from Triggering Example 1, the first location information, the first address information, or the UE's information can be used to trigger RAN#1 to perform a security signature. For ease of description, information that has the function of "triggering RAN#1 to perform a security signature" can be referred to as "fourth information".

[0384] In some possible implementations, method 300 also includes: S330, the UE sends a fourth message to RAN#1.

[0385] Optionally, the fourth information is also used to trigger RAN#1 to send data #1 to the node at the location indicated by the first location information. For example, referring to triggering example 1, the first location information, the first address information, or the UE's information can be used to trigger RAN#1 to send data #1 to the node at the location indicated by the first location information.

[0386] As can be seen from the content of Trigger Example 1, the fourth information can be at least one of the first location information, the first address information, or the UE's information. However, this application does not limit the specific content of the fourth information, and the fourth information may also be other information.

[0387] Trigger Example 2:

[0388] In trigger example 2, the fourth information sent by the UE in S330 can be the first indication information. In some possible implementations, RAN#1 receives the first indication information from the previous hop node of RAN#1. The content of the first indication information will be described below.

[0389] Optionally, the first indication information is used to instruct secure signing. Thus, S340 may include: RAN#1, in response to the first indication information, generating signature information #1 based on key #1.

[0390] In some examples, the first indication information can be an optional field in a message. The message can instruct secure signing by whether or not it carries the first indication information. For example, if the message carries the first indication information, that is, RAN#1 receives the first indication information, then RAN#1 can execute S340; if the message does not carry the first indication information, that is, RAN#1 does not receive the first indication information, then RAN#1 can choose not to execute S340.

[0391] In other examples, the first indication information can indicate whether a secure signature should be performed. For example, the first indication information can be 1 bit. A value of "1" indicates that a signature should be performed; a value of "0" indicates that no signature should be performed. Alternatively, a value of "0" indicates that a signature should be performed; a value of "1" indicates that no signature should be performed. The first indication information can also be more bits, which is not limited in this application.

[0392] Optionally, the first indication information is used to indicate that the node processing data #1 is at the location indicated by the first location information. For example, the first indication information may indicate: location restriction on the routing path of data #1; or, that the node processing data #1 is at the location indicated by the location information corresponding to data #1.

[0393] The phrase "restricting the location of the routing path for data #1" can also be understood as: the routing path for data #1 meets security requirements; or, the location of the node processing data #1 is restricted; or, the node processing data #1 meets security requirements; or, the node processing data #1 is located at the position indicated by the first location information.

[0394] The location information corresponding to the data can be understood as the location of the UE that sent the data, the location indicated by the UE, or the location of the receiving network element #1.

[0395] In some examples, the first indication information can be used to indicate: performing a secure signature, and / or, that the node processing data #1 is in the position indicated by the first location information.

[0396] In other examples, the information indicating the secure signing of the path information and the information indicating that the node processing data #1 is in the position indicated by the first location information may be different. For example, instruction information #5 may be used to indicate the secure signing of the path information. Instruction information #6 may be used to indicate that the node processing data #1 is in the position indicated by the first location information; these may be different information.

[0397] Thus, the first instruction information in S330 can be used to implement the functions of instruction information #5 and / or instruction information #6. Unless otherwise specified, the first instruction information in this application can be replaced with instruction information #5 and / or instruction information #6. Instruction information #5 and instruction information #6 are different pieces of information.

[0398] In some examples, the first indication information may be an optional field in a message. Whether or not the message carries the first indication information can indicate whether to perform a secure signature and whether to impose location restrictions on the routing path of data #1. For example, if the message carries the first indication information, i.e., RAN #1 receives the first indication information, then RAN #1 can execute S340 and determine to send data #1, signature information #1, and information about the first routing path to the RAN located at the location indicated by the first location information; if the message does not carry the first indication information, i.e., RAN #1 does not receive the first indication information, then RAN #1 may not execute S340, and the next-hop node of RAN #1 may or may not be located at the location indicated by the first location information, which is not limited in this application.

[0399] In other examples, the first indication information may indicate whether a secure signature is performed and whether a location restriction is imposed on the routing path of data #1. For example, the first indication information may be 1 bit. A value of "1" indicates that a signature is performed and a location restriction is imposed on the routing path of data #1; a value of "0" indicates that no signature is performed and no location restriction is imposed on the routing path of data #1. Alternatively, a value of "0" indicates that a signature is performed and a location restriction is imposed on the routing path of data #1; a value of "1" indicates that no signature is performed and no location restriction is imposed on the routing path of data #1. The first indication information may also consist of more bits, which is not limited in this application.

[0400] In some further examples, the first indication information may indicate whether to perform a secure signature and whether to impose location restrictions on the routing path of data #1. For example, the first indication information may be 1 bit. A value of "0" indicates that a signature is performed; a value of "1" indicates that a signature is performed and that there are location restrictions on the routing path of data #1. As another example, the first indication information may be 1 bit. A value of "0" indicates that a signature is performed and that there are no location restrictions on the routing path of data #1; a value of "1" indicates that a signature is performed and that there are location restrictions on the routing path of data #1.

[0401] The following is an example of the previous hop node of RAN#1.

[0402] In some examples, the upstream node of RAN#1 can be the UE. In other words, RAN#1 and the UE can be adjacent nodes. Thus, S330 can be understood as the UE directly sending the first indication information to RAN#1, and RAN#1 directly receiving the first indication information from the UE.

[0403] As an example, the UE can send data #1 and the first indication information together to RAN #1, or it can send data #1 and the first indication information separately to RAN #1. In other words, S320 and S330 can be one step or two steps, and this application does not limit them.

[0404] In other examples, the upstream node of RAN#1 can be a different node from the UE. In other words, RAN#1 and the UE can be non-adjacent nodes.

[0405] For example, the UE can send a first indication message, which can be relayed through at least one node and eventually reach RAN#1. Exemplarily, the previous hop node of RAN#1 can be a RAN deployed on an NTN device.

[0406] It is understood that the first instruction information refers to information with a certain function, without limiting the specific form of the first instruction information. For example, the first instruction information has the function of "instructing to perform a secure signature" and / or has the function of "instructing the node processing data #1 to be at the position indicated by the first position information".

[0407] The first indication information sent by the UE and the first indication information ultimately received by RAN#1 may be the same or different in form. As an example, the "form" of the first indication information can be understood as the content contained in the first indication information, the name of the first indication information, etc.

[0408] As can be seen from the content of triggering example 2, the fourth information can be the first indication information. However, this application does not limit the specific content of the fourth information, and the fourth information may also be other information.

[0409] Optionally, the fourth information is also used to trigger RAN#1 to send data #1 to the node at the location indicated by the first location information. For example, referring to triggering example 2, the first indication information can be used to trigger RAN#1 to send data #1 to the node at the location indicated by the first location information.

[0410] For an example of how to enable the UE to send the first indication information, see the following text, for example, Figure 5 Method 500 is shown.

[0411] The above details triggering example 1 and triggering example 2 for RAN#1 to execute S340. Below is an example of RAN#1 instructing RAN#2 to perform a security signature.

[0412] In some examples, RAN#1 can implicitly instruct RAN#2 to perform a secure signature. For instance, signature information #1 can implicitly instruct RAN#2 to perform a secure signature. RAN#2 can then determine to perform a secure signature based on signature information #1.

[0413] In other examples, RAN#1 can explicitly instruct RAN#2 to perform a secure signature. In some possible implementations, method 300 further includes: S352, RAN#1 sends a second instruction message to RAN#2. This second instruction message can be used to instruct RAN#2 to perform a secure signature. That is, the second instruction message can explicitly instruct RAN#2 to perform a secure signature.

[0414] As an example, the second indication information in S352, along with data #1, signature information #1, and the first routing path information in S350, can be sent simultaneously. In other words, S350 and S352 can be the same step. As another example, the second indication information in S352, along with data #1, signature information #1, and the first routing path information in S350, can be sent separately. In other words, S350 and S352 can be different steps.

[0415] Optionally, the second indication information is also used to instruct RAN#2 to impose location restrictions on the routing path of data #1.

[0416] In some possible implementations, RAN#1 can determine the second indication information based on the first information or the first indication information.

[0417] For example, RAN#1 can determine policy #1 or policy #2 based on the first information. If RAN#1 determines policy #1, the second indication information determined by RAN#1 can be used to instruct RAN#2 to perform a secure signature. If RAN#1 determines policy #2, the second indication information determined by RAN#1 can be used to instruct RAN#2 to perform a secure signature and to instruct RAN#2 to impose location restrictions on the routing path of data #1.

[0418] For example, RAN#1 can determine second indication information based on the first indication information. If the first indication information instructs RAN#1 to perform a security signature, the second indication information determined by RAN#1 can be used to instruct RAN#2 to perform a security signature. If the first indication information instructs RAN#1 to perform a security signature and also instructs RAN#1 to restrict the location of the routing path for data #1, the second indication information determined by RAN#1 can be used to instruct RAN#2 to perform a security signature and to instruct RAN#2 to restrict the location of the routing path for data #1.

[0419] This application does not limit the specific name of the second instruction information. For example, the second instruction information may also be called a secure routing instruction, a secure signature instruction, a signature instruction, or other names.

[0420] The following details how RAN#1 selects RAN#2 as its next-hop node.

[0421] In some examples, RAN#1 can be configured with at least one routing path or at least one next-hop node. RAN#1 can select a suitable routing path (denoted as the first routing path) from the at least one routing path configured above, and then send data #1, signature information #1, and information about the first routing path to the next-hop node of RAN#1 on the first routing path (denoted as RAN#2), i.e., execute S350. Alternatively, RAN#1 can select a suitable next-hop node from the at least one next-hop node configured above, and then send data #1, signature information #1, and information about the first routing path to that next-hop node (denoted as RAN#2), i.e., execute S350. The above configuration can be achieved through the first configuration information, which will be described in detail below.

[0422] In some possible implementations, method 300 also includes S310 before S350.

[0423] S310, RAN#1 receives the first configuration information.

[0424] In some examples, the first configuration information may be sent by the first network element. This first network element can be used to plan routing paths. For example, the first network element can determine the routing path from the UE to the landing network element #1, thus determining the complete routing path information.

[0425] Unless otherwise specified, the first network element in this application may be a communication device (e.g., a core network device or a third-party device), a component in the communication device (e.g., a processor, a chip, or a chip system), or a logic module or software that can implement some or all of the functions of the communication device.

[0426] As an example, the first network element can be a RAN node, SMF, other network elements involved in the current 3GPP protocol, or a network element added by the future 3GPP protocol. In other examples, the first network element can also be RAN#1, in which case S310 can be understood as RAN#1 determining the first configuration information. In still other examples, the first network element can be a different network element from the SMF. The first network element can send the first configuration information to RAN#1 through the SMF.

[0427] The first network element can also be called a routing node controller, path planning network element, or other names. For ease of understanding, this application refers to the first network element as a routing node controller.

[0428] In some examples, the routing node controller can be deployed on NTN devices, such as low Earth orbit (LEO) satellites, medium Earth orbit (MEO) satellites, or geostationary orbit (GEO) satellites. In other examples, the routing node controller can be deployed on the ground; this application is not limited to this.

[0429] In some examples, the first configuration information may be sent by a second network element. This second network element can be used to generate a key. For example, the second network element may send key #1 to RAN#1. As another example, in signature example 2, the second network element may send key #1 to RAN#1, key #2 to RAN#2, ..., and key #i to RAN#i.

[0430] Unless otherwise specified, the second network element in this application may be a communication device (e.g., a core network device or a third-party device), a component in the communication device (e.g., a processor, a chip, or a chip system), or a logic module or software that can implement some or all of the functions of the communication device.

[0431] As an example, the second network element can be a RAN node, an SMF, other network elements involved in the current 3GPP protocol, or a network element added by the future 3GPP protocol. In some examples, the second network element may be a different network element from the SMF. The second network element can send the first configuration information to RAN#1 through the SMF.

[0432] The second network element can also be called a key management network element, a security network element, a security function network element, or other names. For ease of understanding, this application refers to the second network element as a security network element.

[0433] In some examples, the security network element can be deployed on NTN devices, such as LEO, MEO, or GEO satellites. In other examples, the security network element can be deployed on the ground; this application is not limited to this.

[0434] For example, the first configuration information is used to configure at least one of the following:

[0435] Key #1;

[0436] Information about the first routing path;

[0437] • The correspondence between the information of the first routing path and key #1;

[0438] • The mapping relationship between the information of landing network element #1 and the identifier of the first routing path;

[0439] Information for RAN#2;

[0440] • Signature method (e.g., first signature method);

[0441] • First-hand information.

[0442] As an example, the "correspondence between the information of the first routing path and the key #1" can be configured by carrying the information of the key #1 and the first routing path. For example, the first configuration information carries the information of the key #1 and the first routing path, and RAN #1 can determine the correspondence between the information of the first routing path and the key #1 based on the above information.

[0443] As an example, the mapping relationship between the information of landing network element #1 and the identifier of the first routing path can be configured by carrying the information of landing network element #1 and the identifier of the first routing path. For example, if the first configuration information carries the information of landing network element #1 and the identifier of the first routing path, RAN #1 can determine the correspondence between the information of landing network element #1 and the identifier of the first routing path based on the above information.

[0444] The first time information can be used to indicate the validity period of the first routing path. For example, after the validity period of the first routing path expires, RAN#1 can request an update to the routing path from the routing node controller or the security network element. Optionally, after the validity period of the first routing path expires, RAN#1 can request an update to the key corresponding to the routing path from the routing node controller or the security network element. Other descriptions of the time information can be found in the "Example of the Validity Period of a Routing Path" section below, and will not be detailed here.

[0445] The following is an example of how RAN#1 obtains the mapping relationship between the information of the landing network element #1 and the information of the first routing path.

[0446] In example 1 of the routing path information, the information of the first routing path includes the information of the landing network element #1. Therefore, there can be a correspondence between the information of the first routing path and the information of the landing network element #1. For example, the first configuration information can be used to configure the information of the first routing path. In this way, after obtaining the information of the first routing path, RAN #1 can determine that there is a correspondence between the first routing path and the information of the landing network element #1.

[0447] In example 2 of the routing path information, the information of the first routing path is the identifier of the first routing path. The first configuration information can be used to configure the mapping relationship between the information of the landing network element #1 and the identifier of the first routing path. In this way, RAN #1 can determine the correspondence between the first routing path and the identifier of the landing network element #1 based on the first configuration information.

[0448] To facilitate understanding, the following examples illustrate the two functions of the first configuration information, referred to as Configuration Example 1 and Configuration Example 2.

[0449] Configuration Example 1: The first configuration information can be used to configure the first route path.

[0450] As an example, the first routing path can be a routing path with the destination network element as the landing network element #1. Exemplarily, the first routing path can also be understood as a routing path planned (or determined) by the routing node controller that can route data #1 from the UE to the landing network element #1. The first routing path can also be called a planned routing path, a preset routing path, or other names.

[0451] In some examples, the first configuration information may include information about a first routing path. For example, this first routing path information may include information about RAN#1, RAN#2, ..., and the landing network element #1. That is, the meaning of the first routing path information can be found in the aforementioned example 1 of routing path information. Optionally, the first routing path information may also include UE information.

[0452] In this way, RAN#1 can obtain the mapping relationship between the information of the first routing path and the information of the landing network element #1 based on the information of the first routing path. In S332, RAN#1 can determine the information of the first routing path based on the first configuration information in configuration example 1 and the information of the landing network element #1. For example, RAN#1 can find the routing path (i.e., the first routing path) whose last hop node is the aforementioned landing network element #1 based on the information of the landing network element #1.

[0453] For an example of how RAN#1 obtains information about the landing network element #1, please refer to S332 above, which will not be repeated here.

[0454] In some examples, the first configuration information can be used to configure multiple routing paths. The first routing path can be one of the aforementioned multiple routing paths.

[0455] As an example, the destination network elements of multiple routing paths can be different landing network elements. In this way, RAN#1 can select the first routing path corresponding to the information of landing network element #1 from multiple routing paths by executing S332.

[0456] As another example, the destination network element for multiple routing paths can all be the landing network element #1. RAN #1 can determine which routing path to use based on security policies, UE indication information, or the load conditions of the multiple routing paths. See Example 1 and Example 2 for second node determination below for details.

[0457] Configuration Example 2: The first configuration information can be used to configure RAN#2 and the first routing path.

[0458] In some examples, the first configuration information may include information about RAN#2 and information about the first routing path. This first routing path information may be an identifier for the first routing path. That is, the information about the first routing path can be understood by referring to the meaning of the aforementioned example 2 of routing path information.

[0459] For example, the routing node controller can determine a first routing path and configure the next-hop node of RAN#1 (i.e., RAN#2) and the identifier of the first routing path for RAN#1, and configure the next-hop node of RAN#2 and the identifier of the first routing path for RAN#2. In some possible implementations, the routing node controller can configure the next-hop node and the identifier of the first routing path for each node on the first routing path.

[0460] As an example, after S332, RAN#1 can determine RAN#2 based on the correspondence between the information of the first routing path and the information of RAN#2.

[0461] The following is an example of RAN#1 selecting RAN#2 from multiple next-hop nodes.

[0462] In some examples, the first configuration information can be used to configure information for multiple RANs. These multiple RANs can all be the next-hop node of RAN#1. RAN#2 can be one of these multiple RANs. RAN#2 can correspond to the identifier of the first routing path.

[0463] As an example, information from multiple RANs corresponds to different routing path identifiers. Thus, RAN#1 can use the identifier of the first routing path determined by S332 to select RAN#2 from among the multiple RANs.

[0464] In some possible implementations, RAN#2 and subsequent nodes can determine the next-hop node based on the identifier of the first routing path received from the previous-hop node. For example, the routing node controller can indicate the identifier of the first routing path and the next-hop node of RAN#2 to RAN#2 through configuration information. RAN#2 can obtain the identifier of the first routing path from RAN#1 through S350. Thus, RAN#2 can determine its next-hop node based on the identifier of the first routing path, the identifier of the first routing path indicated by the aforementioned configuration information, and the next-hop node of RAN#2.

[0465] As a concrete example, the first configuration information can configure RAN#1 with RAN#2 information and path identifier #1. The routing node controller can configure RAN#2 with RAN#3 information and path identifier #1, and RAN#4 information and path identifier #2. RAN#1 can send path identifier #1 to RAN#2, so that RAN#2 can determine its next-hop node as RAN#3, instead of RAN#4, based on path identifier #1.

[0466] The two functions of the first configuration information have been introduced above, namely Configuration Example 1 and Configuration Example 2. For a description of how the routing node controller or security network element determines the first configuration information, please refer to the following sections, such as Method 600 and Method 700.

[0467] The following is an example of RAN#1 triggering the first configuration information to be sent.

[0468] In some possible implementations, method 300 may also include S309 before S310.

[0469] In S309, RAN#1 sends a second request message to the routing node controller. This second request message can be used to request the routing node controller to determine a routing path, or to request the routing node controller to determine the next-hop node for RAN#1 on the routing path. As an example, the second request message and the first request message described later can be the same. As another example, the second request message in S309 can be interchanged with the first request message described later.

[0470] For example, the second request information is used to request the routing node controller to determine a routing path. S310 may include: in response to the second request information, the routing node controller or security network element sends first configuration information to RAN#1, which is used to configure the first routing path.

[0471] For example, the second request information is used to request the routing node controller to determine the next-hop node of RAN#1 on the routing path. S310 may include: in response to the second request information, the routing node controller or security network element sends first configuration information to RAN#1, which is used to configure the next-hop node of RAN#1 on the first routing path (denoted as RAN#2).

[0472] Understandably, S309 can be an optional operation. For example, after determining the first routing path, the routing node controller can proactively send the first configuration information to RAN#1 without requiring a request from RAN#1.

[0473] In some possible implementations, the second request information may include at least one of the following:

[0474] • Information about the landing network element #1;

[0475] Information for RAN#1;

[0476] • Security routing requirements / policy information;

[0477] • First location information;

[0478] • Fifth indication information. For example, this fifth indication information can be used to indicate that the node processing data #1 is at the position indicated by the first position information.

[0479] For example, policy information may indicate one or more of policies #0 to #3, or one or more of policies #a to #c. Secure routing requirements may include whether path information is signed, and / or whether location restrictions are imposed on the nodes processing the data.

[0480] As an example, RAN#1 can establish a PDU session and / or perform a registration procedure with other UEs (denoted as UE#2) before establishing a PDU session and / or performing a registration procedure with the UE (denoted as UE#1) in method 300. Here, the location information of both UE#1 and UE#2 is first location information, and the landing network element is landing network element #1. Thus, RAN#1 can obtain information about landing network element #1 during the process of establishing a PDU session and / or performing a registration procedure with UE#2. Unless otherwise specified, the UE in this application refers to the aforementioned UE#1, which will not be described again hereafter.

[0481] For example, if RAN#1 requests a routing path corresponding to policy #0 or policy #1, or if the routing path requested by RAN#1 has no location restrictions, then RAN#1 may omit the first location information and the fifth indication information from its second request information. In this way, the routing node controller can plan the routing path without considering the first location information.

[0482] For example, if RAN#1 requests a routing path corresponding to policy #2 or policy #3, or if the routing path requested by RAN#1 has location restrictions, then RAN#1 can carry the first location information and / or the fifth indication information in the second request information.

[0483] As an example, the second request information includes the first location information, or the second request information includes the first location information and the fifth indication information. The routing node controller can determine a location-restricted routing path based on the first location information, or in response to the fifth indication information and based on the first location information. Nodes on the location-restricted routing path are located at the position indicated by the first location information when processing data.

[0484] As another example, the second request information includes the fifth indication information. In response to the fifth indication information, the routing node controller can obtain the first location information from RAN#1, SMF, or other network elements, or obtain the first location information cached by the routing node controller, thereby determining a location-restricted routing path based on the first location information.

[0485] In the example above, if the second request information carries the fifth indication information, it indicates that the node processing data #1 needs to be at the position indicated by the first position information. In other words, if the second request information does not carry the fifth indication information, it indicates that the node processing data #1 may or may not be at the position indicated by the first position information. That is to say, the second request information can indicate whether the node processing data #1 needs to be at the position indicated by the first position information by whether or not it carries the fifth indication information.

[0486] In other examples, the fifth indication information can indicate whether the node processing data #1 is at the location indicated by the first location information. That is, the second request information can use the content of the fifth indication information to indicate whether the node processing data #1 needs to be at the location indicated by the first location information. For example, assuming the fifth indication information indicates that the node processing data #1 does not need to be at the location indicated by the first location information, then regardless of whether RAN #1 sends the first location information, or whether the routing node controller has the first location information, the routing node controller can plan the route without location restrictions. In other words, the routing node controller can disregard the first location information when determining the first route.

[0487] In other examples, the second request information carries a fifth indication, instructing the routing node controller to distribute path #1 where the node does not need to be at the location indicated by the first location information, and path #2 where the node is at the location indicated by the first location information. Thus, the routing node controller can distribute path #1 and path #2 to RAN #1 based on the fifth indication. The first routing path can be either path #1 or path #2.

[0488] In other examples, if the second request information does not carry the fifth indication information, then the routing node controller is instructed to issue path #1 where the node does not need to be at the location indicated by the first location information, and path #2 where the node is at the location indicated by the first location information. Here, the first routing path can be either path #1 or path #2. If the second request information carries the fifth indication information, and the fifth indication information indicates that the node processing data #1 does not need to be at the location indicated by the first location information, the routing node controller issues path #1 (considered the first routing path). If the second request information carries the fifth indication information, and the fifth indication information indicates that the node processing data #1 is at the location indicated by the first location information, the routing node controller issues path #2 (considered the first routing path).

[0489] In other possible implementations, the routing node controller may obtain the information of the aforementioned landing network element #1, RAN #1, first location information, or fifth indication information through other means. For example, the routing node controller may receive at least one of the following from the SMF: information of the landing network element #1, RAN #1, first location information, or fifth indication information.

[0490] For example, the first location information can indicate the location of the UE. The routing node controller can obtain the location of RAN#1 from the ephemeris information node based on the information of RAN#1 (e.g., the IP address of RAN#1). This location of RAN#1 can be understood as the location of the UE, and thus as the first location information. That is, in the above example, the routing node controller can obtain the first location information from the ephemeris information node. As an example, after receiving the second request information, the routing node controller can obtain the location of RAN#1 from the ephemeris information node. In this way, the location of RAN#1 can be understood as the location of RAN#1 when it sent the second request information, or the location of RAN#1 a short period of time after it sent the second request information.

[0491] For example, the routing node controller can obtain the information of RAN#1 and the information of the landing network element #1 during the PDU session establishment process or UE registration process, and associate the information of RAN#1 with the information of the landing network element #1.

[0492] In some possible implementations, the routing node controller can interact with RAN#1 through a 3GPP network element (e.g., SMF). This 3GPP network element can then obtain information about RAN#1 and the destination network element #1 during the interaction between the routing node controller and RAN#1. The 3GPP network element can send a second request message to the routing node controller, requesting the routing node controller to issue a routing path to RAN#1, or requesting the routing node controller to issue the next-hop node of RAN#1 on the routing path. As an example, the second request message may include information about RAN#1 and the destination network element #1.

[0493] The following examples further illustrate how RAN#1 determines the identifier of the first routing path, denoted as Route Path Determination Example 1 and Route Path Determination Example 2. In short, in Route Path Determination Example 1, RAN#1 can determine the information of the first routing path based on a security policy. In Route Path Determination Example 2, RAN#1 can determine the information of the first routing path based on first indication information.

[0494] Example 1 of route path determination:

[0495] In some possible implementations, S332 includes: RAN#1 determining information about a first routing path based on policies #0 to #3 and data #1. RAN#1 is configured with a mapping between security policies and routing path information. For example, first configuration information can be used to configure this mapping. Alternatively, this mapping can be pre-configured in RAN#1.

[0496] As an example, RAN#1 can determine the information of the first routing path based on policy #0 or policy #1. The RAN nodes on the first routing path may or may not be located at the location indicated by the first location information. This application does not limit this.

[0497] As another example, RAN#1 can determine the information of the first routing path based on policy #2 or policy #3, and the RAN nodes on the first routing path can be located at the positions indicated by the first location information.

[0498] For an example of how RAN#1 determines whether to use policy #0, policy #1, policy #2, or policy #3, please refer to the corresponding content in trigger example 1, such as the section "How RAN#1 determines whether to perform a secure signature based on the first information," which will not be repeated here.

[0499] In some examples, Route Path Determination Example 1 can be combined with Configuration Example 1. In this way, the information of the first route path determined by RAN#1 based on policies #0 to #3 can include information about each node on the first route path. Specifically, on the first route path, RAN#2 is the next-hop node of RAN#1, and the nodes on the first route path are located at the positions indicated by the first location information.

[0500] When multiple routing paths are configured in the first configuration information, this application denotes the routing path ultimately selected by RAN#1 as the first routing path. Thus, S332 above can be understood as RAN#1 determining whether to impose location restrictions on the node processing data #1 based on a security policy, and ultimately determining the first routing path that satisfies the security policy among multiple routing paths. Further, RAN#1 can determine the next-hop node of RAN#1 on the first routing path (denoted as RAN#2).

[0501] For example, on a first routing path satisfying strategy #0 or strategy #1, each node may or may not be located at the position indicated by the first location information; this application does not limit this. As another example, on a first routing path satisfying strategy #2 or strategy #3, each node may be located at the position indicated by the first location information.

[0502] In other examples, Route path determination example 1 can be combined with configuration example 2. In this way, the information of the first route path determined by RAN#1 based on policies #0 to #3 is the identifier of the first route path. Further, RAN#1 can determine RAN#2 based on the correspondence between the identifier of the first route path and RAN#2. An example of how RAN#1 obtains the correspondence between the identifier of the first route path and RAN#2 is given in configuration example 2 and will not be repeated here.

[0503] When the first configuration information indicates the identifiers of multiple routing paths, this application records the identifier of the routing path finally selected by RAN#1 as the identifier of the first routing path. Thus, S332 above can be understood as RAN#1 determining whether to impose location restrictions on the node processing data #1 based on a security policy, and ultimately determining the identifier corresponding to the first routing path that satisfies the security policy among the identifiers of multiple routing paths. Further, RAN#1 can determine the next-hop node (denoted as RAN#2) corresponding to the identifier of this first routing path.

[0504] Example 2 of route path determination:

[0505] In some possible implementations, S332 includes: RAN#1 determining information about a first routing path based on the first indication information and data #1.

[0506] As an example, if the first indication information does not indicate that the node processing data #1 is at the location indicated by the first location information, or indicates that the node processing data #1 does not need to be at the location indicated by the first location information, then RAN #1 can determine the information of the first routing path based on the first indication information. The RAN node on the first routing path information may or may not be at the location indicated by the first location information; this application does not limit this.

[0507] As another example, if the first indication information indicates that the node processing data #1 is at the location indicated by the first location information, then RAN #1 can determine the information of the first routing path based on the first indication information. The RAN node on this first routing path information can be at the location indicated by the first location information.

[0508] For details regarding the first instruction message, please refer to Trigger Example 2; it will not be repeated here.

[0509] In some examples, route path determination example 2 can be combined with configuration example 1. In this way, the information of the first route path determined by RAN#1 based on the first indication information can include information about each node on the first route path. Specifically, on the first route path, RAN#2 is the next-hop node of RAN#1, and the nodes on the first route path are located at the positions indicated by the first location information.

[0510] When multiple routing paths are configured in the first configuration information, this application designates the routing path ultimately selected by RAN#1 as the first routing path. Thus, S332 above can be understood as RAN#1 determining, based on the first indication information, whether to impose location restrictions on the node processing data #1, and ultimately determining the first routing path that satisfies the security policy among the multiple routing paths. Further, RAN#1 can determine the next-hop node of RAN#1 on the first routing path (denoted as RAN#2).

[0511] For example, if the first indication information does not indicate that the node processing data #1 is at the location indicated by the first location information, or if it indicates that the node processing data #1 does not need to be at the location indicated by the first location information, then each node in the information of the first routing path determined by RAN#1 may or may not be at the location indicated by the first location information; this application does not limit this. As another example, if the first indication information indicates that the node processing data #1 is at the location indicated by the first location information, then each node in the information of the first routing path determined by RAN#1 may all be at the location indicated by the first location information.

[0512] In other examples, Route Path Determination Example 2 can be combined with Configuration Example 2. In this way, the information of the first route path determined by RAN#1 based on the first indication information is the identifier of the first route path. Further, RAN#1 can determine RAN#2 based on the correspondence between the identifier of the first route path and RAN#2. An example of how RAN#1 obtains the correspondence between the identifier of the first route path and RAN#2 is given in Configuration Example 2 and will not be repeated here.

[0513] When the first configuration information indicates the identifiers of multiple routing paths, this application records the identifier of the routing path ultimately selected by RAN#1 as the identifier of the first routing path. Thus, S332 above can be understood as RAN#1 determining, based on the first indication information, whether to impose location restrictions on the node processing data #1, and ultimately determining the identifier corresponding to the first routing path that satisfies the first indication information from among the identifiers of multiple routing paths. Further, RAN#1 can determine the next-hop node (denoted as RAN#2) corresponding to the identifier of this first routing path.

[0514] The following is an example of how network elements verify the validity of signature information.

[0515] In some possible implementations, after S360, method 300 also includes S372 and S376. These are described below.

[0516] S372, verify the network element to obtain the second signature information and the first routing path information.

[0517] The second signature information can be understood as the signature information that the verification network element needs to verify. For example, in signature example 1, the second signature information can be one or more of signature information #1, signature information #2 to signature information #i. As another example, in signature example 2, the second signature information can be signature information #i or signature information #i+1.

[0518] In some examples, the verification network element can be the landing network element #1. For example, S372 and S360 can be considered as one step. That is, S372 includes: the verification network element (i.e., the landing network element) receiving data #1, second signature information (i.e., signature information #i), and information of the first routing path from RAN#2. As another example, the part of S372 where the verification network element obtains the information of the first routing path can be considered as one step with S360. Specifically, S360 can include the verification network element (i.e., the landing network element #1) receiving data #1, signature information #i, and information of the first routing path from RAN#2. Further, the verification network element can process the signature information #i based on its key #i+1 to obtain the second signature information (i.e., signature information #i+1).

[0519] In other examples, the verification network element can be a different network element from the landing network element #1. Thus, S372 can include: the landing network element #1 sending the second signature information and the first routing path information to the verification network element. Correspondingly, the verification network element receives the second signature information and the first routing path information from the landing network element #1. In signature example 1, the second signature information can be one or more of signature information #1, signature information #2 to signature information #i. In signature example 2, the second signature information can be signature information #i or signature information #i+1.

[0520] S376, the network element uses the verification key (denoted as verification key #1) to verify the second signature information.

[0521] In some examples, the verification network element verifies the validity of the second signature information based on verification key #1 and the information to be signed. For example, the information to be signed can be sent directly to the verification network element by the RAN node through the first routing path. As an example, the verification network element can process the information to be signed based on verification key #1 to obtain the second signature information '. The verification network element can compare the difference between the second signature information ' and the second signature information to verify the validity of the second signature information. The verification network element can also verify the validity of the second signature information in other ways, which are not limited in this application.

[0522] In some examples, the verification network element can be a local network element. If, based on S376 above, the verification network element determines that the second signature information is valid, then the verification network element can forward data #1. For example, the verification network element can be a gateway station, which can forward data #1 using a UPF. Another example is that the verification network element can be a UPF, which can forward data #1 to the DN.

[0523] In other examples, the verification network element can be a different network element from the destination network element. If, based on S376 above, the verification network element determines that the second signature information is valid, then the verification network element can indicate to the destination network element that the second signature information is valid. Further, the destination network element can forward the data #1.

[0524] In some possible implementations, method 300 further includes: if the second signature information verification fails, the verification network element sends third information. For example, the verification network element may send the third information to the security network element and / or the routing node controller. That is, the recipient of the third information may be the security network element and / or the routing node controller.

[0525] As an example, the third information is used to indicate updating the first routing path, and / or, the third information is used to indicate updating the key corresponding to the first routing path. Optionally, the third information includes information about the first routing path.

[0526] In some examples, the receiver of the third information can replace some nodes on the first routing path or replan the routing path based on the third information. Optionally, the receiver may distribute new keys to each node on the updated routing path.

[0527] In other examples, the receiver of the third information can use the third information to send new keys to each node on the first routing path.

[0528] The following is an example of obtaining the verification key #1 by verifying the network element.

[0529] In some examples, the verification network element can store the correspondence between the information of the first routing path and the verification key #1. In this way, the verification network element can determine the verification key #1 based on the aforementioned correspondence and the information of the first routing path, thereby executing S376.

[0530] In some possible implementations, method 300 may also include S370 before S376.

[0531] S370, the verification network element receives the second configuration information. For example, the verification network element can receive the second configuration information from the security network element or the routing node controller. See later sections, such as method 700, for a description of how the routing node controller or security network element determines and distributes the second configuration information.

[0532] For example, the second configuration information is used to configure at least one of the following:

[0533] • Verification key #1;

[0534] Information about the first routing path;

[0535] • The correspondence between the information of the first routing path and the verification key #1;

[0536] • Signature method (e.g., first signature method);

[0537] • First-hand information.

[0538] As an example, the "correspondence between the information of the first routing path and the verification key #1" can be configured by carrying the verification key #1 and the information of the first routing path. For example, the first configuration information carries the verification key #1 and the information of the first routing path, and the verification network element can determine the correspondence between the information of the first routing path and the verification key #1 based on the above information.

[0539] The following is an example of instructing network elements to verify the second signature information.

[0540] In some examples, the verification network element can be implicitly instructed to verify the second signature information. For instance, the second signature information can implicitly instruct the verification network element to verify the second signature information. Based on the second signature information, the verification network element can determine the verification key #1 based on the first path information, thereby executing S376. As another example, the first routing path information can implicitly instruct the verification network element to verify the second signature information. Based on the first routing path information, the verification network element can determine to obtain the verification key #1, thereby executing S376.

[0541] In other examples, the verification network element can be explicitly instructed to verify the signature information #1. In some possible implementations, the verification network element is a local network element, and method 300 further includes: RAN#2 sending indication information #1 to the verification network element. This indication information #1 can be used to instruct the verification network element to verify the signature information #1. For example, RAN#2 can send indication information #1 to the verification network element in S360.

[0542] In some other possible implementations, the verification network element is a different network element from the destination network element, and method 300 further includes: the destination network element sending indication information #1 to the verification network element. This indication information #1 can be used to instruct the verification network element to verify the signature information #1.

[0543] In other words, the aforementioned instruction information #1 can explicitly instruct the verification network element to verify the signature information #1. In other words, instruction information #1 can be information that has the function of "instructing the verification network element to verify the signature information #1". This application does not limit the specific form of instruction information #1. For example, instruction information #1 can be the aforementioned first instruction information or second instruction information.

[0544] The following is an example of the validity period of a route path.

[0545] For example, the first time information can indicate the validity period of the first routing path. During the validity period of the first routing path, that first routing path is available. In other words, the "valid time" of the aforementioned routing path can also be understood as the "available time" of the routing path. As an example, the aforementioned "time" can be understood as a "time period".

[0546] In some examples, the initial time information may include the length of the validity period. For instance, each node on the first routing path can obtain the start time of the validity period of the first routing path through predefined, preconfigured, configuration information indication, or other means. This start time could be the moment the configuration information for the first routing path is issued, or a moment after the issuance of the configuration information. Thus, each node on the first routing path can determine the validity period of the first routing path based on the length of the validity period in the initial event information and the start time of the validity period.

[0547] As a concrete example, suppose RAN#1 receives the first configuration information at 15:30. This first configuration information is used to configure the information of the first routing path and the first time information. The first time information can indicate 20 minutes, indicating that the validity period of the first routing path is from 15:30 to 15:20. The above example is for illustrative purposes only and is not intended to limit this application.

[0548] In other examples, the initial time information may include the start time of the valid time and the length of the valid time.

[0549] In some other examples, the first time information may include the start and end times of the valid time.

[0550] In some possible implementations, the initial information can be determined by the routing node controller. For example, the routing node controller can determine the initial information based on factors such as the movement of each node on the first routing path.

[0551] To facilitate understanding, the following examples illustrate the behavior of each network element after the validity period of the routing path expires. In short, the examples below assume that before configuring the first routing path, at least one of RAN#1, the verification network element, the security network element, the landing network element #1, or the routing node controller has a second routing path and second time information configured.

[0552] The second routing path can be a routing path determined by the routing node controller, with the destination network element being RAN#1. RAN#1 can be a node on the second routing path. For ease of description, the following example uses RAN#1 triggering a routing path update.

[0553] In some possible implementations, method 300 may also include S302a, S304a and S306a before S310.

[0554] S302a, RAN#1 receives information about the second routing path and the second time information. For example, RAN#1 may receive configuration information used to configure the second routing path and the second time information.

[0555] S304a, RAN#1 determines the expiration time of the second routing path based on the second time information.

[0556] S306a, RAN#1 sends a first request message to the routing node controller. Correspondingly, the routing node controller can receive the first request message from RAN#1.

[0557] In some examples, RAN#1 can send the first request message directly to the routing node controller. In other examples, RAN#1 can send the first request message indirectly to the routing node controller through one or more network elements (e.g., security network elements).

[0558] Optionally, the first request information is used to request an update to the routing path with the destination network element as the landing network element #1. For example, S310 may include: the routing node controller sending first configuration information to RAN#1 based on the first request information.

[0559] For example, after receiving the first request information, the routing node controller can determine configuration information such as the first routing path and send the configuration information to the security network element. The security network element can determine the first configuration information based on the received configuration information and send the first configuration information to RAN#1. The configuration information received by the security network element from the routing node controller may be exactly the same as the first configuration information, or it may be different; this application does not limit this.

[0560] Thus, the first routing path can be the updated routing path with the destination network element as the landing network element #1.

[0561] Optionally, the first request information is used to request an update of the key corresponding to the routing path whose destination network element is landing network element #1. For example, the first request information can be used to request an update of the second routing path.

[0562] The "key corresponding to the routing path" can include keys used for signing and / or keys used for verification along the routing path. The key used for signing can be the key of each RAN node along the routing path. Optionally, the key used for signing can also include the key of the landing network element.

[0563] For example, the first request information can implicitly "request an update to the key corresponding to the routing path whose destination network element is landing network element #1". For instance, by default, the routing node controller updates the key corresponding to the updated routing path when the routing path is updated. Thus, the routing node controller can request the generation of the updated key corresponding to the updated routing path from the security network element after updating the routing path (e.g., determining the first routing path).

[0564] For example, the first request information can explicitly state "request to update the key corresponding to the routing path where the destination network element is land network element #1". In this way, the information used for "requesting to update the key corresponding to the routing path where the destination network element is land network element #1" and the aforementioned information used for "requesting to update the routing path where the destination network element is land network element #1" can be the same information or different information, and this application does not limit it.

[0565] In some examples, the first request information may be used to: request an update to the routing path with the destination network element as the landing network element #1, and / or to request an update to the key corresponding to the routing path with the destination network element as the landing network element #1.

[0566] The above example uses RAN#1 to trigger the update of the routing path. In the example above, the execution subject in S302a, S304a and S306a can be replaced by RAN#1 with the verification network element, the security network element or the landing network element #1. The details will not be elaborated here.

[0567] The following description uses the example of a routing node controller triggering a route path update. In some possible implementations, prior to S310, method 300 also includes S302b and S304b.

[0568] S302b, the routing node controller obtains information about the second routing path and the second time information. For example, the routing node controller can construct the second routing path and determine the second time information.

[0569] S304b, the routing node controller determines the expiration time of the second routing path based on the second time information.

[0570] Thus, after S304b, the first routing path can execute S310, thereby configuring the updated first routing path for nodes such as RAN#1.

[0571] The following is an example of how RAN#1 determines the signature method.

[0572] In some possible implementations, S340 includes: RAN#1 generating signature information #1 using key #1 based on the first signature method.

[0573] For example, the first signature method can be the one shown in signature example 1. As another example, the first signature method can be the one shown in signature example 2.

[0574] As an example, in signature example 1, the information to be signed can be the path information of RAN#1. As an example, in signature example 2, the information to be signed can be at least one of data #1, UE information, or a random number.

[0575] In some possible implementations, method 300 also includes: S354.

[0576] S354, RAN#1 instructs RAN#2 on information regarding the first signature method. For example, RAN#1 may send instruction information to RAN#2, which may instruct RAN#2 to perform a secure signature using the first signature method. Exemplarily, this instruction information may include information about the first signature method.

[0577] As an example, the information regarding the first signature method in S354, along with the data #1, signature information #1, and first routing path information in S350, can be sent simultaneously. In other words, S350 and S354 can be the same steps. As another example, the information regarding the first signature method in S354, along with the data #1, signature information #1, and first routing path information in S350, can be sent separately. In other words, S350 and S354 can be different steps.

[0578] As an example, the information regarding the first signature method in S354 and the second instruction information in S352 can be sent simultaneously. In other words, S352 and S354 can be the same step. As another example, the information regarding the first signature method in S354 and the second instruction information in S352 can be sent separately. In other words, S350 and S352 can be different steps.

[0579] In some possible implementations, method 300 may also include S312 before S340.

[0580] S312, RAN#1 receives third indication information from the previous hop node, routing node controller or security network element.

[0581] The third instruction information can be used to instruct the use of the first signature method for secure signing. For example, the third instruction information may include information about the first signature method. In this way, RAN#1 can perform secure signing using the first signature method based on the information about the first signature method, that is, execute S340.

[0582] In some examples, the third indication information may be received by RAN#1 from the previous hop node.

[0583] In other examples, the third indication information may be received by RAN#1 from the routing node controller or security network element. Optionally, the third indication information may be carried within the first configuration information.

[0584] The following is an example of verifying network elements to determine the signature method.

[0585] In some possible implementations, method 300 also includes S374 before S376.

[0586] S374, the verification network element receives information in the first signature method from the landing network element #1 or RAN #2.

[0587] In some examples, the verification network element can be the landing network element #1. For example, S374 and S360 can be considered as one step. That is, S374 includes: the verification network element (i.e., the landing network element) receiving data #1, second signature information (i.e., signature information #i), information of the first routing path, and information of the first signature method from RAN #2. However, for another example, S374 and S360 can be considered as different steps.

[0588] In other examples, the verification network element can be a different network element from the destination network element #1. In this case, S374 can include: the destination network element #1 sending information about the first signature method to the verification network element. Correspondingly, the verification network element receives the information about the first signature method from the destination network element #1.

[0589] In some possible implementations, S376 includes: verifying the network element based on the first signature method, using the verification key #1, to verify the second signature information.

[0590] The configuration process for the signature method is described later, for example, method 700, which will not be detailed here.

[0591] Figure 4 This is a schematic flowchart of another communication method 400 provided in an embodiment of this application. Optional operations in method 400 are shown in dashed lines. Method 400 can be combined with method 300. The following describes the process in conjunction with... Figure 4 An example illustrating how a UE obtains its first address information.

[0592] S410, UE completes the authentication and registration process.

[0593] S420, the UE sends a PDU session establishment request to the SMF. Correspondingly, the SMF receives the PDU session establishment request from the UE.

[0594] S430, SMF determines that the UE's data needs to be securely signed on the routing path, and / or that the routing path of the UE's data needs to be location-restricted.

[0595] The above S430 can also be understood as the SMF determining to use policy #1 to protect the data transmitted by the UE, or determining to use policy #2 to protect the data transmitted by the UE, or determining to use policy #3 to protect the data transmitted by the UE.

[0596] Regarding how to trigger SMF to execute S430, several methods are introduced below, referred to as judgment method 1 to judgment method 4 respectively.

[0597] Judgment Method 1: SMF can determine policy #0, policy #1, policy #2 or policy #3 based on the location of the UE, the location indicated by the UE, or the location of the landing network element to which the data sent by the UE arrives.

[0598] For example, a PDU session establishment request may include the location of the UE.

[0599] For example, a UE can send a PDU session establishment request to the SMF through a RAN node. The RAN node can determine the location of the UE based on its coverage area and report the location of the UE to the SMF.

[0600] For example, if the network side locates the UE, the SMF can obtain the UE's location from core network elements such as the LMF.

[0601] For example, a PDU session establishment request may include the UE's identifier. The SMF can then obtain the UE's indicated location from the UDM based on this UE identifier.

[0602] For example, a landing network element can be a gateway station. SMF can obtain the location of the gateway station determined by the UE in S410.

[0603] For a detailed description of judgment method 1, please refer to the content of RAN#1 in trigger example 1, which determines the security policy based on the first location information (i.e., the location of the UE, the location indicated by the UE, or the location of the landing network element). The difference is that in judgment method 1, the subject for judging the UE's security policy is the SMF.

[0604] In other words, SMF can determine security policies based on the above correspondence between locations and security policies.

[0605] Method 1 can implement location-based configuration strategies, which can meet data supervision requirements and avoid redundant configuration.

[0606] Method 2: The SMF can obtain the UE's subscription data from the UDM. This subscription data can indicate the security policy. For example, the SMF can determine whether to use policy #0, policy #1, policy #2, or policy #3 based on the content of the subscription data.

[0607] For example, SMF can retrieve or update subscription data through subscription retrieval or subscription for updates. The subscription data in this application may also be referred to as subscription data or other names.

[0608] For example, a PDU session establishment request may include the UE's identifier. The SMF can then retrieve the UE's subscription data from the UDM based on this UE identifier.

[0609] In some examples, the UE's subscription data can indicate the use of policy #1, policy #2, or policy #3 in an NTN scenario. Thus, the SMF can determine whether to use policy #1, policy #2, or policy #3 if it determines that the data transmitted by the UE needs to be forwarded by one or more on-board RAN nodes. Alternatively, the SMF can determine whether to use policy #1, policy #2, or policy #3 and determine indication information #3. This indication information #3 can be carried in a subsequent message sent to the UE (e.g., a PDU session establishment accept message). This indication information #3 can be used to instruct the UE to use the address information corresponding to policy #1, policy #2, or policy #3 in an NTN scenario.

[0610] Method 2 can enable UE-level policy configuration, thereby meeting the security requirements of different UEs.

[0611] Method 3: The SMF can obtain the service type of the UE's data, as well as the mapping relationship between specific service types and security policies. In this way, the SMF can determine whether the UE's data service type belongs to the aforementioned specific service type. The SMF can then determine the service for that specific service type of the UE and allocate address information corresponding to policy #1, policy #2, or policy #3.

[0612] For example, a PDU session establishment request may include a business type.

[0613] SMF can obtain the mapping relationship between service types and policies of UE data from UDM.

[0614] As an example, service type #1 corresponds to policy #1. The SMF can allocate address information #1 to the UE, and this address information #1 corresponds to policy #1. Thus, when the UE transmits data of service type #1, address information #1 can be used as the UE's address information. RAN #1 can determine the use of policy #1 based on address information #1, i.e., perform secure signing.

[0615] As another example, service type #2 corresponds to policy #2. The SMF can assign address information #2 to the UE, which corresponds to policy #2. Thus, when the UE transmits data of service type #2, address information #2 can be used as the UE's address information. RAN #2 can determine the use of policy #2 based on address information #2, i.e., perform secure signing and restrict the location of the nodes processing the data.

[0616] Method 3 allows for policy configuration at the business level, thus meeting the security requirements of different business types. For example, for businesses with high security requirements, location restrictions can be imposed on the nodes processing that business data. As an example, businesses with high security requirements could include factory operations or power grid operations, and so on.

[0617] Judgment Method 4: The SMF can determine whether the NTN equipment network transmitting UE data has an ISL. If the NTN equipment network has an ISL, the SMF can determine policy #2 or policy #3.

[0618] In some examples, after receiving a PDU session establishment request from the UE, the RAN node (e.g., RAN#1) can send indication information #4 to the SMF. This indication information #4 indicates that the data sent by the UE is routed through the NTN device network, or in other words, that the data sent by the UE is in an NTN scenario. In this way, the SMF can determine that the data sent by the UE needs to be transmitted through the NTN device network. Furthermore, the SMF can determine whether the NTN device network accessed by the UE has an ISL (Independent Service Level).

[0619] The instruction information #4 can be carried in a PDU session establishment request or in other messages; this application is not limited to this. This instruction information #4 can be referred to as NTN instruction, satellite instruction, NTNISL instruction, or other names.

[0620] In other examples, the PDU session establishment request sent by the UE to the SMF may carry the PLMNID of the NTN device network. This PLMNID can be the identifier of the NTN device network (i.e., the PLMN) to which the UE is accessing. The SMF can be configured with the PLMN ID of the NTN device network that has an ISL. In this way, the SMF can determine whether the PLMNID reported by the UE belongs to the PLMNID configured by the SMF.

[0621] As an example, if the PLMNID reported by the UE belongs to the PLMN ID configured in the SMF, it can be determined that the NTN device network transmitting the UE's data has an ISL.

[0622] As an example, if the PLMNID reported by the UE does not belong to the PLMN ID configured in the SMF, it can be determined that the NTN device network transmitting the UE's data does not have an ISL.

[0623] SMF can also determine whether the NTN device network transmitting UE data has ISL in other ways, which is not limited in this application.

[0624] In decision method 4, if the NTN device network has an ISL (Independent Service Level), either strategy #2 or strategy #3 can be determined. Compared to the scheme that imposes location restrictions on all NTN device networks, decision method 4 can make full use of the communication resources of NTN devices.

[0625] For S440, select UPF#1 for SMF.

[0626] For example, UPF#1 can be a verification network element. If the SMF determines that the data sent by the UE needs to be securely signed on the routing path, the SMF can choose UPF#1 that supports verification of the signature information.

[0627] For example, UPF#1 and the verification network element can be different network elements. If the SMF determines that the data sent by the UE needs to be securely signed on the routing path, the SMF can select UPF#1 and instruct UPF#1 to send the signature information to the verification network element.

[0628] S450, the SMF sends indication information #2 to the UPF#1. This indication information #2 can be used to determine the first address information. Correspondingly, the UPF#1 receives the indication information #2 from the SMF. This first address information can correspond to a security policy.

[0629] For example, the first address information corresponding to policy #1 can indicate policy #1, that is, the first address information can indicate secure signing. The first address information corresponding to policy #2 can indicate policy #2, that is, the first address information can indicate secure signing and location restrictions on the data routing path.

[0630] In some possible implementations, the SMF can allocate first address information to the UE and carry this first address information in the indication information #2. In this way, the UPF#1 can determine the first address information based on the indication information #2.

[0631] In some other possible implementations, the SMF can send indication information #2 to the UPF#1, which instructs the UPF#1 to allocate address information corresponding to the security policy. In this way, the UPF#1 can determine the address information corresponding to the security policy based on indication information #2.

[0632] In the case of UPF#1 address allocation information, method 400 also includes S455.

[0633] S455, UPF#1 can indicate first address information to SMF. This first address information is the address information corresponding to the security policy, determined by UPF#1 based on the indication of indication information #2.

[0634] In some examples, the SMF and / or UPF#1 can be configured with at least one mapping relationship between address information and security policy.

[0635] At least one of the aforementioned address information can also be understood as an address range. That is, the address information corresponding to a security policy can belong to an address range. If the address information in a data packet belongs to this address range, it indicates that the data needs to be protected according to the security policy on the routing path.

[0636] S460, the SMF sends a PDU session establishment acceptance message to the UE. Correspondingly, the UE receives the PDU session establishment acceptance message from the SMF.

[0637] The PDU session establishment acceptance message may include first address information. The PDU session establishment acceptance message may also be called the PDU session establishment completion message or other names.

[0638] S470, the UE and UPF#1 complete the data channel establishment.

[0639] For example, the aforementioned data channel could be a user plane (UP) data channel.

[0640] In some possible implementations, after the above method 400 is executed, the UE can carry the first address information in the fourth information of S330, so that RAN#1 can determine which security policy to use based on the first address information.

[0641] In some examples, the UE can be configured with multiple address information. For instance, when security signing by the RAN node is required, the UE can use the address information corresponding to policy #1. When location restrictions on data routing paths by the RAN node are required, the UE can use the address information corresponding to policy #3. When security signing is not required, the UE can use the address information corresponding to policy #0.

[0642] The “UE uses address information” can be understood as the address information that the UE carries in the data packets it sends to the RAN node.

[0643] Figure 5 This is a schematic flowchart of another communication method 500 provided in an embodiment of this application. Optional operations in method 500 are shown with dashed lines. Method 500 can be combined with methods 300 and 400. The following describes the process in conjunction with... Figure 5 This section provides an example of how to enable the UE to send the first indication information.

[0644] S510, the fourth network element (e.g., SMF) determines the fourth indication information.

[0645] The fourth indication information can be used to indicate the need for secure signing, and / or the fourth indication information can be used to indicate the location indicated by the first location information of the routing node (or node) that processes the data.

[0646] Unless otherwise specified, the fourth network element in this application can be a communication device (e.g., a core network device), a component within the communication device (e.g., a processor, chip, or chip system), or a logic module or software capable of implementing some or all of the functions of the communication device. For ease of description, the following description uses SMF as an example of the fourth network element.

[0647] S520, the SMF sends the fourth indication information to the UE. Correspondingly, the UE receives the fourth indication information from the SMF.

[0648] In this way, the UE can determine the first indication information based on the fourth indication information, and then send the first indication information to RAN#1 in S330.

[0649] As an example, the content indicated by the fourth indication information can be the same as the content indicated by the first indication information. For instance, if the fourth indication information is used to indicate that a secure signature is to be performed, then the first indication information can also indicate that a secure signature is to be performed. As another example, if the fourth indication information is used to indicate that the routing node processing data is at the location indicated by the first location information, then the first indication information can indicate that the node processing data #1 is at the location indicated by the first location information.

[0650] In some examples, the fourth instruction information may have the same form as the first instruction information. In other examples, the fourth instruction information and the first instruction information may have different forms, which is not limited in this application.

[0651] For example, the UE can obtain the aforementioned fourth indication information during the PDU session establishment process. For instance, the fourth indication information can be carried in the PDU session establishment accept message.

[0652] Based on the fourth indication information in the above scheme, the UE can be informed of the data security requirements. For example, the security requirement could be the need for a secure signature. Another example is that the data routing path needs location restrictions. In this way, the UE can indicate these security requirements to the RAN, enabling the RAN to protect the security of data transmission.

[0653] In some possible implementations, S510 may include any of the following:

[0654] The fourth indication information is determined based on the UE's location, the location indicated by the UE, or the location of the network element to which the data sent by the UE arrives. See judgment method 1 in S430 for details. For example, if the SMF determines to use policy #1,

[0655] The fourth instruction can instruct on secure signing.

[0656] • Based on the UE's subscription data, determine the fourth indication information. See judgment method 2 in S430 for details. For example, in the case of subscription data indication policy #1, the fourth indication information may indicate the need for secure signing.

[0657] ● Determine the fourth instruction information based on the data-driven business type. See judgment method 3 in S430 for details. Examples will not be repeated here.

[0658] ● When the NTN device network has an inter-satellite link, a fourth indication information is determined. The NTN device network can be used to transmit UE data. For example, when the NTN device network has an ISL, the fourth indication information can indicate that the routing node (or node) processing the data is at the location indicated by the first location information. See determination method 4 in S430 for further details.

[0659] In some possible implementations, method 500 may further include S410 and / or S420 before S510. In some possible implementations, method 500 may further include S440 before S520. The descriptions of S410, S420, and S440 above are given in method 400 and will not be repeated here.

[0660] In some possible implementations, method 500 also includes S515 before S520.

[0661] S515, SMF obtains the UE's address information.

[0662] In some possible implementations, the UE's address information may be assigned by the SMF. In other possible implementations, the UE's address information may be obtained by the SMF from UPF#1. The aforementioned UE address information may be address information specific to the PDU session established for the UE. For example, the UE's address information may be the UEIP address.

[0663] In some examples, the address information of the UE described above can be the first address information in method 400. That is, method 400 and method 500 can be combined, and the UE can receive specific first address information and fourth indication information. The UE can choose to implicitly instruct RAN#1 to perform a secure signature and / or to restrict the location of the routing path for processing the data using the first address information; the UE can also explicitly instruct RAN#1 to perform a secure signature and / or to restrict the location of the routing path for processing the data using the first indication information based on the fourth indication information.

[0664] The UE may also use the first address information and the first indication information mentioned above to instruct RAN#1 to perform a security signature, and / or to restrict the location of the routing path for processing the data, which is not limited in this application.

[0665] In some examples, the UE's address information can be carried in the PDU session establishment accept message. That is, the PDU session establishment accept message can carry the fourth indication information as well as the UE's address information.

[0666] In some possible implementations, after S520, method 500 also includes S470. The description of S470 is the same as that in method 400 and will not be repeated here.

[0667] Figure 6 This is a schematic flowchart of a communication method 600 provided in an embodiment of this application. Optional operations in method 600 are shown in dashed lines. Method 600 can be combined with methods 300, 400, and 500. Method 600 takes a security network element and a routing node controller as two network elements as an example, and details the generation and distribution of the first configuration information in S310.

[0668] S620, the routing node controller determines the first routing path based on the information of the landing network element #1.

[0669] In this context, the landing network element #1 can be the last hop node of the first routing path. The following describes how the routing node controller obtains information about the landing network element #1.

[0670] In some examples, the information for the landing network element #1 can be reported by a RAN node (e.g., RAN#1) or a node such as an SMF. Taking RAN#1 as an example, RAN#1 can obtain the information for the landing network element #1 during the UE registration process or the PDU session establishment process, and then RAN#1 can report the information for the landing network element #1 to the routing node controller. For example, the landing network element #1 can be a gateway station, and the gateway station's information can be obtained during the UE registration process. Another example is that the landing network element #1 can be UPF#1, and the UPF#1's information can be obtained during the PDU session establishment process.

[0671] In other examples, the routing node controller can be a RAN node or an SMF node. Taking the SMF as an example, the SMF can obtain information about the landing network element #1 during the UE registration process or PDU session establishment process.

[0672] In some examples, the routing node controller determines the first routing path based on the information from RAN#1 and the information from the landing network element #1. The information from RAN#1 can be reported by the RAN, obtained by the routing node controller during PDU session establishment, or obtained through other means.

[0673] The following is an example of how the routing node controller determines the first routing path.

[0674] In some examples, the routing node controller can construct a first routing path using RAN#1 as the destination network element. For example, the information of this first routing path may include: RAN#1 IP address, RAN#2 IP address, ..., RAN#1 IP address.

[0675] As an example, the routing node controller can construct a first routing path based on ephemeris information so that each on-board node on the first routing path can be connected via ISL.

[0676] In some possible implementations, S620 includes: a routing node controller determining a first routing path based on information about the landing network element #1 and first location information. Nodes on the first routing path are located at the positions indicated by the first location information when processing data.

[0677] Here, "data" can be understood as data transmitted on the first routing path. For example, when data transmitted on other routing paths happens to pass through a node on the first routing path, that node may or may not be at the location indicated by the first location information; this application does not impose any limitations on this.

[0678] As an example, the number of nodes on the first route path is N, where N is an integer greater than 1. In other words, there are N nodes on the first route path.

[0679] In some examples, the aforementioned N nodes can be N RAN nodes. In other words, the aforementioned N nodes may not include the landing network element #1. In other words, N can be equal to "i" mentioned earlier.

[0680] In other examples, the aforementioned N nodes can be N-1 RAN nodes and landing network element #1. In other words, N can be equal to "i+1" mentioned earlier.

[0681] S630, the security network element obtains the number N of nodes on the first routing path from the routing node controller.

[0682] The following are two examples of S630, referred to as Node Count Acquisition Example 1 and Node Count Acquisition Example 2.

[0683] Example 1 for obtaining the number of nodes:

[0684] In some possible implementations, S630 may include: the routing node controller sending second information to the security network element. This second information may be used to indicate the number N of nodes on the first routing path.

[0685] In other words, in Example 1 of obtaining the number of nodes, the routing node controller can provide the number of nodes N to the security network element.

[0686] Example 2 for obtaining the number of nodes:

[0687] In some possible implementations, S630 may include: the routing node controller sending information about a first routing path to the security network element; and the security network element determining the number of nodes N based on the information about the first routing path. The information about the first routing path can be understood with reference to Example 1 of the routing path information, that is, the information about the first routing path includes information about each node used to transmit data #1.

[0688] In other words, in Example 2 of obtaining the number of nodes, the routing node controller can provide the security network element with a complete routing path, and the security network element can determine the number of nodes N based on the complete routing path.

[0689] The following is an example of how a security network element obtains a key.

[0690] S635, the security network element obtains N keys based on the number of nodes N.

[0691] In some possible implementations, S635 includes: the security network element generating a signature key #1; and dividing the signature key #1 into N keys based on the number of nodes N. This implementation can also be understood as the security network element generating a complete signature key #1, and then dividing this signature key #1 into N parts, each part being a key. Alternatively, this implementation can be understood as the security network element generating N keys based on the number of nodes N, used for signing.

[0692] As an example, the N keys are the keys used for signing by the N nodes on the first routing path. For example, the N keys are the keys of the N RAN nodes on the first routing path. Another example is that the N keys are the keys of the N-1 RAN nodes and the landing network element #1 on the first routing path.

[0693] As an example, the aforementioned N nodes may include RAN#1 in this application; the aforementioned N keys may include key #1 in this application. Key #1 is the key used for signing by RAN#1.

[0694] The following describes the process of distributing N keys after S635.

[0695] In Example 1 for obtaining the number of nodes, after S635, method 600 also includes S640 and S642.

[0696] S640: The security network element sends N keys to the routing node controller. Correspondingly, the routing node controller receives N keys from the security network element.

[0697] S642, the routing node controller sends N keys to the N nodes respectively based on the information of the N nodes on the first routing path.

[0698] For example, the information for N nodes could be their respective IP addresses. In this case, the routing node controller can send N keys to each of the N nodes based on their IP addresses. Alternatively, the information for N nodes could be their IP addresses (e.g., their IDs). In this case, the routing node controller can determine the IP addresses of the N nodes based on their information and then send the N keys to each of the N nodes based on those IP addresses.

[0699] In some examples, N nodes can be i RAN nodes in this application (i.e., N = i). Thus, S642 can be understood as the routing node controller sending key #1 to RAN#1 based on the information of RAN#1; the routing node controller sending key #2 to RAN#2 based on the information of RAN#2; and so on, the routing node controller sending key #i to RAN#i based on the information of RAN#i.

[0700] In other examples, the N nodes can be the i RAN nodes and the landing network element #1 in this application (i.e., N = i + 1). Thus, S642 can be understood as follows: the routing node controller sends key #1 to RAN #1 based on the information of RAN #1; the routing node controller sends key #2 to RAN #2 based on the information of RAN #2; and so on, the routing node controller sends key #i to RAN #i based on the information of RAN #i. Furthermore, the routing node controller sends key #i+1 to landing network element #1 based on the information of landing network element #1.

[0701] In some possible implementations, the key #1 sent by the routing node controller to RAN#1 may be carried within the first configuration information. A detailed description of this first configuration information can be found in S310 above, and will not be repeated here.

[0702] As an example, the key #x sent by the routing node controller to a RAN node (denoted as RAN#x, where x is any integer from 1 to i) can be carried in configuration information. Exemplarily, this configuration information may also include at least one of the following:

[0703] Information about the first routing path;

[0704] • The correspondence between the information of the first routing path and the key #x;

[0705] • The mapping relationship between the information of landing network element #1 and the identifier of the first routing path;

[0706] Information about the next-hop node for RAN#x;

[0707] • Signature method (e.g., first signature method);

[0708] • First-hand information.

[0709] The specific description of the above information can be understood by referring to the relevant content of the first configuration information in S310, and will not be repeated here.

[0710] In some examples, the verification network element and the landing network element #1 can be different network elements. In some possible implementations, method 600 also includes: S644 and S646.

[0711] S644, the routing node controller sends configuration information #1 to the landing network element #1 based on the information of the landing network element #1. For example, the configuration information #1 includes at least one of the following:

[0712] Information about the first routing path;

[0713] • The correspondence between the information of the first routing path and the key #i+1;

[0714] • First-hand information;

[0715] • Signature method (e.g., first signature method);

[0716] • Verify the information of network elements.

[0717] The specific description of the above configuration information #1 can be understood by referring to the relevant content of the first configuration information in S310, and will not be repeated here.

[0718] In the example of secure signature performed by landing network element #1, after receiving the information of the first routing path and the signature information #i from RAN#i, landing network element #1 can determine the key #i+1 based on the information of the first routing path, and use the key #i+1 to process the signature information #i+1 (i.e., the second signature information). Furthermore, landing network element #1 can send the signature information #i+1 to the verification network element based on the information of the verification network element.

[0719] In the example where the landing network element #1 does not perform a secure signature, after receiving the signature information #i from RAN #i, the landing network element #1 can send the signature information #i to the verification network element based on the information of the verification network element.

[0720] S646, the routing node controller or security network element sends configuration information #2 to the verification network element. For example, the configuration information #2 includes at least one of the following:

[0721] Information about the first routing path;

[0722] • Verification key #1;

[0723] ●The correspondence between the information of the first routing path and the verification key #1;

[0724] • Signature method (e.g., first signature method);

[0725] • First-hand information.

[0726] The specific description of the above configuration information #2 can be understood by referring to the relevant content of the first configuration information in S310, and will not be repeated here.

[0727] As an example, the verification network element can receive information about the first routing path and the second signature information from the landing network element #1. Based on the information about the first routing path, the verification network element can determine the verification key #1 and verify the second signature information. See S372 and S376 for details. The second signature information can be signature information #i or signature information #i+1.

[0728] In some examples, the verification network element and the landing network element can be the same network element. In some possible implementations, method 600 also includes: S648.

[0729] S648, the routing node controller sends configuration information #3 to the landing network element #1 (i.e., the verification network element) based on the information of the landing network element #1.

[0730] For example, the configuration information #3 includes at least one of the following:

[0731] Information about the first routing path;

[0732] • The correspondence between the information of the first routing path and the key #i+1;

[0733] • First-hand information;

[0734] • Verification key #1;

[0735] • Signature method (e.g., first signature method);

[0736] • The correspondence between the information of the first routing path and the verification key #1.

[0737] The specific description of the above configuration information #3 can be understood by referring to the relevant content of the first configuration information in S310, and will not be repeated here.

[0738] In the example of secure signature performed by landing network element #1, after receiving the information of the first routing path and the signature information #i from RAN#i, landing network element #1 (i.e., the verification network element) can determine the key #i+1 based on the information of the first routing path and use the key #i+1 to process the signature information #i+1 (i.e., the second signature information). Furthermore, landing network element #1 can use the verification key #1 corresponding to the information of the first routing path to verify the signature information #i+1.

[0739] In the example where the landing network element #1 does not perform a secure signature, after receiving the signature information #i from RAN#i, the landing network element #1 (i.e., the verification network element) can use the verification key #1 corresponding to the information of the first routing path to verify the signature information #i.

[0740] The above example demonstrates how the routing management controller distributes keys in Example 1 of node count acquisition. The following example demonstrates how the security network element distributes keys in Example 2 of node count acquisition.

[0741] In Example 2 for obtaining the number of nodes, after S630, method 600 also includes: S650.

[0742] S650, the security network element sends N keys to N nodes respectively based on the information of N nodes on the first routing path.

[0743] The relevant description of S650 is the same as that in S642. The difference is that the execution entity for key distribution in S650 is the security network element, while the execution entity for key distribution in S642 is the routing node controller.

[0744] In some possible implementations, the key #1 sent by the security network element to RAN#1 can be carried in the first configuration information. A detailed description of this first configuration information is given in S310 above and will not be repeated here.

[0745] As an example, the key #x sent by a security network element to a RAN node (denoted as RAN#x, where x is any integer from 1 to i) can be carried in configuration information, which may also include at least one of the following:

[0746] Information about the first routing path;

[0747] • The correspondence between the information of the first routing path and the key #x;

[0748] • The mapping relationship between the information of landing network element #1 and the identifier of the first routing path;

[0749] ●Information about the next-hop node for RAN#x;

[0750] ● Signature method (e.g., first signature method);

[0751] • First-hand information.

[0752] The specific description of the above information can be understood by referring to the relevant content of the first configuration information in S310, and will not be repeated here.

[0753] In some examples, the verification network element and the landing network element can be different network elements. In some possible implementations, method 600 also includes: S654 and S656.

[0754] In S654, the security network element sends configuration information #1 to the landing network element #1 based on the information from the landing network element #1. A detailed description of the configuration information #1 can be found in S310 and S644, and will not be repeated here.

[0755] S656, the security network element sends configuration information #2 to the verification network element. A detailed description of the above configuration information #2 can be found in S310 and S646, and will not be repeated here.

[0756] In some examples, the verification network element and the landing network element can be the same network element. In some possible implementations, method 600 also includes: S658.

[0757] In S658, the security network element sends configuration information #3 to the landing network element #1 (i.e., the verification network element) based on the information from the landing network element #1. A detailed description of the configuration information #3 can be found in S310 and S648, and will not be repeated here.

[0758] Figure 7 This is a schematic flowchart of another communication method 700 provided in this application embodiment. Optional operations in method 700 are shown with dashed lines. Method 700 can be combined with methods 300, 400, and 500. Method 700 takes the example where the security network element and the routing node controller are the same network element to describe in detail the generation and distribution of the first configuration information in S310. For ease of description, method 700 is described with the security network element as the execution subject. The security network element in method 700 can also be replaced by the routing node controller.

[0759] S620, the security network element determines the first routing path based on the information of the landing network element #1.

[0760] For details, please refer to the description in method 600. The difference is that the execution subject here can be a security network element or it can be replaced by a routing node controller.

[0761] S730, the security network element obtains the number N of nodes on the first routing path.

[0762] For example, a security network element can determine the number of nodes N based on information from the first routing path.

[0763] S735, the security network element obtains N keys based on the number of nodes N.

[0764] For details, please refer to the relevant description in S635, which will not be repeated here.

[0765] In the S750, the security network element sends N keys to N nodes respectively based on the information of N nodes on the first routing path.

[0766] For details, please refer to the relevant description of S750, which will not be repeated here.

[0767] In some examples, the verification network element and the landing network element can be different network elements. In some possible implementations, method 700 also includes: S654 and S656. See the corresponding descriptions in method 600 for details.

[0768] In some examples, the verification network element and the landing network element can be the same network element. In some possible implementations, method 700 also includes: S658. See the corresponding description in method 600 for details.

[0769] The following are examples of how the routing node controller determines the signature method, referred to as Signature Method Determination Example 1 and Signature Method Determination Example 2, respectively.

[0770] Signature method determination example 1:

[0771] In some possible implementations, S620 in method 600 or method 700 includes: the routing node controller determining a first routing path based on the information of the landing network element #1 and the first signature method. Further, the routing node controller may send third indication information to RAN#1 on the first routing path. This third indication information can be used to instruct the use of the first signature method for secure signing. See the example in S312 for details, which will not be elaborated here.

[0772] In some examples, the routing node controller first determines to use a first signature method, selects nodes that support the first signature method based on the first signature method, and then determines a first routing path from the selected nodes. For example, the routing node controller may determine to use the first signature method based on the signature method reported by RAN#1.

[0773] In this process, nodes on the first routing path can support the first signature method. For example, the routing node controller can obtain the signature methods supported by multiple nodes and select the node that supports the first signature method from among these nodes to construct the first routing path.

[0774] In this application, "supported signature methods" can be understood as or replaced by "supported security algorithms", "security capabilities", "supported signature algorithms", "supported signature methods", "supported signature methods" or "supported secure routing methods".

[0775] Signature method determination example 2:

[0776] In some possible implementations, after S620, method 600 or method 700 further includes: the routing node controller determining a first signature method based on the capability information of the nodes on the first routing path; and the routing node controller sending third indication information to RAN#1 on the first routing path.

[0777] The first signature method is the signature method supported by the aforementioned capability information. For example, after constructing the first routing path, the routing node controller can select a signature method supported by all nodes on the first routing path as the first signature method.

[0778] The third instruction information can be used to instruct the use of the first signature method for secure signing. See the example in S312 for details, which will not be elaborated here.

[0779] This application also provides a communication method. The communication method may include:

[0780] S1, the security network element obtains the number of nodes N on the first routing path, where N is an integer greater than 1;

[0781] S2, the security network element obtains N keys based on the number of nodes N, where the N keys are the keys used for signing by the N nodes on the first routing path.

[0782] As an example, S1 above may include S630 or S730. S2 above may include S635 or S735.

[0783] Figure 8 This is a schematic flowchart of a communication method 800 provided in an embodiment of this application. Method 800 can be considered as a specific example of a combination of method 700 and method 300. In method 800, RAN#1 can determine whether to perform a secure signature based on location information. Optionally, RAN#1 can also determine whether to select a routing path with location restrictions based on location information. The configuration of nodes involved in method 800 is described below.

[0784] As an example, RAN#1 can be configured with policy #0, policy #1, and policy #2. Furthermore, RAN#1 can also be configured with a mapping between security policies and locations. For ease of understanding, assume policy #0 corresponds to location #0, policy #1 corresponds to location #1, and policy #2 corresponds to location #2.

[0785] For example, the above information for RAN#1 can be configured by PCF, SMF or other network elements.

[0786] As an example, the routing node controller can be configured with a mapping relationship between node address information (e.g., IP address) and node ID. The nodes can include RAN nodes and / or the NTN devices where the RAN nodes reside. For example, the mapping relationship could be between the IP address of RAN#1 and the ID of the first NTN device deployed on RAN#1. Based on the mapping relationship and the node address information, the routing node controller can determine the node ID and obtain the node's location information from the ephemeris information node based on the node ID, thereby determining whether the node's location meets location restrictions or whether the node can communicate with other nodes (i.e., has an ISL).

[0787] For example, the above information of the routing node controller can be configured by core network elements or network elements on NTN devices.

[0788] As an example, the verification network element and the landing network element can be UPF#1.

[0789] As an example, the routing node controller and the security network element can be the same network element.

[0790] The following is combined with Figure 8 This section introduces the various operations of method 800.

[0791] S810, the routing node controller configures the routing path for UPF#1.

[0792] The above configuration method can also be understood as the routing node controller configuring routing paths based on perUPF (perUPF). As an example, the routing node controller can configure two types of routing paths, denoted as path #1 and path #2. Path #1 can be a routing path without location restrictions. Path #2 can be a routing path with location restrictions, meaning that the nodes on path #2 are located at the positions indicated by the location information when processing data. Both path #1 and path #2 correspond to UPF #1. UPF #1 is the last hop of both path #1 and path #2.

[0793] In some examples, in S810, the routing node controller and RAN#1 can execute method 600 or method 700 to configure the routing path. Here, path #1 can also be understood as the routing path corresponding to policy #1 or policy #0, and path #2 can also be understood as the routing path corresponding to policy #2. The first routing path in method 600 or method 700 can be either path #1 or path #2. The first configuration information in method 600 or method 700 can be understood as being used to configure path #1 and / or path #2.

[0794] S815, the routing node controller configures keys for routing paths.

[0795] The above configuration method can also be understood as the routing node controller configuring keys based on the routing path. For example, the routing node controller generates a signing key (or signing private key) and a verification key (or public key); based on the number of nodes N on the routing path, the signing key is divided into N parts, resulting in N key components. The routing node controller can distribute the corresponding key components and routing path (e.g., path #1 and / or path #2) information to each node on the routing path. Furthermore, the routing node controller can provide UPF#1 with the signature verification key and routing path information for signing or verification.

[0796] The purpose of the routing path information is to enable nodes on the routing path to determine the key to be issued based on this information.

[0797] In some examples, the routing path information can indicate the complete routing path. For instance, the routing path information could be a segment in segment routing (SR) version 6 (SRv6). As an example, the first-hop node on the routing path can send the routing path information to the next-hop node. Further, each hop node can send the routing path information to the next-hop node. In this way, each hop node can determine the key component used for signing based on the routing path information, thereby performing secure signing. As another example, after each node on the routing path has signed, the last-hop node can send the routing path information and the final signature information (i.e., the second signature information mentioned above) to UPF#1. UPF#1 can obtain a verification key based on the routing path information and verify the signature information based on the verification key. Alternatively, the last-hop node itself can be UPF#1, which can obtain a verification key based on the routing path information and verify the signature information based on the verification key.

[0798] In other examples, the routing path information can be a routing path identifier, such as a path ID. This identifier can be used to identify a routing path (e.g., path #1 or path #2). As an example, the routing path identifier can be assigned by the routing node controller. The routing node controller can distribute the routing path identifier and the next-hop node information to each node on the routing path. As an example, the first-hop node on the routing path can determine the routing path identifier based on security policies and / or information about the landing network element (see S332, Routing Path Determination Example 1, and Routing Path Determination Example 2 above), and determine the next-hop node based on the routing path identifier. The first-hop node can send the routing path identifier and signature information to the next-hop node. Further, each hop node can determine the next-hop node and key component based on the routing path identifier, thereby performing a secure signature, and sending the routing path identifier and signature information to the next-hop node. The signature information sent by different nodes can be different; see the description in Signature Example 2 for details, which will not be repeated here.

[0799] As an example, after the routing node controller sends the routing path information and verification key to UPF#1, UPF#1 can return an acknowledgement (ACK) message to the routing node controller. Exemplarily, the routing path information and verification key sent by the routing node controller to UPF#1 can be carried within the aforementioned second configuration information.

[0800] S820, the UE and network elements such as UPF#1 complete the PDU session establishment process.

[0801] As an example, S810 can be executed before, during, or after the PDU session establishment process. In other words, the execution order of S810 and S820 is not limited, and they can also be executed as a single step. The execution order of S815 and S820 is also not limited. As an example, the SMF can select the UPF located in the first position information as UPF#1 based on the first position information.

[0802] S830, RAN#1 receives data #1 from UE.

[0803] As an example, the description of S830 can be found in S320 of method 300, and will not be repeated here.

[0804] S840, RAN#1 determines the security policy based on the first location information.

[0805] For example, if the first location information indicates location #0, then RAN#1 can determine strategy #0. If the first location information indicates location #1, then RAN#1 can determine strategy #1. If the first location information indicates location #2, then RAN#1 can determine strategy #2.

[0806] As an example, other details of S840 are described in S335 and will not be repeated here.

[0807] S850, RAN#1 sends data #1 and routing path information to RAN#2.

[0808] As an example, RAN#1 can perform DRB mapping based on data #1 to obtain the UPF#1 IP address and TEID. RAN#1 can also send the TEID to RAN#2.

[0809] In some examples, if RAN#1 determines policy #0 in S840, then RAN#1 may not need to perform a security signature. In some possible implementations, RAN#1 can select path #1 from one or more paths configured for RAN#1 based on the UPF#1 IP address and policy #0. RAN#2 is the next-hop node of RAN#1 on path #1.

[0810] In other examples, if RAN#1 determines policy #1 in S840, then RAN#1 can perform a secure signature. In this way, RAN#1 can also send the signature information #1 to RAN#2. In some possible implementations, RAN#1 can select path #1 from one or more paths configured for RAN#1 based on the UPF#1 IP address and policy #1. RAN#2 is the next-hop node for RAN#1 on path #1.

[0811] In other examples, if RAN#1 determines policy #2 in S840, then RAN#1 can perform a secure signature. This allows RAN#1 to also send signature information #1 to RAN#2. In some possible implementations, RAN#1 can select path #2 from one or more paths configured for RAN#1 based on the UPF#1 IP address and policy #2. RAN#2 is the next-hop node for RAN#1 on path #2.

[0812] For a detailed example of the above, please refer to Trigger Example 1, which will not be repeated here.

[0813] S860, RAN#2 sends data #1 and routing path information to UPF#1.

[0814] In some examples, if RAN#1 determines policy #1 or policy #2 in S840, then RAN#2 and all subsequent RAN nodes also securely sign the corresponding signature information. For example, RAN#2 can securely sign signature information #1 to obtain signature information #2; and so on, RAN#i can securely sign RAN#i-1 to obtain signature information #i.

[0815] Here, RAN#i is assumed to be the last-hop RAN node, where i is an integer greater than or equal to 2. RAN#i can send data #1, routing path information, and signature information #i to UPF#1. The signature information #i can be understood as the second signature information in method 300.

[0816] Optionally, RAN#1 also sends a second indication message to RAN#2. See the relevant description in S376 for details. For example, each hop node can send information indicating secure signing to the next hop node. The information indicating secure signing sent by RAN#1 to RAN#2 can be referred to as the second indication message.

[0817] Optionally, RAN#i also sends indication information #1 to UPF#1. See the relevant description in S376 for details.

[0818] For further descriptions of S760 above, please refer to method 300 or method 400, which will not be repeated here.

[0819] S870, UPF#1 verifies the signature information #i.

[0820] For example, if RAN#i sends routing path information and signature information #i to UPF#1, UPF#1 can obtain a verification key based on the routing path information and verify the validity of the signature information #i based on the verification key. As an example, RAN#1 can pass the information to be signed (e.g., a random number) used to generate signature information #1 to RAN#2. Furthermore, each hop node can pass the information to be signed to the next hop node. In this way, UPF#1 can obtain the information to be signed. UPF#1 can then verify whether the signature information #i is correct based on the verification key and the information to be signed.

[0821] Optionally, RAN#i also sends indication information #1 to UPF#1. UPF#1 may respond to indication information #1 and verify signature information #i. Optionally, UPF#1 may verify signature information #i based on routing path information and / or signature information #i.

[0822] If UPF#1 determines that the signature information #i is incorrect, then the routing path is abnormal. In some possible implementations, UPF#1 can report the identifier of the routing path to the routing node controller. The routing node controller can then regenerate and distribute the key, or update the routing path.

[0823] In some possible implementations, if another RAN (denoted as RAN#1') moves to the location of RAN#1, RAN#1' can determine the security policy to be used.

[0824] In some examples, RAN#1 can send the security policy determined by RAN#1 in S840 to RAN#1'. In other examples, RAN#1' can take the security policy determined in S840.

[0825] Figure 9 This is a schematic flowchart of another communication method 900 provided in this application embodiment. Method 900 can be regarded as a specific example of a combination of methods 700, 500, and 300. In method 900, RAN#1 can determine whether to perform a secure signature on the path information based on the first indication information sent by the UE. In addition, the routing node controller can configure the validity period of the routing path. The node configuration involved in method 900 is the same as that in method 800, and will not be described again.

[0826] Method 900 takes UPF#1 as an example when the verification network element and the landing network element are both UPF#1. The following section combines... Figure 9 This section introduces the various operations of method 900.

[0827] S910, the routing node controller configures the routing path for UPF#1.

[0828] For a specific example of S910, please refer to S810. The difference is that in S910, the routing node controller also adds the validity period of the routing path for the routing path.

[0829] S915, the routing node controller configures keys for routing paths.

[0830] For a specific example of S915, please refer to S815, which will not be repeated here.

[0831] S917: After the validity period of the routing path expires, the routing node controller, RAN node (e.g., RAN#1 or RAN#2), and UPF#1 update the path information and the corresponding key. S917 is an optional operation.

[0832] For specific examples, please refer to the examples in S302a, S304a, S306a, S302b, and S304b; further details will not be provided.

[0833] S920, the UE and network elements such as UPF#1 complete the PDU session establishment process.

[0834] For details, please refer to S820, which will not be repeated here.

[0835] S925, the UE determines the first indication information.

[0836] For example, the UE can determine the first indication information based on method 500, which is detailed in method 500 and will not be repeated here.

[0837] For example, the UE can determine the first indication information based on its own service needs and / or the UE's location.

[0838] S930, RAN#1 receives data #1 and first indication information from UE.

[0839] As an example, the description of S930 can be found in S320 and S330 of method 300, and will not be repeated here.

[0840] S940, RAN#1 sends data #1 and routing path information to RAN#2 based on the first indication information.

[0841] As an example, RAN#1 can perform DRB mapping based on data #1 to obtain the UPF#1 IP address and TEID. RAN#1 can also send the TEID to RAN#2.

[0842] In some examples, RAN#1 may not perform a security signature if the first indication information indicates that a security signature is not required. In some possible implementations, RAN#1 may select path #1 from one or more paths configured for RAN#1 based on the UPF#1 IP address and the first indication information. RAN#2 is the next-hop node of RAN#1 on path #1.

[0843] In other examples, if the first indication information indicates that secure signing is required and there are no location restrictions on the routing path for data #1, then RAN#1 can perform secure signing. In this case, RAN#1 can also send the signed information #1 to RAN#2. In some possible implementations, RAN#1 can select path #1 from one or more paths configured for RAN#1 based on the UPF#1 IP address and the first indication information. RAN#2 is the next-hop node for RAN#1 on path #1.

[0844] In other examples, if the first indication information indicates that secure signing is required and there are location restrictions on the routing path for data #1, then RAN#1 can perform secure signing. In this case, RAN#1 can also send the signed information #1 to RAN#2. In some possible implementations, RAN#1 can select path #2 from one or more paths configured for RAN#1 based on the UPF#1 IP address and the first indication information. RAN#2 is the next-hop node for RAN#1 on path #2.

[0845] Other details regarding S940 can be found in the corresponding description of trigger example 2, and will not be repeated here.

[0846] Optionally, each path in S940 above can be an updated path. Optionally, the key used by each node to sign in method 900 is an updated key.

[0847] S960, RAN#2 sends data #1 and routing path information to UPF#1.

[0848] The difference between S960 and S860 is that in S960, a secure signature is triggered by a first instruction message. The content of the signature can be found in S860.

[0849] For further descriptions of S960 above, please refer to method 300, which will not be repeated here.

[0850] S970, UPF#1 verifies the signature information #i.

[0851] For details, please refer to S870, which will not be repeated here.

[0852] Figure 10This is a schematic flowchart illustrating another communication method 1000 provided in this application embodiment. Method 1000 can be considered as a specific example of a combination of methods 700, 500, and 300. In method 1000, RAN#1 can determine whether to perform a secure signature on the path information based on the first indication information sent by the UE. Furthermore, the routing node controller can consider the security capabilities of the nodes on the routing path and select the signature method supported by the nodes. The node configuration involved in method 1000 is described in reference to method 900 and will not be repeated here.

[0853] Method 1000 takes UPF#1 as an example when the verification network element and the landing network element are both UPF#1. The following is combined with Figure 10 This section introduces the various operations of method 1000.

[0854] S1010, the routing node controller configures the routing path for UPF#1.

[0855] A specific example of S1010 can be found in S810, the difference being that in S1010, the routing node controller can determine the signature methods supported by each node on the routing path. For example, each node may support the signature method in signature example 1. Or, for another example, each node may support the signature method in signature example 2. Thus, a routing path can correspond to a specific signature method.

[0856] For details, please refer to Example 1 and Example 2 of signature method determination in Method 600 or Method 700, which will not be repeated here.

[0857] For details on how routing nodes obtain signatures, please refer to Method 600 or Method 700, which will not be repeated here.

[0858] S1015, the routing node controller configures keys for routing paths.

[0859] For a specific example of S1015 above, please refer to S815, which will not be repeated here.

[0860] As an example, if the routing node controller determines the signature method in signature example 2 in S1010, then S1015 can be executed. If the routing node controller determines the signature method in signature example 1 in S1010, then S1015 can be omitted.

[0861] S1020, the UE and network elements such as UPF#1 complete the PDU session establishment process.

[0862] For details, please refer to S820, which will not be repeated here.

[0863] S1025, the UE determines the first indication information.

[0864] For example, the UE can determine the first indication information based on method 500, which is detailed in method 500 and will not be repeated here.

[0865] For example, the UE can determine the first indication information based on its own service needs and / or the UE's location.

[0866] S1030, RAN#1 receives data #1 and first indication information from UE.

[0867] As an example, the description of S930 can be found in S320 and S330 of method 300, and will not be repeated here.

[0868] S1040, RAN#1 sends data #1 and routing path information to RAN#2 based on the first indication information.

[0869] See S940 for details. The difference is that in method 1000, the route path selected by RAN#1 can correspond to a specific signature method. RAN#1 can determine signature information #1 based on this signature method. In addition, RAN#1 can also send second indication information to RAN#2, as detailed in S352, which will not be elaborated further.

[0870] S1060, RAN#2 sends data #1 to UPF#1.

[0871] The difference between S1060 and S960 is that in S1060, RAN#2 can use a specific signature method to sign. Optionally, RAN#2 receives a second indication message from RAN#1, which instructs RAN#2 to use the specific signature method to sign.

[0872] S1070, UPF#1 verifies the signature information.

[0873] For example, if the routing node controller determines the signature method in signature example 1 in S1010, then UPF#1 can verify signature information #1. Optionally, UPF#1 also verifies signature information #2 to signature information #i. See S870 for details, which will not be repeated here. If the routing node controller determines the signature method in signature example 2 in S1010, then UPF#1 can verify signature information #i.

[0874] The following, combined with Figures 11 to 14 This application provides a detailed description of the communication device provided in the embodiments. The descriptions of the device embodiments correspond to the descriptions of the method embodiments; therefore, for content not described in detail, please refer to the above method embodiments. For the sake of brevity, some content will not be repeated.

[0875] This application embodiment can divide the communication device into functional modules according to the above method example. For example, each function can be divided into its own functional modules, or two or more functions can be integrated into one processing module. The integrated modules can be implemented in hardware, software, or a combination of both. The module division in this application embodiment is illustrative and only represents one logical functional division; other division methods may be used in actual implementation. The following description uses the division of functional modules according to each function as an example.

[0876] Figure 11 This is an exemplary block diagram of the communication device 10 provided in the embodiments of this application.

[0877] like Figure 11 As shown, for example, the communication device 10 may include a chip system 110, a memory 120, a bus 130, a power management module 140, or a transceiver 150, etc.

[0878] The chip system 110 can be an integrated circuit chip with signal processing capabilities. In implementation, each step of the above method can be completed through integrated logic circuits in the hardware of the chip system 110 or through software instructions.

[0879] By way of example and not limitation, chip system 110 may include circuitry or chips responsible for signal processing (such as a modem chip, also known as a baseband chip, or a system-on-chip (SoC) chip or system-in-package (SIP) chip containing a modem core).

[0880] Optionally, the chip system 110 may also include a memory (such as a cache) for storing instructions and data. In some embodiments, the memory in the chip system 110 is a cache memory. This memory can store instructions or data that the chip system 110 has just used or that are used repeatedly. If the chip system 110 needs to use the instruction or data again, it can retrieve it directly from this memory. This avoids repeated accesses, reduces the waiting time of the chip system 110, and thus improves the efficiency of the system.

[0881] In some embodiments, the chip system 110 may include one or more interfaces. Interfaces may include an inter-integrated circuit (I2C) interface, an inter-integrated circuit sound (I2S) interface, a pulse code modulation (PCM) interface, a universal asynchronous receiver / transmitter (UART) interface, a mobile industry processor interface (MIPI), a general-purpose input / output (GPIO) interface, a subscriber identity module (SIM) interface, and / or a universal serial bus (USB) interface, etc.

[0882] The memory 120 may include random access memory (RAM) and read-only memory (ROM). The memory 120 may store computer-readable and computer-executable code, including instructions that, when executed, cause the processor to perform the various functions of this application.

[0883] Optionally, the code may include instructions for implementing various aspects of the embodiments of this application, such as instructions for performing secure signing. The code may be stored in a non-transitory computer-readable medium such as system memory or other types of memory. In some cases, the code may not be directly executable by the chip system 110, but may enable a computer (e.g., at compile and execution time) to perform the functions of this application. In some cases, memory 120 may contain a basic I / O system that controls basic hardware or software operations, such as interaction with peripheral components or devices.

[0884] For example, the chip system 110 executes various functional applications and data processing of the communication device 10 by running instructions stored in the memory 120. For instance, when the communication device 10 transfers files with other devices (which may also be terminals or access network devices), the chip system 110 of the communication device 10 can call the computer-executable program code stored in the memory 120 to implement the communication method provided in the embodiments of this application.

[0885] In addition, the memory 120 can be integrated into the chip system 110 or independent of the chip system 110.

[0886] For example, bus 130 may be USB, used to support communication between various parts of communication device 10.

[0887] The power management module 140 is used to receive charging input from the charger. Optionally, the power management module 140 can also supply power to the communication device 10 while charging it (e.g., the battery module of the communication device 10). By way of example and not limitation, the power management module 140 can also supply power to other devices besides the communication device 10.

[0888] Transceiver 150 can communicate bidirectionally via one or more antennas, wired links, or wireless links. For example, transceiver 150 can represent a wireless transceiver and can communicate bidirectionally with another wireless transceiver. Transceiver 150 may also include a modem for modulating packets and providing the modulated packets to the antenna for transmission, and for demodulating packets received from the antenna. Transceiver 150 may include a receiver and a transmitter, the receiver performing the function of receiving information and the transmitter performing the function of transmitting information.

[0889] In some cases, a wireless device may include a single antenna. However, in other cases, a device may have more than one antenna, such as... Figure 11 Antennas 1 and 2 shown may be capable of simultaneously transmitting or receiving multiple wireless transmissions. Exemplarily, antennas 1 and 2 are used to transmit and receive electromagnetic wave signals. Each antenna in communication device 10 can be used to cover one or more communication frequency bands. Different antennas can also be multiplexed to improve antenna utilization. For example, antenna 1 can be multiplexed as a diversity antenna for a wireless local area network. In some other embodiments, the antennas can be used in conjunction with a tuning switch. Communication device 10 can transfer files to other devices via wireless communication functionality.

[0890] In one design, the communication device 10 may correspond to the first node in the above method embodiment.

[0891] The device 10 can implement the steps or processes corresponding to the first node executed in the above method embodiments. The transceiver 150 can be used to execute transmission and reception related operations of the first node in the above method embodiments, such as executing step S350 in the above method embodiments. The chip system 110 can be used to execute processing related operations of the first node in the above method embodiments, such as S340.

[0892] In another design, the communication device 10 may correspond to the terminal in the above method embodiment.

[0893] The device 10 can implement the steps or processes executed by the terminal in the above method embodiments. The transceiver 150 can be used to perform operations related to the transmission and reception of the terminal in the above method embodiments, such as executing step S320 in the above method embodiments. The chip system 110 can be used to perform operations related to the processing of the terminal in the above method embodiments.

[0894] In another design, the communication device 10 may correspond to the verification network element in the above method embodiment.

[0895] The device 10 can implement the steps or processes corresponding to the verification network element in the above method embodiments. The transceiver 150 can be used to perform operations related to the transmission and reception of the verification network element in the above method embodiments, such as executing step S372 in the above method embodiments. The chip system 110 can be used to perform processing-related operations of the verification network element in the above method embodiments, such as S376.

[0896] In another design, the communication device 10 may correspond to the second network element in the above method embodiment.

[0897] The device 10 can implement the steps or processes corresponding to the second network element in the above method embodiments. The transceiver 150 can be used to perform operations related to the transmission and reception of the second network element in the above method embodiments, such as executing step S630 in the above method embodiments. The chip system 110 can be used to perform processing-related operations of the second network element in the above method embodiments, such as S635.

[0898] In another design, the communication device 10 may correspond to the first network element in the above method embodiment.

[0899] The device 10 can implement the steps or processes corresponding to the first network element in the above method embodiments. The transceiver 150 can be used to perform operations related to the transmission and reception of the first network element in the above method embodiments, such as executing step S630 in the above method embodiments. The chip system 110 can be used to perform processing-related operations of the first network element in the above method embodiments, such as S620.

[0900] In a design where the communication device 10 corresponds to a terminal (e.g., a terminal device), the communication device 10 may include, for example: Figure 11 The short-range communication module 164, sensor 161, display 162, or camera 163 shown are examples of such modules.

[0901] The short-range communication module 164 may include modules that support short-range communication, such as Wi-Fi and Bluetooth.

[0902] For example, sensor 161 may include pressure sensor, gyroscope sensor, barometric pressure sensor, magnetic sensor, accelerometer, distance sensor, proximity sensor, fingerprint sensor, temperature sensor, touch sensor, ambient light sensor, bone conduction sensor, etc.

[0903] For example, display 162 is used to display images, videos, etc. The display includes a display panel. The display panel may be a liquid crystal display (LCD), an organic light-emitting diode (OLED), an active-matrix organic light-emitting diode (AMOLED), a flexible light-emitting diode (FLED), a mini light-emitting diode (LED), a microLED, a microOLED, a quantum dot light-emitting diode (QLED), etc. For example, in this embodiment, the display can be used to display the interface required by the communication device 10. For example, the communication device 10 implements display functions through a graphics processing unit (GPU), a display, and an application processor. The GPU is a microprocessor for image processing, connected to the display and the application processor. The GPU is used to perform mathematical and geometric calculations for graphics rendering. The chip system 110 may include one or more GPUs that execute program instructions to generate or modify display information.

[0904] For example, camera 163 is used to acquire images, videos, etc.

[0905] Understandable, Figure 11 The structure shown does not constitute a specific limitation on the communication device 10. The specific structure of the terminal equipment, access network equipment or core network equipment can be referred to Figure 11 As shown. In some embodiments, the communication device 10 may also include a... Figure 11 This could mean having more or fewer components, combining some components, separating some components, or having different component arrangements. Or, Figure 11 Some of the components shown can be implemented in hardware, software, or a combination of software and hardware. Terminal devices and / or access network devices can be implemented in… Figure 11 The components were added or removed based on the given structure.

[0906] Figure 12 This is a schematic block diagram of the communication device 20 provided in the embodiments of this application.

[0907] like Figure 12 As shown, the communication device 20 may include a baseband unit 210, which can communicate with external devices via a cellular radio frequency (RF) transceiver 220 (e.g., if the communication device 20 is a terminal device, the baseband unit 210 can communicate with access network devices via the cellular RF transceiver 220; or, if the communication device 20 is an access network device, the baseband unit 210 can communicate with terminal devices and / or core network devices via the cellular RF transceiver 220).

[0908] Exemplarily, baseband unit 210 may include a computer-readable medium / memory. Baseband unit 210 may be responsible for general processing, including the execution of software stored on the computer-readable medium / memory. When executed by baseband unit 304, the software causes baseband unit 210 to perform the various functions described above. The computer-readable medium / memory may also be used to store data manipulated by baseband unit 210 during software execution.

[0909] Optionally, the baseband unit 210 further includes a receiving unit 201, a management unit 202, and a transmitting unit 203. When the communication device 20 is used to implement the functions of the first node, the management unit 202 includes one or more of these components. Figure 12 The sub-units shown are, for example, a secure signature sub-unit, which can be used for secure signature operations in the above method embodiments. Units within management unit 201 can be stored in a computer-readable medium / memory and / or configured as hardware within baseband unit 210. Management unit 201 can also be referred to as a processing unit. The receiving unit 201 and the sending unit 203 can be referred to as transceiver units.

[0910] When the communication device 20 is used to implement the function of the first node in the above method embodiments, the receiving unit 201 is used to perform the receiving step of the first node, the sending unit 203 is used to perform the sending step of the first node, and the management unit 202 is used to perform the processing step of the first node.

[0911] For example, when the communication device 20 is used to implement the function of the first node in the above method embodiments, the receiving unit 201 is used to receive data from the previous hop node; the management unit 202 is used to determine the information of the first routing path based on the data, the nodes on the first routing path are used to transmit the data, and the information of the first routing path has a correspondence with the first key; the management unit 202 is also used to use the first key to generate first signature information; the sending unit 203 is used to send the data, the first signature information and the information of the first routing path to the second node on the first routing path.

[0912] For example, when the device 20 is used to perform Figures 3 to 10 When the method is in use, the receiving unit 201 can be used to execute the step of receiving information in the method; the management unit 202 can be used to execute the processing step in the method; and the sending unit 203 can be used to execute the step of sending information in the method.

[0913] When the communication device 20 is used to implement the functions of the terminal in the above method embodiments, the receiving unit 201 is used to perform the receiving step of the terminal, the sending unit 203 is used to perform the sending step of the terminal, and the management unit 202 is used to perform the processing step of the terminal.

[0914] For example, when the communication device 20 is used to implement the functions of the terminal in the above method embodiments, the sending unit 203 is used to send fourth information to the first node deployed on the first NTN device, the fourth information being used to trigger the first node to perform a security signature; the sending unit 203 is also used to send data to the first node.

[0915] For example, when the device 20 is used to perform Figures 3 to 10 When the method is in use, the receiving unit 201 can be used to execute the step of receiving information in the method; the management unit 202 can be used to execute the processing step in the method; and the sending unit 203 can be used to execute the step of sending information in the method.

[0916] When the communication device 20 is used to implement the function of the verification network element in the above method embodiments, the receiving unit 201 is used to perform the receiving step of the verification network element, the sending unit 203 is used to perform the sending step of the verification network element, and the management unit 202 is used to perform the processing step of the verification network element.

[0917] For example, when the communication device 20 is used to implement the function of verifying the network element in the above method embodiments, the receiving unit 201 is used to obtain the second signature information and the information of the first routing path, and the information of the first routing path has a corresponding relationship with the verification key; the management unit 202 is used to use the verification key to verify the second signature information.

[0918] For example, when the device 20 is used to perform Figures 3 to 10 When the method is in use, the receiving unit 201 can be used to execute the step of receiving information in the method; the management unit 202 can be used to execute the processing step in the method; and the sending unit 203 can be used to execute the step of sending information in the method.

[0919] When the communication device 20 is used to implement the function of the second network element in the above method embodiments, the receiving unit 201 is used to perform the receiving step of the second network element, the sending unit 203 is used to perform the sending step of the second network element, and the management unit 202 is used to perform the processing step of the second network element.

[0920] For example, when the communication device 20 is used to implement the function of the second network element in the above method embodiments, the receiving unit 201 is used to obtain the number of nodes N on the first routing path, where N is an integer greater than 1; the management unit 202 is used to obtain N keys based on the number of nodes N, where the N keys are the keys used for signing by the N nodes on the first routing path.

[0921] For example, when the device 20 is used to perform Figures 3 to 10 When the method is in use, the receiving unit 201 can be used to execute the step of receiving information in the method; the management unit 202 can be used to execute the processing step in the method; and the sending unit 203 can be used to execute the step of sending information in the method.

[0922] When the communication device 20 is used to implement the function of the first network element in the above method embodiments, the receiving unit 201 is used to perform the receiving step of the first network element, the sending unit 203 is used to perform the sending step of the first network element, and the management unit 202 is used to perform the processing step of the first network element.

[0923] For example, when the communication device 20 is used to implement the function of the first network element in the above method embodiments, the management unit 202 is used to determine the first routing path based on the information of the landing network element, which is the last hop node on the first routing path; the sending unit 203 is used to send second information to the second network element, which is used to indicate the number of nodes N on the first routing path, where N is an integer greater than 1.

[0924] For example, when the device 20 is used to perform Figures 3 to 10 When the method is in use, the receiving unit 201 can be used to execute the step of receiving information in the method; the management unit 202 can be used to execute the processing step in the method; and the sending unit 203 can be used to execute the step of sending information in the method.

[0925] For a more detailed description of the receiving unit 201, management unit 202 and sending unit 203, please refer to the relevant descriptions in the above method embodiments, which will not be repeated here.

[0926] As an example and not a limitation, the chip system in this application is as follows: Figure 13 As shown, Figure 13 This is a schematic block diagram of the chip system 30 provided in the embodiments of this application. The chip system includes, but is not limited to, a modem chip, also known as a baseband chip, or a system-on-chip (SoC) chip or system-in-package (SIP) chip containing a modem core.

[0927] from Figure 13 As can be seen, the chip system (or processing system) includes a processor 310 and an input / output interface 330.

[0928] The processor 310 can be a processing circuit in a chip system (including at least one processor core, such as...). Figure 13 (Shown as processor core 1 and processor core 2, etc.). Optionally, processor 310 can be coupled to memory 320 to call instructions in memory 320, enabling the chip system to implement the methods and functions of the various embodiments of this application. Input / output interface 330 can be an input / output circuit in the chip system, outputting information processed by the chip system, or inputting data or signaling information to be processed into the chip system for processing.

[0929] As one approach, the chip system is used to implement the operations performed by the first node, terminal, verification network element, second network element, or the first network element in the various method embodiments described above.

[0930] For example, processor 310 is used to implement the processing-related operations performed by the first node, terminal, verification network element, second network element, or first network element in the above method embodiments, as described in the foregoing embodiments; input / output interface 330 is used to implement the sending and / or receiving-related operations performed by the first node, terminal, verification network element, second network element, or first network ...

Claims

1. A communication method, characterized in that, The method is applied to a first node deployed on a first non-terrestrial network (NTN) device, and the method includes: Receive data from the previous hop node; Based on the data, information about a first routing path is determined, nodes on the first routing path are used to transmit the data, and the information about the first routing path has a corresponding relationship with a first key; Using the first key, generate the first signature information; The data, the first signature information, and the information of the first routing path are sent to the second node on the first routing path.

2. The method according to claim 1, characterized in that, Before generating the first signature information using the first key, the method further includes: Based on the first information, a secure signature is determined, wherein the first information is at least one of first location information, first address information, or information of the terminal sending the data, wherein the first location information is used to indicate the location of the terminal sending the data, the location indicated by the terminal, or the location of the landing network element, wherein the landing network element is a network element deployed on the ground for receiving the data, and the first address information is used to indicate the address of the terminal.

3. The method according to claim 2, characterized in that, The first node is configured with a mapping relationship between the first information and the first security policy; The step of determining to perform a secure signature based on the first information includes: Based on the mapping relationship and the first information, the first security policy is determined, and the first security policy is used to instruct the performance of secure signature.

4. The method according to claim 1, characterized in that, Before generating the first signature information using the first key, the method further includes: Based on the first information, it is determined that a secure signature is to be performed, and that the node processing the data is located at the location indicated by the first location information. The first information is at least one of first location information, first address information, or information of the terminal sending the data. The first location information is used to indicate the location of the terminal sending the data, the location indicated by the terminal, or the location of the landing network element. The landing network element is a terrestrial network element used to receive the data. The first address information is used to indicate the address of the terminal.

5. The method according to claim 4, characterized in that, The first node is configured with a mapping relationship between the first information and the second security policy; The step of determining, based on the first information, to perform a secure signature and to determine that the node processing the data is located at the position indicated by the first location information includes: Based on the mapping relationship and the first information, a second security policy is determined. The second security policy is used to instruct secure signing and to instruct the node processing the data to be located at the position indicated by the first location information.

6. The method according to claim 1, characterized in that, Before generating the first signature information using the first key, the method further includes: Receive first indication information from the previous hop node, the first indication information being used to instruct secure signing.

7. The method according to claim 6, characterized in that, The first indication information is also used to indicate that the node processing the data is at the location indicated by the first location information, wherein the first location information is used to indicate the location of the terminal sending the data, the location indicated by the terminal, or the location of the landing network element, wherein the landing network element is a network element deployed on the ground for receiving the data.

8. The method according to any one of claims 1 to 7, characterized in that, The first node is configured with a third security policy, which is used to indicate that the node processing the data is at the location indicated by the first location information. The information for determining the first routing path based on the data includes: Based on the third security policy and the data, information about the first routing path is determined, wherein the nodes on the first routing path are located at the positions indicated by the first location information.

9. The method according to any one of claims 1 to 8, characterized in that, Before generating the first signature information using the first key, the method further includes: Receive first configuration information, which is used to configure at least one of the following: the correspondence between the information of the first routing path and the first key, the first key, the information of the first routing path, the information of the second node, or first time information, wherein the first time information is used to indicate the validity period of the first routing path.

10. The method according to claim 9, characterized in that, Before receiving the first configuration information, the method further includes: Receive information about the second routing path and second time information, wherein the second routing path is a routing path with the destination network element as the landing network element, and the second time information is used to indicate the validity period of the second routing path; Based on the second time information, it is determined that the validity period of the second routing path has expired; Send a first request message, which is used to request an update to the second routing path, wherein the first routing path is a routing path updated based on the first request message, with the destination network element being the landing network element.

11. The method according to claim 10, characterized in that, The first request information is also used to request an update of the key corresponding to the routing path where the destination network element is the landing network element.

12. The method according to any one of claims 1 to 11, characterized in that, The method further includes: Send a second instruction message to the second node, the second instruction message being used to instruct the second node to perform a secure signature.

13. The method according to any one of claims 1 to 12, characterized in that, The step of using the first key to generate the first signature information includes: Based on the first signature method, the first signature information is generated using the first key; The method further includes: Indicate the information of the first signature method to the second node.

14. The method according to any one of claims 1 to 13, characterized in that, The method further includes: Receive a third instruction message, which is used to instruct the use of the first signature method for secure signing.

15. A communication method, characterized in that, The method is applied to a terminal, and the method includes: Send a fourth message to the first node deployed on the first NTN device, the fourth message being used to trigger the first node to perform a security signature; Send data to the first node.

16. The method according to claim 15, characterized in that, The fourth piece of information is also used to trigger the first node to send the data to the node at the location indicated by the first location information.

17. The method according to claim 15 or 16, characterized in that, The fourth piece of information is at least one of the following: First location information; First address information, the first address information being used to indicate the address of the terminal; The information of the terminal; or, First indication information, the first indication information is used to indicate that a secure signature is to be performed, and / or, the first indication information is used to indicate that the node processing the data is at the position indicated by the first location information; The first location information is used to indicate the location of the terminal, the location indicated by the terminal, or the location of the landing network element, wherein the landing network element is a network element deployed on the ground for receiving the data.

18. The method according to claim 17, characterized in that, Before sending the fourth message to the first node deployed on the first NTN device, the method further includes: Receive a fourth indication information from a third network element, the fourth indication information being used to indicate secure signing, and / or, the fourth indication information being used to indicate that the node processing the data is at the position indicated by the first location information.

19. A communication method, characterized in that, The method is applied to verify network elements, and the method includes: Obtain the second signature information and the first routing path information, wherein the information of the first routing path has a corresponding relationship with the verification key; Use the verification key to verify the second signature information.

20. The method according to claim 19, characterized in that, The method further includes: If the second signature information fails to be verified, a third message is sent, which is used to instruct the updating of the first routing path and / or the updating of the key corresponding to the first routing path.

21. The method according to claim 20, characterized in that, The third information includes information about the first routing path.

22. The method according to any one of claims 19 to 21, characterized in that, Before obtaining the second signature information and the first routing path information, the method further includes: Receive second configuration information, which is used to configure at least one of the following: the correspondence between the information of the first routing path and the verification key, the information of the first routing path, the verification key, or first time information, wherein the first time information is used to indicate the validity period of the first routing path.

23. The method according to any one of claims 19 to 22, characterized in that, Before receiving the second configuration information, the method further includes: Receive information about the second routing path and second time information, wherein the second routing path is a routing path with the destination network element as the landing network element, and the second time information is used to indicate the validity period of the second routing path; Based on the second time information, it is determined that the validity period of the second routing path has expired; Send a first request message, which is used to request an update to the second routing path, wherein the first routing path is a routing path updated based on the first request message, with the destination network element being the landing network element.

24. The method according to any one of claims 19 to 23, characterized in that, The method further includes: Receive information using the first signature method; The step of using the verification key to verify the second signature information includes: Based on the first signature method, the second signature information is verified using the verification key.

25. A communication device, characterized in that, It includes at least one module or at least one unit, said at least one module or at least one unit being used to perform the method of any one of claims 1 to 24.

26. A communication device, characterized in that, include: At least one processor, the at least one processor being configured to execute a computer program or instructions to cause the method of any one of claims 1 to 24 to be performed.

27. The communication device according to claim 26, characterized in that, The communication device further includes a memory for storing the computer program or the instructions.

28. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program or instructions, and when the computer program or instructions are run, the method of any one of claims 1 to 24 is performed.

29. A computer program product, characterized in that, Includes a computer program or instructions, which, when executed, implement the method as described in any one of claims 1 to 24.

Images