METHOD AND DEVICE FOR DETECTING PEOPLE IN THE MIDDLE

Description

TECHNICAL FIELD

[0001] This application relates to the communication field, and more specifically, to a man-in-the-middle detection method and apparatus in the communication field.BACKGROUND

[0002] In a wireless communication system, radio resource control (radio resource control, RRC) signaling or user plane data may be sent between user equipment (user equipment, UE) and a base station. However, attackers may deploy a false base station between the UE and the base station to eavesdrop, tamper with, forge, inject, and release an air interface message, causing a DoS attack to a terminal and a network.

[0003] A man-in-the-middle is a type of false base station, including a false base station part function and a false UE part function. If UE is in an idle state, when the UE approaches a false base station, and detects that signal quality of a cell of the false base station is good and meets a cell reselection condition, the UE triggers a cell reselection process and camps on the cell of the false base station. If UE is in a connected state, when the UE approaches a false base station, and detects that signal quality of a cell of the false base station is good, the UE reports a measurement result to a serving cell. The serving cell triggers handover of the UE to the cell of the false base station, to enable the UE to camp on the cell of the false base station. The false UE part function is used to forward or modify communication data of real UE, access a real base station as the real UE, and communicate with an access and mobility management function (access and mobility management function, AMF) based on an N2 protocol. It is usually difficult for a network side and a terminal side to perceive a man-in-the-middle.

[0004] A current method for discovering a man-in-the-middle is usually as follows: A hash HASH value of a received master information block (master information block, MIB) / system information block (system information block, SIB) is calculated by UE, and the hash value of the MIB / SIB is carried in a measurement report (measurement report, MR) / logged MR to be reported to a real base station. The real base station calculates a hash value of the MIB / SIB and compares the hash value with the value reported by the UE; and if the two values are inconsistent, determines that a man-in-the-middle exists. US 2020 / 0236554 A1 discloses information protection to detect fake base stations. CN 110545253 A discloses an information processing method and device. CN 102223632 A discloses a synchronization method and system for an access layer security algorithm.

[0005] However, when the man-in-the-middle completely imitates the MIB / SIB of the real base station, the method cannot be used to detect the man-in-the-middle.

[0006] Therefore, providing a man-in-the-middle detection method that can prevent a man-in-the-middle from bypassing detection through a mechanism of the man-in-the-middle is an urgent problem to be resolved currently.SUMMARY

[0007] The invention is defined by the appended claims. This application provides a man-in-the-middle detection method and apparatus, to effectively improve an air interface man-in-the-middle detection rate and prevent a man-in-the-middle from bypassing a detection mechanism through technical means.

[0008] According to a first aspect, a man-in-the-middle detection method is provided. The method includes: A base station receives, in a first physical frame, a first radio resource control RRC message from user equipment UE; the base station receives a second RRC message from the UE, where the second RRC message includes frame information of a second physical frame, and security protection is performed on the first RRC message and the second RRC message by using an access stratum AS security context established by the UE and the base station; and the base station determines whether the first physical frame matches the second physical frame.

[0009] With reference to the first aspect, in a first possible implementation of the first aspect, the frame information of the second physical frame includes a frame number and a subframe number of the second physical frame.

[0010] With reference to the first possible implementation of the first aspect, in a second possible implementation of the first aspect, that the base station determines whether the first physical frame matches the second physical frame includes: If a frame number of the first physical frame is the same as the frame number of the second physical frame and a subframe number of the first physical frame is the same as the subframe number of the second physical frame, the base station determines that the first physical frame matches the second physical frame; otherwise, the base station determines that the first physical frame does not match the second physical frame.

[0011] With reference to the first aspect or either of the first and second possible implementations of the first aspect, in a third possible implementation of the first aspect, after that a base station receives, in a first physical frame, a first radio resource control RRC message from UE, the method further includes: The base station stores frame information of the first physical frame.

[0012] With reference to the first aspect or any one of the first to third possible implementations of the first aspect, in a fourth possible implementation of the first aspect, before that a base station receives, in a first physical frame, a first radio resource control RRC message from UE, the method further includes: The base station establishes the AS security context with the UE.

[0013] With reference to the first aspect or any one of the first to fourth possible implementations of the first aspect, in a fifth possible implementation of the first aspect, before that a base station receives, in a first physical frame, a first RRC message from UE, the method further includes: The base station sends indication information to the UE, where the indication information indicates the UE to enable man-in-the-middle detection.

[0014] According to a second aspect, a man-in-the-middle detection method is provided. The method includes: User equipment UE sends, in a second physical frame, a first radio resource control RRC message to a base station; and the UE sends a second RRC message to the base station, where the second RRC message includes frame information of the second physical frame, and security protection is performed on the first RRC message and the second RRC message by using an access stratum AS security context established by the UE and the base station.

[0015] With reference to the second aspect, in a first possible implementation of the second aspect, the frame information of the second physical frame includes a frame number and a subframe number of the second physical frame.

[0016] With reference to the second aspect or the first possible implementation of the second aspect, in a second possible implementation of the second aspect, before that user equipment UE sends, in a second physical frame, a first radio resource control RRC message to a base station, the method further includes: The UE receives downlink control information DCI, where the DCI is used to determine the frame information of the second physical frame; and the UE stores the frame information of the second physical frame.

[0017] With reference to the second aspect or either of the first and second possible implementations of the second aspect, in a third possible implementation of the first aspect, before that user equipment UE sends, in a second physical frame, a first radio resource control RRC message to a base station, the method further includes: The UE accesses the base station, and establishes the AS security context with the base station.

[0018] With reference to the second aspect or any one of the first to third possible implementations of the second aspect, in a fourth possible implementation of the second aspect, that user equipment UE sends, in a second physical frame, a first radio resource control RRC message to a base station includes: If a preset rule is met, the UE sends, in the second physical frame, the first RRC message to the base station.

[0019] With reference to the fourth possible implementation of the second aspect, in a fifth possible implementation of the second aspect, the preset rule includes: The UE receives indication information sent by the base station, where the indication information indicates the UE to enable man-in-the-middle detection; or the UE determines that user plane integrity protection between the UE and the base station is not enabled.

[0020] According to a third aspect, a man-in-the-middle detection method is provided. The method includes: User equipment UE sends, in a third physical frame, a third radio resource control RRC message to a base station; the UE receives a fourth RRC message from the base station, where the fourth RRC message includes frame information of a fourth physical frame; the UE determines whether the third physical frame matches the fourth physical frame; and the UE sends a fifth RRC message to the base station, where the fifth RRC message indicates whether the third physical frame matches the fourth physical frame, and security protection is performed on the third RRC message, the fourth RRC message, and the fifth RRC message by using an access stratum AS security context established by the UE and the base station.

[0021] With reference to the third aspect, in a first possible implementation of the third aspect, the frame information of the fourth physical frame includes a frame number and a subframe number of the fourth physical frame.

[0022] With reference to the first possible implementation of the third aspect, in a second possible implementation of the third aspect, that the UE determines whether the third physical frame matches the fourth physical frame includes: If a frame number of the third physical frame is the same as the frame number of the fourth physical frame and a subframe number of the third physical frame is the same as the subframe number of the fourth physical frame, the UE determines that the third physical frame matches the fourth physical frame; otherwise, the UE determines that the third physical frame does not match the fourth physical frame.

[0023] With reference to the third aspect or either of the first and second possible implementations of the third aspect, in a third possible implementation of the third aspect, before that user equipment UE sends, in a third physical frame, a third radio resource control RRC message to a base station, the method further includes: The UE receives downlink control information DCI, where the DCI is used to determine frame information of the third physical frame, and the frame information of the third physical frame includes the frame number and the subframe number of the third physical frame; and the UE stores the frame information of the third physical frame.

[0024] With reference to the third aspect or any one of the first to third possible implementations of the third aspect, in a fourth possible implementation of the third aspect, before that user equipment UE sends, in a third physical frame, a third radio resource control RRC message to a base station, the method further includes: The UE accesses the base station, and establishes the AS security context with the base station.

[0025] With reference to the third aspect or any one of the first to fourth possible implementations of the third aspect, in a fifth possible implementation of the third aspect, that user equipment UE sends, in a third physical frame, a third radio resource control RRC message to a base station includes: If a preset rule is met, the UE sends, in the second physical frame, the third RRC message to the base station.

[0026] With reference to the third aspect or any one of the first to fifth possible implementations of the third aspect, in a sixth possible implementation of the third aspect, the first preset rule includes: The UE receives indication information sent by the base station, where the indication information indicates the UE to enable man-in-the-middle detection; or the UE determines that user plane integrity protection between the UE and the base station is not enabled.

[0027] According to a fourth aspect, a man-in-the-middle detection method is provided. The method includes: A base station receives, in a fourth physical frame, a third RRC message from user equipment UE; the base station sends a fourth RRC message to the UE, where the fourth RRC message includes frame information of the fourth physical frame; the base station receives a fifth RRC message sent by the UE; and the base station determines, based on the fifth RRC message, whether a man-in-the-middle exists between the base station and the UE.

[0028] With reference to the fourth aspect, in a first possible implementation of the fourth aspect, the fifth RRC message indicates whether a third physical frame matches the fourth physical frame, and the third physical frame is a physical frame in which the UE sends the third RRC message. That the base station determines, based on the fifth RRC message, whether a man-in-the-middle exists between the base station and the UE includes: If the third physical frame does not match the fourth physical frame, the base station determines that a man-in-the-middle exists between the base station and the UE; or if the third physical frame matches the fourth physical frame, the base station determines that no man-in-the-middle exists between the base station and the UE.

[0029] With reference to the fourth aspect or the first possible implementation of the fourth aspect, in a second possible implementation of the fourth aspect, the frame information of the fourth physical frame includes a frame number and a subframe number of the fourth physical frame.

[0030] With reference to the fourth aspect or either of the first and second possible implementations of the fourth aspect, in a third possible implementation of the third aspect, before that a base station receives, in a fourth physical frame, a third RRC message sent by user equipment UE, the method further includes: The base station establishes an AS security context with the UE.

[0031] With reference to the fourth aspect or any one of the first to third possible implementations of the fourth aspect, in a fifth possible implementation of the third aspect, before that a base station receives, in a fourth physical frame, a third RRC message from user equipment UE, the method further includes: The base station sends indication information to the UE, where the indication information indicates the UE to enable man-in-the-middle detection.

[0032] According to a fifth aspect, a man-in-the-middle detection apparatus is provided. The apparatus includes: a transceiver module, configured to receive, in a first physical frame, a first radio resource control RRC message from user equipment UE, where the transceiver module is further configured to receive a second RRC message from the UE, where the second RRC message includes frame information of a second physical frame, and security protection is performed on the first RRC message and the second RRC message by using an access stratum AS security context established by the UE and a base station; and a processing module, configured to determine whether the first physical frame matches the second physical frame.

[0033] With reference to the fifth aspect, in a first possible implementation of the fifth aspect, the frame information of the second physical frame includes a frame number and a subframe number of the second physical frame.

[0034] With reference to the first possible implementation of the fifth aspect, in a second possible implementation of the fifth aspect, the processing module is specifically configured to: if a frame number of the first physical frame is the same as the frame number of the second physical frame and a subframe number of the first physical frame is the same as the subframe number of the second physical frame, determine, by the base station, that the first physical frame matches the second physical frame; otherwise, determine, by the base station, that the first physical frame does not match the second physical frame.

[0035] With reference to the fifth aspect or either of the first and second possible implementations of the fifth aspect, in a third possible implementation of the fifth aspect, the processing module is further configured to store frame information of the third physical frame.

[0036] With reference to the fifth aspect or any one of the first to third possible implementations of the fifth aspect, in a fourth possible implementation of the fifth aspect, the processing module is further configured to establish the AS security context with the UE.

[0037] With reference to the fifth aspect or any one of the first to fourth possible implementations of the fifth aspect, in a fifth possible implementation of the fifth aspect, the transceiver module is further configured to send indication information to the UE, where the indication information indicates the UE to enable man-in-the-middle detection.

[0038] According to a sixth aspect, a man-in-the-middle detection apparatus is provided. The apparatus includes a transceiver module, configured to send, in a second physical frame, a first radio resource control RRC message to a base station. The transceiver module is further configured to send a second RRC message to the base station. The second RRC message includes frame information of the second physical frame, and security protection is performed on the first RRC message and the second RRC message by using an access stratum AS security context established by UE and the base station.

[0039] With reference to the sixth aspect, in a first possible implementation of the sixth aspect, the frame information of the second physical frame includes a frame number and a subframe number of the second physical frame.

[0040] With reference to the sixth aspect or the first possible implementation of the sixth aspect, in a second possible implementation of the sixth aspect, the transceiver module is further configured to receive downlink control information DCI, where the DCI is used to determine the frame information of the second physical frame. The apparatus further includes a processing module, where the processing module is configured to store the frame information of the second physical frame.

[0041] With reference to the sixth aspect or either of the first and second possible implementations of the fifth aspect, in a third possible implementation of the sixth aspect, the processing module is further configured to access the base station and establish the AS security context with the base station.

[0042] With reference to the sixth aspect or any one of the first to third possible implementations of the sixth aspect, in a fourth possible implementation of the sixth aspect, the transceiver module is specifically configured to: if a preset rule is met, send, by the UE in the second physical frame, the first RRC message to the base station.

[0043] With reference to the fourth possible implementation of the sixth aspect, in a fifth possible implementation of the sixth aspect, the preset rule includes: The UE receives indication information sent by the base station, where the indication information indicates the UE to enable man-in-the-middle detection; or the UE determines that user plane integrity protection between the UE and the base station is not enabled.

[0044] According to a seventh aspect, a man-in-the-middle detection apparatus is provided. The apparatus includes: a transceiver module, configured to send, in a third physical frame, a third radio resource control RRC message to a base station. The transceiver module is further configured to receive a fourth RRC message from the base station, where the fourth RRC message includes frame information of a fourth physical frame; and the transceiver module is further configured to send a fifth RRC message to the base station, where the fifth RRC message indicates whether the third physical frame matches the fourth physical frame, and security protection is performed on the third RRC message, the fourth RRC message, and the fifth RRC message by using an access stratum AS security context established by UE and the base station.

[0045] With reference to the seventh aspect, in a first possible implementation of the seventh aspect, the frame information of the fourth physical frame includes a frame number and a subframe number of the fourth physical frame.

[0046] With reference to the seventh aspect or the first possible implementation of the seventh aspect, in a second possible implementation of the seventh aspect, the processing module is specifically configured to: if a frame number of the third physical frame is the same as the frame number of the fourth physical frame and a subframe number of the third physical frame is the same as the subframe number of the fourth physical frame, determine, by the UE, that the third physical frame matches the fourth physical frame; otherwise, determine, by the UE, that the third physical frame does not match the fourth physical frame.

[0047] With reference to the seventh aspect or either of the first and second possible implementations of the seventh aspect, in a third possible implementation of the seventh aspect, the transceiver module is further configured to receive downlink control information DCI, where the DCI is used to determine frame information of the third physical frame, and the frame information of the third physical frame includes the frame number and the subframe number of the third physical frame.

[0048] The processing module is further configured to store the frame information of the third physical frame.

[0049] With reference to the seventh aspect or any one of the first to third possible implementations of the seventh aspect, in a fourth possible implementation of the seventh aspect, the processing module is further configured to access the base station and establish the AS security context with the base station.

[0050] With reference to the seventh aspect or any one of the first to fourth possible implementations of the seventh aspect, in a fifth possible implementation of the seventh aspect, the first preset rule includes:

[0051] The UE receives indication information sent by the base station, where the indication information indicates the UE to enable man-in-the-middle detection; or the UE determines that user plane integrity protection between the UE and the base station is not enabled.

[0052] According to an eighth aspect, a man-in-the-middle detection apparatus is provided. The apparatus includes: a transceiver module, configured to receive, in a fourth physical frame, a third RRC message from user equipment UE, where the transceiver module is further configured to send a fourth RRC message to the UE, where the fourth RRC message includes frame information of the fourth physical frame; and the transceiver module is further configured to receive a fifth RRC message sent by the UE; and a processing module, configured to determine, based on the fifth RRC message, whether a man-in-the-middle exists between a base station and the UE.

[0053] With reference to the eighth aspect, in a first possible implementation of the eighth aspect, the fifth RRC message indicates whether a third physical frame matches the fourth physical frame, and the third physical frame is a physical frame in which the UE sends the third RRC message. The processing module is specifically configured to: if the third physical frame does not match the fourth physical frame, determine that the man-in-the-middle exists between the base station and the UE; or if the third physical frame matches the fourth physical frame, determine that no man-in-the-middle exists between the base station and the UE.

[0054] With reference to the eighth aspect or the first possible implementation of the eighth aspect, in a second possible implementation of the eighth aspect, the frame information of the fourth physical frame includes a frame number and a subframe number of the fourth physical frame.

[0055] With reference to the eighth aspect or either of the first and second possible implementations of the eighth aspect, in a third possible implementation of the eighth aspect, the processing module is further configured to establish an AS security context with the UE.

[0056] With reference to the eighth aspect or any one of the first to third possible implementations of the eighth aspect, in a fourth possible implementation of the eighth aspect, the transceiver module is further configured to send indication information to the UE, where the indication information indicates the UE to enable man-in-the-middle detection.

[0057] According to a ninth aspect, a communication apparatus is provided. The apparatus includes a processor, configured to execute a computer program stored in a memory, to enable the communication apparatus to perform the communication method in any one of the first to fifth possible implementations of the first aspect, or perform the communication method in any one of the first to fifth possible implementations of the second aspect, or perform the communication method in any one of the first to fourth possible implementations of the third aspect, or perform the communication method in any one of the first to fourth possible implementations of the fourth aspect.

[0058] According to a tenth aspect, a computer-readable storage medium is provided. The computer-readable storage medium stores a computer program. When the computer program is run on a computer, the computer is enabled to perform the communication method in any one of the first to fifth possible implementations of the first aspect, or perform the communication method in any one of the first to the fifth possible implementations of the second aspect, or perform the communication method in any one of the first to fourth possible implementations of the third aspect, or perform the communication method in any one of the first to fourth possible implementations of the fourth aspect.

[0059] According to an eleventh aspect, a chip system is provided. The chip system includes a processor, configured to invoke a computer program from a memory and run the computer program, to enable the communication device installed with the chip system to perform the communication method in any one of the first to fifth possible implementations of the first aspect, or perform the communication method in any one of the first to fifth possible implementations of the second aspect, or perform the communication method in any one of the first to fourth possible implementations of the third aspect, or perform the communication method in any one of the first to fourth possible implementations of the fourth aspect.BRIEF DESCRIPTION OF DRAWINGS

[0060] FIG. 1 is an example diagram of a system architecture to which an embodiment of this application is applied; FIG. 2 is an architectural diagram of working of a man-in-the-middle according to an embodiment of this application; FIG. 3 is a schematic interaction diagram of an example of a man-in-the-middle detection method according to an embodiment of this application; FIG. 4 is a schematic diagram of message transmission between user equipment and a base station according to an embodiment of this application; FIG. 5 is a schematic interaction diagram of another example of a man-in-the-middle detection method according to an embodiment of this application; FIG. 6 is a schematic interaction diagram of another example of a man-in-the-middle detection method according to an embodiment of this application; FIG. 7 is a schematic interaction diagram of another example of a man-in-the-middle detection method according to an embodiment of this application; FIG. 8 is a schematic block diagram of an example of user equipment according to this application; FIG. 9 is a schematic block diagram of an example of a base station according to this application; FIG. 10 is a schematic block diagram of another example of user equipment according to this application; FIG. 11 is a schematic block diagram of another example of a base station according to this application; FIG. 12 is a schematic block diagram of an example of a communication apparatus according to this application; FIG. 13 is a schematic block diagram of another example of a communication apparatus according to this application; and FIG. 14 is a schematic diagram of a structure of a terminal device according to this application. DESCRIPTION OF EMBODIMENTS

[0061] The following describes technical solutions in embodiments of this application with reference to the accompanying drawings in embodiments of this application.

[0062] The technical solutions in embodiments of this application may be applied to various communication systems, for example, a long term evolution (long term evolution, LTE) system, an LTE frequency division duplex (frequency division duplex, FDD) system, an LTE time division duplex (time division duplex, TDD), a universal mobile telecommunications system (universal mobile telecommunications system, UMTS), and a new radio (new radio, NR) system.

[0063] The following describes a structure of a communication system in this application with reference to FIG. 1. As shown in FIG. 1, the communication system includes but is not limited to the following network elements.1. User equipment (user equipment, UE)

[0064] The UE in embodiments of this application may also be referred to as a mobile station (mobile station, MS), a mobile terminal (mobile terminal, MT), an access terminal, a subscriber unit, a subscriber station, a mobile station, a remote station, a remote terminal, a mobile device, a user terminal, a terminal, a wireless communication device, a user agent, a user apparatus, and the like.

[0065] The UE may be a device that provides a voice / data connectivity for a user, for example, a handheld device or a vehicle-mounted device that has a wireless connection function. Currently, examples of some terminals are a mobile phone (mobile phone), a tablet computer, a laptop computer, a palmtop computer, a mobile internet device (mobile internet device, MID), a wearable device, a virtual reality (virtual reality, VR) device, an augmented reality (augmented reality, AR) device, a wireless terminal in industrial control (industrial control), a wireless terminal in self-driving (self-driving), a wireless terminal in remote medical surgery (remote medical surgery), a wireless terminal in a smart grid (smart grid), a wireless terminal in transportation safety (transportation safety), a wireless terminal in a smart city (smart city), a wireless terminal in a smart home (smart home), a cellular phone, a cordless telephone set, a session initiation protocol (session initiation protocol, SIP) phone, a wireless local loop (wireless local loop, WLL) station, a personal digital assistant (personal digital assistant, PDA), a handheld device having a wireless communication function, a calculating device or another processing device connected to a wireless modem, a vehicle-mounted device, a wearable device, UE in a future 5G network, or UE in a future evolved public land mobile network (public land mobile network, PLMN). This is not limited in embodiments of this application.

[0066] By way of example, and not limitation, in embodiments of this application, the UE may alternatively be a wearable device. The wearable device may also be referred to as a wearable intelligent device, and is a general term of a wearable device that is intelligently designed and developed for daily wear by using a wearable technology, for example, glasses, gloves, a watch, clothing, and shoes. The wearable device is a portable device that can be directly worn on a body or integrated into clothes or an accessory of a user. The wearable device is not only a hardware device, but also implements a powerful function through software support, data exchange, and cloud interaction. A generalized wearable intelligent device includes a full-featured and large-size device that can implement complete or partial functions without depending on a smartphone, such as a smart watch or smart glasses, and a device that focuses on only one type of application functions and needs to work with another device such as a smartphone, for example, various smart bands or smart jewelry for monitoring a physical sign.

[0067] In addition, in embodiments of this application, the UE may alternatively be UE in an internet of things (Internet of things, IoT) system. An IoT is an important part of future information technology development. A main technical feature of the IoT is that an article is connected to a network by using a communication technology, to implement an intelligent network for human-machine interconnection and thing-thing interconnection.

[0068] In embodiments of this application, the IoT technology can implement massive connections, in-depth coverage, and terminal power saving by using, for example, a narrow band (narrow band) NB technology. For example, an NB may include one resource block (resource block, RB). In other words, a bandwidth of the NB is only 180 KB. To implement massive access, a terminal needs to perform discrete access. According to a communication method in embodiments of this application, a congestion problem that occurs in the IoT technology when massive terminals access a network through the NB can be effectively resolved.

[0069] In addition, in embodiments of this application, the UE may further communicate with UE in another communication system. For example, the UEs perform inter-device communication. For example, the UE may further transmit (for example, send and / or receive) a time synchronization packet with UE in another communication system.2. Base station

[0070] In addition, the base station in embodiments of this application may be a device configured to communicate with UE. The base station may also be referred to as an access network device or a radio access network device. For example, the base station may be an evolved NodeB (evolved NodeB, eNB or eNodeB) in an LTE system, or a radio controller in a cloud radio access network (cloud radio access network, CRAN) scenario. Alternatively, the base station may be a relay station, an access point, a vehicle-mounted device, a wearable device, a base station in a future 5G network, a base station in a future evolved PLMN network, an access point (access point, AP) in a WLAN, or a gNB in a new radio (new radio, NR) system. This is not limited in embodiments of this application.

[0071] In addition, in embodiments of this application, the base station is a device in a RAN, that is, a RAN node that enables UE to access a wireless network. For example, by way of example, and not limitation, the base station may be a gNB, a transmission reception point (transmission reception point, TRP), an evolved NodeB (evolved NodeB, eNB), a radio network controller (radio network controller, RNC), a NodeB (NodeB, NB), a base station controller (base station controller, BSC), a base transceiver station (base transceiver station, BTS), a home base station (such as a home evolved NodeB, or home NodeB, HNB), or a base band unit (base band unit, BBU). In a network structure, a network device may include a central unit (central unit, CU) node, a distributed unit (distributed unit, DU) node, a RAN device including a CU node and a DU node, or a RAN device including a CU control plane node (CU-CP node), a CU user plane node (CU-UP node), and a DU node.

[0072] The base station serves a cell. UE communicates with the base station by using a transmission resource (for example, a frequency domain resource or a spectrum resource) used for the cell. The cell may be a cell corresponding to the base station (for example, the base station). The cell may belong to a macro base station, or a base station corresponding to a small cell (small cell). The small cell herein may include a metro cell (metro cell), a micro cell (micro cell), a pico cell (pico cell), a femto cell (femto cell), or the like. These small cells have features of small coverage and low transmit power, and are applicable to providing a high-speed data transmission service.

[0073] In addition, a plurality of cells may simultaneously operate in a same frequency on a carrier in an LTE system or a 5G system. In some special scenarios, it may also be considered that a concept of the carrier is equivalent to that of the cell. For example, in a carrier aggregation (carrier aggregation, CA) scenario, when a secondary component carrier is configured for UE, a carrier index of the secondary component carrier and a cell identifier (cell identifier, Cell ID) of a secondary cell working on the secondary component carrier are both carried. In this case, it may be considered that the concept of the carrier is equivalent to that of the cell. For example, for UE, accessing a carrier is equivalent to accessing a cell.3. Access management function entity

[0074] The access management function entity is mainly configured to perform mobility management, access management, and the like, and may be configured to implement functions other than a session management function in functions of a mobility management entity (mobility management entity, MME) in an LTE system, for example, functions such as lawful interception and access authorization / authentication.

[0075] In a 5G communication system, an access management network element may be an access management function (access and mobility management function, AMF) entity.

[0076] In a future communication system, the access management function entity may still be an AMF entity, or may have another name. This is not limited in this application.

[0077] It may be understood that the entities or the functions may be network elements in a hardware device, may be software functions run on dedicated hardware, or may be virtualized functions instantiated on a platform (for example, a cloud platform).

[0078] It should be understood that the foregoing network elements or entities included in the communication system are merely examples for descriptions. This is not particularly limited in this application.

[0079] FIG. 2 is an architectural diagram of working of a man-in-the-middle. It can be learned from FIG. 2 that the man-in-the-middle includes a false base station part and a false UE part. The false base station part is configured to attract UE to camp on a man-in-the-middle cell, and the false UE part is configured to access a real base station, and forward or modify communication data of real UE. An AMF network element is a network element that is mainly responsible for access and mobility management. A base station (a gNB in FIG. 2) and the AMF are connected through an N2 interface. The interface is similar to an S1 interface, and transmits a message exchanged between a RAN and the AMF. UE communicates with the AMF through an N1 / NAS interface to transmit a message exchanged between the UE and the AMF. Usually, the RAN forwards the message to the AMF. The UE and the base station are connected through a Uu interface, and the UE and the base station may send RRC signaling and user plane data. The base station is connected to the AMF through the N2 interface, and the base station communicates with the AMF based on an N2 protocol.

[0080] Such a man-in-the-middle may eavesdrop, tamper with, forge, inject, and release an air interface message, causing a DoS attack to a terminal and a network. It is usually difficult for a network side and a terminal side to perceive a man-in-the-middle.

[0081] For ease of description, the following first describes a physical frame in air interface communication by using a frame structure in an LTE system and an NR system as an example.

[0082] The physical frame usually refers to a protocol data unit at a data link layer. The physical frame includes several parts that perform different functions. The frame structure refers to frames that can form different repetition periodicities based on different transmitted information. To meet a requirement of uplink and downlink time conversion in time division multiplexing, in TD-LTE, a dedicated radio frame structure is designed. In TD-LTE time domain, there are two types of frame structures for periodic simultaneous transmission with a quantity of uplink and downlink subframes in a standard configuration: a radio frame and a half-frame. Duration of the radio frame is 10 ms, and duration of the half-frame is 5 ms. One radio frame includes two half-frames. Each half-frame includes five subframes whose duration is 1 ms, each subframe includes two slots whose duration is 0.5 ms, and each slot includes six or seven CP+OFDM symbols based on different cyclic prefix CP duration.

[0083] Compared with a fixed 4G frame structure, the most distinctive feature of a 5G frame structure is flexibility and variability. A 5G frame uses a hierarchical structure and includes two parts: a fixed architecture and a flexible architecture. The fixed architecture is the same as that in 4G, and includes a radio frame whose duration is 10 ms and a subframe whose duration is 1 ms. Each frame is divided into two half-frames. The first half-frame includes subframes 0 to 4, and the second half-frame includes subframes 5 to 9. Each subframe includes several slots.

[0084] In an LTE system or an NR system, a system frame number (system frame number, SFN) ranges from 0 to 1023, that is, a basic data sending periodicity is 1024 frames. A subframe number ranges from 0 to 9, that is, a sending periodicity of a part of control information is 10 subframes.

[0085] The following describes in detail a man-in-the-middle detection method in this application with reference to FIG. 3 to FIG. 7.

[0086] FIG. 3 is a schematic flowchart of a man-in-the-middle detection method 100 according to an embodiment of this application. It can be learned from FIG. 3 that the method 100 includes the following steps.

[0087] S110: A base station receives, in a first physical frame, a first RRC message sent by UE.

[0088] S120: The base station receives a second RRC message sent by the UE, where the second RRC message includes frame information of a second physical frame.

[0089] S130: The base station determines whether the first physical frame matches the second physical frame.

[0090] Specifically, after successfully establishing an AS security context with the UE, the base station receives, in the first physical frame, the first RRC message from the UE. Then, the base station receives the second RRC message on which security protection is performed from the UE. The UE provides the frame information of the second physical frame for the base station by using the second RRC message. The frame information of the second physical frame is a physical frame in which the UE sends the first RRC message. When a man-in-the-middle attack exists, air interface communication between the base station and the UE is intercepted by the man-in-the-middle. An air interface between the UE and a false base station and an air interface between false UE and the base station are independent of each other, that is, the base station cannot directly receive the first RRC message sent by the UE. The man-in-the-middle receives the first RRC message through the false base station, and forwards the first RRC message to the base station through the false UE. Security protection is performed on the first RRC message by using an access stratum security context established by the UE and the base station. Therefore, the man-in-the-middle cannot crack or tamper with the first RRC message. After the man-in-the-middle attack occurs between the UE and the base station, a physical frame in which the UE sends an uplink message cannot be consistent with a physical frame in which the base station receives the uplink message. Therefore, when the first physical frame matches the second physical frame, the base station determines that no man-in-the-middle exists between the UE and the base station. When the first physical frame does not match the second physical frame, the base station determines that a man-in-the-middle exists between the UE and the base station.

[0091] Therefore, according to the man-in-the-middle detection method in this embodiment of this application, whether the man-in-the-middle exists in the air interface communication is determined by determining whether the physical frame in which the UE sends the uplink message matches the physical frame in which the base station receives the uplink message, to prevent the man-in-the-middle from bypassing detection through a mechanism of the man-in-the-middle and improve a man-in-the-middle detection rate.

[0092] According to the method 100, a basis of the man-in-the-middle detection method in this embodiment of this application is as follows: When the man-in-the-middle attack exists between the UE and the base station, the physical frame in which the UE sends the uplink message cannot match the physical frame in which the base station receives the uplink message. In other words, frame information of the physical frame in which the UE sends the uplink message is inconsistent with frame information of the physical frame in which the base station receives the uplink message. For example, in an uplink scheduling request mechanism shown in FIG. 4, when the man-in-the-middle exists between the UE and the base station, an uplink message, for example, the first RRC message, sent by the UE to the base station cannot be directly received by the base station. The base station can receive only the first RRC message transparently transmitted by the man-in-the-middle. In this case, frame information of a physical frame in which the man-in-the-middle sends the uplink message through false UE cannot be consistent with frame information of a physical frame in which real UE sends the uplink message. Specifically, the process 200 shown in FIG. 4 includes the following steps.

[0093] S210: The UE sends a first scheduling request (scheduling request, SR) to the man-in-the-middle.

[0094] Specifically, when the man-in-the-middle attack exists, the UE and the base station are indirectly connected through the man-in-the-middle, that is, the man-in-the-middle establishes connections to the real UE and a real base station separately through the false base station and the false UE. After the connections are established, the UE sends the first SR to the false base station to apply for an uplink transmission resource.

[0095] S220: The man-in-the-middle sends first downlink control information (downlink control information, DCI) to the UE.

[0096] Specifically, after receiving the first SR sent by the UE, the man-in-the-middle sends the first DCI to the UE, and indicates an appropriate available resource to the UE by using the first DCI.

[0097] S230: The UE sends the first RRC message to the man-in-the-middle.

[0098] Specifically, the UE receives the first DCI sent by the man-in-the-middle, determines a physical frame a based on the first DCI, and sends the first RRC message to the man-in-the-middle in the physical frame a.

[0099] For example, after receiving the first DCI in a subframe n, the UE sends the first RRC message to the man-in-the-middle in a subframe n+x. A physical frame in which the subframe n+x is located is the physical frame a. It should be understood that in an LTE system, x is a value defined in a protocol, and in a unified configuration, the value of x is fixed. Specifically, for example, in a frequency division duplex (frequency division duplex, FDD) scenario, the value of x is fixed to 4. For details, refer to chapter 8 of the protocol 3GPP TS 36.213. For another example, in an NR system, the UE receives the first DCI, where the first DCI carries an information parameter, and the UE determines the value of x based on the information parameter. For a specific determination method, refer to chapter 6 of the protocol 3GPP TS 38.214.

[0100] S240: The man-in-the-middle sends the first SR to the base station.

[0101] Specifically, after receiving the first SR sent by the UE in step S210, the man-in-the-middle reports the first SR to the real base station through the false UE.

[0102] S250: The base station sends second DCI to the man-in-the-middle.

[0103] Specifically, after receiving the first SR sent by the false UE, the base station sends the second DCI to the man-in-the-middle to indicate an appropriate available resource for the false UE.

[0104] S260: The man-in-the-middle sends the first RRC message to the base station.

[0105] Specifically, the man-in-the-middle receives the second DCI sent by the base station, determines a physical frame b based on the second DCI, and sends the first RRC message to the base station in the physical frame b.

[0106] It should be understood that the physical frame a is a time domain resource location indicated by the man-in-the-middle for the UE, and the physical frame b is a time domain resource location indicated by the base station for the man-in-the-middle. Because the man-in-the-middle cannot predict a specific location of the physical frame b indicated by the base station, the physical frame a cannot match the physical frame b. Therefore, when the man-in-the-middle attack exists, the physical frame in which the UE sends the uplink message cannot match the physical frame in which the base station receives the uplink message.

[0107] FIG. 5 is a schematic flowchart of a man-in-the-middle detection method 300 according to an embodiment of this application when a man-in-the-middle attack exists between UE and a base station. It can be learned from FIG. 5 that the method 300 includes the following steps.

[0108] S310: The UE establishes an AS security context with the base station.

[0109] Specifically, the UE accesses the base station, that is, the UE establishes an indirect connection to the base station through the man-in-the-middle, and then the UE establishes the access stratum AS security context with the base station. It should be understood that, after the UE establishes the AS security context with the base station, security protection is performed on all RRC messages, and the man-in-the-middle cannot tamper with the RRC message sent between the UE and the base station. It should be understood that the security protection includes RRC integrity protection and RRC confidentiality protection. The RRC integrity protection can ensure that the RRC message is not tampered with in a transmission process, and the RRC confidentiality protection can ensure that information content of the RRC message is not disclosed in the transmission process.

[0110] S320: The man-in-the-middle sends third DCI to the UE, where the third DCI is used to determine a physical frame p for sending the RRC message by the UE.

[0111] It should be understood that, before S320, the UE sends a buffer status report (buffer status report, BSR) to the man-in-the-middle to indicate a data volume of an uplink buffer, and then the man-in-the-middle sends the third DCI to the UE to allocate an appropriate available resource to the UE. The UE determines the physical frame p based on the third DCI. Specifically, for example, in an NR system, the UE receives the third DCI in a physical frame c, a frame number and a subframe number of the physical frame c are 10 and 6 respectively, and time indicated by the physical frame c is 10*10+6=106. The third DCI carries an information parameter. The UE obtains, through calculation based on the information parameter, that a value of x is 2, and time indicated by a physical frame e is 106+2=108. Therefore, a frame number and a subframe number of the physical frame e are 10 and 8 respectively.

[0112] Optionally, after determining the physical frame p based on the third DCI, the UE stores frame information of the physical frame p, where the frame information of the physical frame p includes a frame number and a subframe number of the physical frame p.

[0113] It should be understood that, before step S320, if a first preset rule is met, the UE enables man-in-the-middle detection. The enabling man-in-the-middle detection means that the UE performs the method mentioned in this application. For example, the enabling man-in-the-middle detection may include: The UE sends a first physical frame query request message and a second physical frame query request message that carries the frame information of the physical frame p.

[0114] The first preset rule includes: The UE receives indication information from the base station, where the indication information indicates the UE to enable man-in-the-middle detection; or the UE determines that user plane integrity protection between the UE and the base station is not enabled. It should be understood that if the user plane integrity protection is not enabled, there may be a risk of tampering with user plane data between the UE and the base station. In this case, if the man-in-the-middle exists, authenticity of the user plane data cannot be ensured. Therefore, the man-in-the-middle detection needs to be enabled.

[0115] Optionally, if a second preset rule is met, the base station sends indication information to the UE to indicate the UE to enable the man-in-the-middle detection. The second preset rule may be, for example, that a key performance indicator (key performance indicator, KPI) is greater than a second threshold.

[0116] S330: The UE sends the first physical frame query request message to the man-in-the-middle.

[0117] Specifically, the UE sends, in the physical frame p, the first physical frame query request message that is carried in the RRC message, to perform man-in-the-middle detection. Security protection is performed on the message, and therefore the message cannot be tampered with by the man-in-the-middle.

[0118] It should be understood that the first physical frame query request message may be an empty RRC message.

[0119] S340: The base station sends fourth DCI to the man-in-the-middle, where the fourth DCI is used to determine a physical frame q.

[0120] It should be understood that, before S340, the man-in-the-middle sends the BSR to the base station through false UE, to indicate the data volume of the uplink buffer, and then the base station sends the fourth DCI to the man-in-the-middle, where the fourth DCI is used to determine the physical frame q.

[0121] S350: The base station stores frame information of the physical frame q.

[0122] Optionally, after indicating the physical frame q to the man-in-the-middle by using the fourth DCI, the base station stores the frame information of the physical frame q.

[0123] S360: The man-in-the-middle sends the first physical frame query request message to the base station.

[0124] Specifically, the man-in-the-middle receives, in the physical frame p, the first physical frame query request message sent by the UE. Security protection is performed on the first physical frame query request message by using the AS security context established by the UE and the base station, and therefore the man-in-the-middle cannot tamper with the first physical frame query request message, and can only be transparently transmitted to the base station. Therefore, the man-in-the-middle sends, in the physical frame q indicated by the base station for the man-in-the-middle, the first physical frame query request message to the base station.

[0125] S370: The base station continues to store the frame information of the physical frame q.

[0126] Specifically, after receiving, in the physical frame q, the first physical frame query request message forwarded by the man-in-the-middle, the base station locally records the frame information of the physical frame q, where the frame information of the physical frame q includes a frame number and a subframe number of the physical frame q.

[0127] Optionally, when the first physical frame query request message includes specific indication information, for example, the first physical frame query request message is an RRC message for enabling the man-in-the-middle detection, or the first RRC message includes specific indication information (for example, an indication bit is carried in an existing measurement report, and the indication bit optionally indicates to enable the man-in-the-middle detection), the base station continues to retain the frame information of the physical frame q or restores the frame information of the physical frame q.

[0128] Optionally, the base station determines, based on the first RRC message, that a terminal enables the man-in-the-middle detection.

[0129] It should be understood that a feature that the base station continues to retain the frame information of the physical frame q may be applied to another embodiment in which information about a physical frame needs to be retained. This is not limited in this application.

[0130] Optionally, in an NR system, the frame information of the physical frame q may further include a slot number of the physical frame q. In the NR system, when a subframe includes a plurality of slots, the base station (or false base station) may indicate, to the UE by using DCI, the frame number, the subframe number, and the slot number of the physical frame q.

[0131] S380: The UE sends the second physical frame query request message to the man-in-the-middle.

[0132] Specifically, after sending, in the physical frame p, the first physical frame query request message to the man-in-the-middle, the UE sends the second physical frame query request message on which security protection is performed to the man-in-the-middle, where the second physical frame query request message includes the frame information of the physical frame p. It should be understood that, after determining to enable the man-in-the-middle detection, the UE includes the frame information of the physical frame p in the second physical frame query request message for the man-in-the-middle detection. It should be further understood that the second RRC message is sent to perform a man-in-the-middle detection procedure, so that the base station determines, based on the information about the physical frame carried in the second physical frame query request message, whether the man-in-the-middle exists.

[0133] It should be noted that, because the first physical frame query request message is an RRC layer message, when the message is encoded and constructed at an RRC layer, a physical frame in which the message is sent cannot be determined. After the first physical frame query request message is encoded, the first physical frame query request message enters a buffer queue. The UE reports the buffer status report to the base station. Then, the base station schedules the UE in a unified manner. After obtaining a resource, the UE uses the resource for message sending. There is a possibility of retransmission in message sending, and it cannot be ensured that current sending is definitely successful during sending. Therefore, the first physical frame query request message cannot carry the frame information of the physical frame p.

[0134] S390: The man-in-the-middle sends the second physical frame query request message to the base station.

[0135] Specifically, the man-in-the-middle receives the second physical frame query request message sent by the UE. However, because the second physical frame query request message is sent by the UE based on the AS security context, the man-in-the-middle cannot crack or tamper with the second physical frame query request message, and can only transparently transmit the second physical frame query request message to the base station.

[0136] S311: The base station determines whether the physical frame p matches the physical frame q.

[0137] Specifically, after receiving the second physical frame request message transparently transmitted by the man-in-the-middle, the base station extracts the frame number and the subframe number of the physical frame p that are carried in the second physical frame query request message, and compares the frame number and the subframe number with the frame number and the subframe number of the physical frame q that are locally recorded and stored. If the frame number of the physical frame p is the same as the frame number of the physical frame q and the subframe number of the physical frame p is the same as the subframe number of the physical frame q, it indicates that the physical frame p matches the physical frame q, and no man-in-the-middle exists between the UE and the base station. Otherwise, it indicates that the physical frame p does not match the physical frame q, and the man-in-the-middle exists between the UE and the base station.

[0138] Optionally, in the NR system, when a slot number of a physical frame is considered, the second physical frame query request message carries the frame number, the subframe number, and a slot number of the physical frame p, and compares the frame number, the subframe number, and the slot number with the frame number, the subframe number, and the slot number of the physical frame q that are locally recorded. When the frame number, the subframe number, and the slot number of the physical frame p are respectively the same as the frame number, the subframe number, and the slot number of the physical frame q, it indicates that the physical frame p matches the physical frame q, and no man-in-the-middle exists between the UE and the base station. Otherwise, it indicates that the physical frame p does not match the physical frame q, and the man-in-the-middle exists between the UE and the base station.

[0139] Optionally, after determining that the man-in-the-middle exists, the base station may issue a warning or take a preventive measure.

[0140] Therefore, according to the man-in-the-middle detection method in this embodiment of this application, man-in-the-middle detection is performed based on that a physical frame in which the man-in-the-middle sends an uplink message through the false UE cannot be consistent with a physical frame in which real UE sends the uplink message, to prevent the man-in-the-middle from bypassing detection through a mechanism of the man-in-the-middle and improve a man-in-the-middle detection rate.

[0141] FIG. 6 is a schematic flowchart of another man-in-the-middle detection method 400 according to an embodiment of this application. It can be learned from FIG. 6 that the method 400 includes the following steps.

[0142] S410: UE sends, in a third physical frame, a third RRC message to a base station.

[0143] S420: The UE receives a fourth RRC message sent by the base station, where the fourth RRC message includes frame information of a fourth physical frame.

[0144] S430: The UE determines whether the third physical frame matches the fourth physical frame.

[0145] S440: The UE sends a fifth RRC message to the base station, where the fifth RRC message indicates whether the third physical frame matches the fourth physical frame.

[0146] Specifically, after successfully establishing an AS security context with the base station, the UE sends, in the third physical frame, the third RRC message on which security protection is performed to the base station, where the third physical frame is a time domain resource specified by the base station (or false base station) for the UE. Security protection is performed on the third RRC message by using the access stratum AS security context established by the UE and the base station. Therefore, a man-in-the-middle cannot crack or tamper with the third RRC message. When a man-in-the-middle attack exists, air interface communication between the UE and the base station is intercepted by the man-in-the-middle. An air interface between the UE and the false base station and an air interface between false UE and the base station are independent of each other, that is, the base station cannot directly receive the third RRC message sent by the UE. The man-in-the-middle receives the third RRC message through the false base station, and forwards the third RRC message to the base station through the false UE. The base station receives, in the fourth physical frame, the third RRC message, and sends the fourth RRC message on which security protection is performed to the UE, where the fourth RRC message includes the frame information of the fourth physical frame. The UE receives the fourth RRC message, obtains the frame information of the fourth physical frame by using the fourth RRC message, and determines whether the third physical frame matches the fourth physical frame. After the man-in-the-middle attack occurs between the UE and the base station, a physical frame in which the UE sends an uplink message cannot be consistent with a physical frame in which the base station receives the uplink message. Therefore, when the third physical frame matches the fourth physical frame, the UE determines that no man-in-the-middle exists between the UE and the base station. When the third physical frame does not match the fourth physical frame, the UE determines that the man-in-the-middle exists between the UE and the base station. Then, the UE sends a fifth RRC message to the base station, where the fifth RRC message indicates whether the third physical frame matches the fourth physical frame.

[0147] Therefore, according to the man-in-the-middle detection method in embodiments of this application, whether the man-in-the-middle exists in the air interface communication is determined by determining whether the physical frame in which the UE sends the uplink message matches the physical frame in which the base station receives the uplink message, to prevent the man-in-the-middle from bypassing detection through a mechanism of the man-in-the-middle and improve a man-in-the-middle detection rate.

[0148] FIG. 7 shows a schematic flowchart of a man-in-the-middle detection method 500 according to an embodiment of this application when a man-in-the-middle attack exists between UE and a base station. It can be learned from FIG. 7 that the method 500 includes the following steps.

[0149] S510: The UE establishes an AS security context with the base station.

[0150] Specifically, the UE accesses the base station, that is, the UE establishes an indirect connection to the base station through the man-in-the-middle, and then the UE establishes the access stratum AS security context with the base station. It should be understood that, after the UE establishes the AS security context with the base station, security protection is performed on all RRC messages, and the man-in-the-middle cannot tamper with the RRC message sent between the UE and the base station.

[0151] S520: The man-in-the-middle sends fifth DCI to the UE, where the fifth DCI is used to determine a physical frame in which the UE sends an RRC message.

[0152] It should be understood that, before S520, the UE sends a buffer status report (buffer status report, BSR) to the man-in-the-middle to indicate a data volume of an uplink buffer, and then the man-in-the-middle sends the fifth DCI to the UE to allocate an appropriate available resource to the UE. The UE determines a physical frame e based on the fifth DCI.

[0153] Optionally, the UE locally records frame information of the physical frame e, where the frame information of the physical frame e includes a frame number and a subframe number of the physical frame e.

[0154] It should be understood that, before step S520, if a first preset rule is met, the UE enables man-in-the-middle detection. The enabling man-in-the-middle detection means that the UE performs the method mentioned in this application. For example, the enabling man-in-the-middle may include: The UE sends a physical frame query request message and stores the frame information of the physical frame e.

[0155] The first preset rule includes: The UE receives indication information from the base station, where the indication information indicates the UE to enable man-in-the-middle detection; or the UE determines that user plane integrity protection between the UE and the base station is not enabled.

[0156] Optionally, if a second preset rule is met, the base station sends indication information to the UE to indicate the UE to enable the man-in-the-middle detection. The second preset rule may be, for example, that a key performance indicator (key performance indicator, KPI) is greater than a second threshold.

[0157] S530: The UE sends the physical frame query request message to the man-in-the-middle.

[0158] Specifically, the UE sends, in the physical frame e, the physical frame query request message that is carried in the RRC message, to perform man-in-the-middle detection. Security protection is performed on the message by using the access stratum AS security context established between the UE and the base station, and therefore the message cannot be tampered with by the man-in-the-middle.

[0159] It should be understood that the physical frame query request message may be an empty RRC message.

[0160] S540: The base station sends sixth DCI to the man-in-the-middle, where the sixth DCI is used to determine a physical frame for the man-in-the-middle to perform RRC communication.

[0161] Optionally, before S540, the man-in-the-middle sends the buffer status report (buffer status report, BSR) to the base station to indicate the data volume of an uplink buffer. Then, the man-in-the-middle sends the fifth DCI to the UE to allocate an appropriate available resource to the UE. The UE determines a physical frame f based on the sixth DCI.

[0162] S550: The man-in-the-middle sends the physical frame query request message to the base station.

[0163] Specifically, in S530, the man-in-the-middle receives the physical frame query request message sent by the UE. Because security protection is performed on the message, the man-in-the-middle cannot tamper with the message. Therefore, the man-in-the-middle forwards, in the physical frame f indicated by the base station to the man-in-the-middle, the physical frame query request message to the base station.

[0164] S560: The base station sends a physical frame query response message to the man-in-the-middle.

[0165] Specifically, after receiving, in the physical frame f, the physical frame query request message transparently transmitted by the man-in-the-middle, the base station sends the physical frame query response message on which security protection is performed to the false UE. The physical frame query response message carries frame information of the physical frame f, where the frame information of the physical frame f includes a frame number and a subframe number of the physical frame f.

[0166] S570: The man-in-the-middle sends the physical frame query response message to the UE.

[0167] Specifically, after receiving the physical frame query response message sent by the base station, the man-in-the-middle forwards the physical frame query response message to the UE through the false base station.

[0168] S580: The UE determines whether the physical frame e matches the physical frame f.

[0169] Specifically, after receiving the physical frame query response message sent by the false base station, the UE may extract the frame number and the subframe number of the physical frame f that are carried in the physical frame query response message, and compare the frame number and the subframe number with the frame number and the subframe number of the physical frame e that are locally recorded and stored when the physical frame query request message is successfully sent. If the frame number of the physical frame e is the same as the frame number of the physical frame f and the subframe number of the physical frame e is the same as the subframe number of the physical frame f, it indicates that the physical frame e matches the physical frame f, and no man-in-the-middle exists between the UE and the base station. Otherwise, it indicates that the physical frame e does not match the physical frame f, and the man-in-the-middle exists between the UE and the base station.

[0170] S590: The UE sends a physical frame query indication message to the base station.

[0171] Specifically, after determining whether the physical frame e matches the physical frame f, the UE sends the physical frame query indication message on which security protection is performed to the base station, and the physical frame query indication message is received by the base station after being transparently transmitted by the man-in-the-middle. The physical frame query indication message includes a determining result, where the determining result indicates whether the physical frame e matches the physical frame f. After determining, based on the physical frame query indication message, that the man-in-the-middle exists, the base station may issue a warning or take a preventive measure.

[0172] Therefore, according to the man-in-the-middle detection method in this embodiment of this application, man-in-the-middle detection is performed based on that a physical frame in which the man-in-the-middle sends an uplink message through the false UE cannot be consistent with a physical frame in which real UE sends the uplink message, to prevent the man-in-the-middle from bypassing detection through a mechanism of the man-in-the-middle and improve a man-in-the-middle detection rate.

[0173] The methods provided in embodiments of this application are described above in detail with reference to FIG. 3 to FIG. 7. The following describes in detail communication apparatuses provided in embodiments of this application with reference to FIG. 8 and FIG. 12.

[0174] FIG. 8 is a schematic block diagram of a communication apparatus according to an embodiment of this application. As shown in the figure, the communication apparatus 10 may include a transceiver module 11 and a processing module 12.

[0175] In a possible design, the communication apparatus 10 may correspond to the base station in the foregoing method embodiments.

[0176] Specifically, the communication apparatus 10 may correspond to the user equipment in the method 100, the method 200, and the method 300 according to embodiments of this application. The communication apparatus 10 may include a module configured to perform a method performed by the base station in the method 100 in FIG. 3, the method 200 in FIG. 4, or the method 300 in FIG. 5. In addition, units in the communication apparatus 10 and the foregoing other operations and / or functions are separately intended to implement corresponding procedures of the method 100 in FIG. 3, the method 200 in FIG. 4, or the method 300 in FIG. 5.

[0177] When the communication apparatus 10 is configured to perform the method 100 in FIG. 3, the transceiver module 11 may be configured to perform step S110 and step S120 in the method 100, and the processing module 12 may be configured to perform step S130 in the method 100.

[0178] When the communication apparatus 10 is configured to perform the method 200 in FIG. 4, the transceiver module 11 may be configured to perform step S240, step S250, and step S260 in the method 200.

[0179] When the communication apparatus 10 is configured to perform the method 300 in FIG. 5, the transceiver module 11 may be configured to perform step S340, step S350, and step S380 in the method 300, and the processing module 12 may be configured to perform step S360 and S390 in the method 300.

[0180] Specifically, the transceiver module 11 is configured to receive, in a first physical frame, a first radio resource control RRC message from user equipment UE. The transceiver module is further configured to receive a second RRC message from the UE, where the second RRC message includes frame information of a second physical frame, and security protection is performed on the first RRC message and the second RRC message by using an access stratum AS security context established by the UE and a base station. The processing module is configured to determine whether the first physical frame matches the second physical frame.

[0181] Optionally, the processing module 12 may be specifically configured to: if a frame number of the first physical frame is the same as a frame number of the second physical frame and a subframe number of the first physical frame is the same as a subframe number of the second physical frame, determine, by the base station, that the first physical frame matches the second physical frame; otherwise, determine, by the base station, that the first physical frame does not match the second physical frame.

[0182] Optionally, the processing module 12 is further configured to store frame information of a third physical frame.

[0183] Optionally, the processing module 12 is further configured to establish the AS security context with the UE.

[0184] Optionally, the transceiver module 11 is further configured to send indication information to the UE, where the indication information indicates the UE to send a fourth RRC message to the base station.

[0185] FIG. 9 is a schematic block diagram of a communication apparatus according to an embodiment of this application. As shown in the figure, the communication apparatus 20 may include a transceiver module 21 and a processing module 22.

[0186] In a possible design, the communication apparatus 20 may correspond to the user equipment UE in the foregoing method embodiments or a chip disposed in the UE.

[0187] Specifically, the communication apparatus 20 may correspond to the base station in the method 100, the method 200, and the method 300 according to embodiments of this application. The communication apparatus 20 may include a module configured to perform a method performed by the user equipment in the method 100 in FIG. 3, the method 200 in FIG. 4, or the method 300 in FIG. 5. In addition, units in the communication apparatus 20 and the foregoing other operations and / or functions are separately intended to implement corresponding procedures of the method 100 in FIG. 3, the method 200 in FIG. 4, or the method 300 in FIG. 5.

[0188] When the communication apparatus 20 is configured to perform the method 100 in FIG. 3, the transceiver module 11 may be configured to perform step S110 and step S120 in the method 100.

[0189] When the communication apparatus 20 is configured to perform the method 200 in FIG. 4, the transceiver module 11 may be configured to perform step S210, step S220, and step S230 in the method 200.

[0190] When the communication apparatus 20 is configured to perform the method 300 in FIG. 5, the transceiver module 11 may be configured to perform step S320, step S330, and step S370 in the method 300.

[0191] Specifically, the transceiver module 21 is configured to send, in a second physical frame, a first radio resource control RRC message to a base station. The transceiver module is further configured to send a second RRC message to the base station, where the second RRC message includes frame information of the second physical frame, and security protection is performed on the first RRC message and the second RRC message by using an access stratum AS security context established by UE and the base station.

[0192] Optionally, the transceiver module 21 is further configured to receive downlink control information DCI, where the DCI is used to determine the frame information of the second physical frame.

[0193] Optionally, the processing module 22 is configured to store the frame information of the second physical frame.

[0194] Optionally, the processing module 22 is further configured to access the base station and establish the AS security context with the base station.

[0195] Optionally, the transceiver module 21 is specifically configured to: if a preset rule is met, send, by the UE in the second physical frame, the first RRC message to the base station.

[0196] Optionally, the processing module 22 is further configured to receive indication information sent by the base station, where the indication information indicates the UE to enable man-in-the-middle detection, or determine that user plane integrity protection the base station is not enabled.

[0197] FIG. 10 is a schematic block diagram of a communication apparatus according to an embodiment of this application. As shown in the figure, the communication apparatus 30 may include a transceiver module 31 and a processing module 32.

[0198] In a possible design, the communication apparatus 30 may correspond to the user equipment UE in the foregoing method embodiments.

[0199] Specifically, the communication apparatus 30 may correspond to the base station in the method 400 and the method 500 according to embodiments of this application. The communication apparatus 30 may include a module configured to perform a method performed by the UE in the method 400 in FIG. 6 or the method 500 in FIG. 7. In addition, units in the communication apparatus 30 and the foregoing other operations and / or functions are separately intended to implement corresponding procedures of the method 400 in FIG. 6 or the method 500 in FIG. 7.

[0200] When the communication apparatus 30 is configured to perform the method 400 in FIG. 6, the transceiver module 41 may be configured to perform step S410 and step S420 in the method 400, and the processing module 42 may be configured to perform step S430 in the method 400.

[0201] When the communication apparatus 30 is configured to perform the method 500 in FIG. 7, the transceiver module 41 may be configured to perform step S520, step S530, step S570, step S590 in the method 500, and the processing module 42 may be configured to perform step S580 in the method 500.

[0202] Specifically, the transceiver module 31 is configured to send, in a third physical frame, a third radio resource control RRC message to a base station. The transceiver module is further configured to receive a fourth RRC message from the base station, where the fourth RRC message includes frame information of a fourth physical frame. The transceiver module is further configured to send a fifth RRC message to the base station, where the fifth RRC message indicates whether the third physical frame matches the fourth physical frame, and security protection is performed on the third RRC message, the fourth RRC message, and the fifth RRC message by using an access stratum AS security context established by UE and the base station.

[0203] Optionally, the processing module 32 may be specifically configured to: if a frame number of the third physical frame is the same as a frame number of the fourth physical frame and a subframe number of the third physical frame is the same as a subframe number of the fourth physical frame, determine, by the UE, that the third physical frame matches the fourth physical frame; otherwise, determine, by the UE, that the third physical frame does not match the fourth physical frame.

[0204] Optionally, the transceiver module 31 is further configured to receive downlink control information DCI, where the DCI is used to determine frame information of the third physical frame, and the frame information of the third physical frame includes the frame number and the subframe number of the third physical frame.

[0205] Optionally, the processing module 32 is further configured to store the frame information of the third physical frame.

[0206] Optionally, the processing module 32 is further configured to access the base station and establish the AS security context with the base station.

[0207] FIG. 11 is a schematic block diagram of a communication apparatus according to an embodiment of this application. As shown in the figure, the communication apparatus 30 may include a transceiver module 41 and a processing module 42.

[0208] In a possible design, the communication apparatus 40 may correspond to the base station in the foregoing method embodiments.

[0209] Specifically, the communication apparatus 40 may correspond to the base station in the method 400 and the method 500 according to embodiments of this application. The communication apparatus 40 may include a module configured to perform a method performed by the base station in the method 400 in FIG. 6 or the method 500 in FIG. 7. In addition, units in the communication apparatus 30 and the foregoing other operations and / or functions are separately intended to implement corresponding procedures of the method 400 in FIG. 6 or the method 500 in FIG. 7.

[0210] When the communication apparatus 40 is configured to perform the method 400 in FIG. 6, the transceiver module 41 may be configured to perform step S410, step S420, and step S440 in the method 400.

[0211] When the communication apparatus 40 is configured to perform the method 500 in FIG. 7, the transceiver module 41 may be configured to perform step S540, step S550, step S560, step S590 in the method 500, and the processing module 42 may be configured to perform step S510 in the method 500.

[0212] Specifically, the transceiver module 41 is configured to receive, in a fourth physical frame, a third RRC message from user equipment UE. The transceiver module is further configured to send a fourth RRC message to the UE, where the fourth RRC message includes frame information of the fourth physical frame. The transceiver module is further configured to receive a fifth RRC message sent by the UE. The processing module is configured to determine, based on the fifth RRC message, whether a man-in-the-middle exists between a base station and the UE.

[0213] Optionally, the processing module 42 may be specifically configured to: if a third physical frame does not match the fourth physical frame, determine that the man-in-the-middle exists between the base station and the UE; or if the third physical frame matches the fourth physical frame, determine that no man-in-the-middle exists between the base station and the UE.

[0214] Optionally, the processing module 42 is further configured to establish an AS security context with the UE.

[0215] Optionally, the transceiver module 41 is further configured to send indication information to the UE, where the indication information indicates the UE to enable man-in-the-middle detection.

[0216] According to the foregoing methods, FIG. 12 is a schematic diagram of a communication apparatus 50 according to an embodiment of this application. As shown in FIG. 12, the apparatus 50 may be a device that needs to detect a man-in-the-middle and includes various handheld devices, in-vehicle devices, wearable devices, calculating devices that have a wireless communication function, or other processing devices connected to a wireless modem, and various forms of terminals, mobile stations (Mobile Stations, MSs), terminals (Terminals), user equipments UEs, soft terminals, and the like.

[0217] The apparatus 50 may include a processor 51 (that is, an example of a processing module) and a memory 52. The memory 52 is configured to store instructions. The processor 51 is configured to execute the instructions stored in the memory 52, to enable the apparatus 30 to implement a step performed by a network registration device in the method corresponding to FIG. 3, FIG. 4, FIG. 5, FIG. 6, or FIG. 7.

[0218] Further, the apparatus 50 may further include an input port 53 (that is, an example of a transceiver module) and an output port 54 (that is, another example of a transceiver module). Further, the processor 51, the memory 52, the input port 53, and the output port 54 may communicate with each other through an internal connection path, to transmit a control signal and / or a data signal. The memory 32 is configured to store a computer program. The processor 51 may be configured to invoke the computer program from the memory 52 and run the computer program, to control the input port 53 to receive a signal, and control the output port 54 to send a signal, so as to complete a step performed by the terminal device in the foregoing methods. The memory 52 may be integrated into the processor 51, or may be disposed separately from the processor 51.

[0219] Optionally, if the communication apparatus 50 is a communication device, the input port 53 is a receiver, and the output port 54 is a transmitter. The receiver and the transmitter may be a same physical entity or different physical entities. When the receiver and the transmitter are a same physical entity, the receiver and the transmitter may be collectively referred to as a transceiver.

[0220] Optionally, if the communication apparatus 50 is a chip or a circuit, the input port 53 is an input interface, and the output port 54 is an output interface.

[0221] In an implementation, it may be considered that functions of the input port 53 and the output port 54 are implemented by using a transceiver circuit or a dedicated transceiver chip. It may be considered that the processor 51 is implemented by using a dedicated processing chip, a processing circuit, a processor, or a general-purpose chip.

[0222] In another implementation, it may be considered that the communication device provided in this embodiment of this application is implemented by using a general-purpose computer. To be specific, program code for implementing functions of the processor 51, the input port 53, and the output port 54 is stored in the memory 52. The general-purpose processor implements the functions of the processor 51, the input port 53, and the output port 54 by executing the code in the memory 52.

[0223] Modules or units in the communication apparatus 50 may be configured to perform actions or processing processes performed by a device (for example, user equipment) for man-in-the-middle detection in the foregoing methods. To avoid repetition, detailed descriptions thereof are omitted herein.

[0224] For concepts, explanations, detailed descriptions, and other steps of the apparatus 50 that are related to the technical solutions provided in embodiments of this application, refer to the descriptions related to the content in the foregoing methods or another embodiment. Details are not described herein again.

[0225] According to the foregoing methods, FIG. 13 is a schematic diagram of a communication apparatus 60 according to an embodiment of this application. As shown in FIG. 10, the apparatus 60 may be a man-in-the-middle detection device, and includes a network element having an access management function, for example, an AMF.

[0226] The apparatus 60 may include a processor 61 (that is, an example of a processing module) and a memory 62. The memory 62 is configured to store instructions. The processor 61 is configured to execute the instructions stored in the memory 62, to enable the apparatus 60 to implement a step performed by a device for man-in-the-middle detection in the method corresponding to FIG. 3, FIG. 4, FIG. 5, FIG. 6, or FIG. 7.

[0227] Further, the apparatus 60 may further include an input port 63 (that is, an example of a transceiver module) and an output port 64 (that is, another example of a transceiver module). Further, the processor 61, the memory 62, the input port 63, and the output port 64 may communicate with each other through an internal connection path, to transmit a control signal and / or a data signal. The memory 62 is configured to store a computer program. The processor 61 may be configured to invoke the computer program from the memory 62 and run the computer program, to control the input port 63 to receive a signal, and control the output port 64 to send a signal, so as to complete a step performed by the terminal device in the foregoing methods. The memory 62 may be integrated into the processor 61, or may be disposed separately from the processor 61.

[0228] Optionally, if the communication apparatus 60 is a communication device, the input port 63 is a receiver, and the output port 64 is a transmitter. The receiver and the transmitter may be a same physical entity or different physical entities. When the receiver and the transmitter are the same physical entity, the receiver and the transmitter may be collectively referred to as a transceiver.

[0229] Optionally, if the communication apparatus 60 is a chip or a circuit, the input port 63 is an input interface, and the output port 44 is an output interface.

[0230] In an implementation, it may be considered that functions of the input port 63 and the output port 64 are implemented by using a transceiver circuit or a dedicated transceiver chip. It may be considered that the processor 61 is implemented by using a dedicated processing chip, a processing circuit, a processor, or a general-purpose chip.

[0231] In another implementation, it may be considered that the communication device provided in this embodiment of this application is implemented by using a general-purpose computer. To be specific, program code for implementing functions of the processor 61, the input port 63, and the output port 64 is stored in the memory 62. The general-purpose processor implements the functions of the processor 61, the input port 63, and the output port 64 by executing the code in the memory 62.

[0232] Modules or units in the communication apparatus 60 may be configured to perform actions or processing processes performed by a network-side device (that is, a network device) during network registration in the foregoing methods. To avoid repetition, detailed descriptions thereof are omitted herein.

[0233] For concepts, explanations, detailed descriptions, and other steps of the apparatus 60 that are related to the technical solutions provided in embodiments of this application, refer to the descriptions related to the content in the foregoing methods or another embodiment. Details are not described herein again.

[0234] FIG. 14 is a schematic diagram of a structure of a terminal device 500 according to this application. For ease of description, FIG. 14 shows only main components of the terminal device. As shown in FIG. 14, the terminal device 500 includes a processor, a memory, a control circuit, an antenna, and an input / output apparatus.

[0235] The processor is mainly configured to process a communication protocol and communication data, control the entire terminal device, execute a software program, and process data of the software program, for example, is configured to support the terminal device in performing actions described in the foregoing embodiments of an indication method for transmitting a precoding matrix. The memory is mainly configured to store a software program and data, for example, store a codebook described in the foregoing embodiments. The control circuit is mainly configured to convert a baseband signal and a radio frequency signal, and process the radio frequency signal. The control circuit and the antenna together may also be referred to as a transceiver, and are mainly configured to receive and send a radio frequency signal in a form of an electromagnetic wave. The input / output apparatus, such as a touchscreen, a display, or a keyboard, is mainly configured to receive data entered by a user and output data to the user.

[0236] After the terminal device is powered on, the processor may read a software program in a storage unit, interpret and execute instructions of the software program, and process data of the software program. When data needs to be sent wirelessly, the processor performs baseband processing on to-be-sent data, and then outputs a baseband signal to a radio frequency circuit. The radio frequency circuit performs radio frequency processing on the baseband signal, and then sends, through the antenna, a radio frequency signal in a form of an electromagnetic wave. When data is sent to the terminal device, the radio frequency circuit receives the radio frequency signal through the antenna, converts the radio frequency signal into a baseband signal, and outputs the baseband signal to the processor. The processor converts the baseband signal into data, and processes the data.

[0237] A person skilled in the art may understand that, for ease of description, FIG. 14 shows only one memory and only one processor. In an actual terminal device, there may be a plurality of processors and memories. The memory may also be referred to as a storage medium, a storage device, or the like. This is not limited in embodiments of this application.

[0238] In an optional implementation, the processor may include a baseband processor and a central processing unit. The baseband processor is mainly configured to process a communication protocol and communication data. The central processing unit is mainly configured to control the entire terminal device, execute a software program, and process data of the software program. The processor in FIG. 14 integrates functions of the baseband processor and the central processing unit. A person skilled in the art may understand that the baseband processor and the central processing unit may alternatively be separate processors, and are interconnected by using a technology such as a bus. A person skilled in the art may understand that the terminal device may include a plurality of baseband processors to adapt to different network standards. The terminal device may include a plurality of central processing units to enhance a processing capability of the terminal device. Components of the terminal device may be connected through various buses. The baseband processor may alternatively be expressed as a baseband processing circuit or a baseband processing chip. The central processing unit may alternatively be expressed as a central processing circuit or a central processing chip. A function of processing a communication protocol and communication data may be built in the processor, or may be stored in the storage unit in a form of a software program, and the processor executes the software program to implement a baseband processing function.

[0239] As shown in FIG. 14, the terminal device 700 includes a transceiver unit 710 and a processing unit 720. The transceiver unit may also be referred to as a transceiver, a transceiver machine, a transceiver apparatus, or the like. Optionally, a component that is in the transceiver unit 710 and that is configured to implement a receiving function may be considered as a receiving unit, and a component that is in the transceiver unit 710 and that is configured to implement a sending function may be considered as a sending unit. In other words, the transceiver unit 510 includes a receiving unit and a sending unit. For example, the receiving unit may also be referred to as a receiver, a receive machine, or a receiving circuit, and the sending unit may also be referred to as a transmitter, a transmit machine, or a transmitting circuit.

[0240] The terminal device shown in FIG. 14 may perform actions performed by the user equipment in the foregoing method 100, 200, 300, 400, or 500. To avoid repetition, detailed descriptions thereof are omitted herein.

[0241] It should be understood that, in embodiments of this application, the processor may be a central processing unit (central processing unit, CPU), or may be another general-purpose processor, a digital signal processor (digital signal processor, DSP), an application-specific integrated circuit (application-specific integrated circuit, ASIC), a field programmable gate array (field programmable gate array, FPGA), or another programmable logic device, discrete gate, transistor logic device, discrete hardware component, or the like. The general-purpose processor may be a microprocessor, or the processor may be any conventional processor or the like.

[0242] It should be further understood that the memory in embodiments of this application may be a volatile memory or a nonvolatile memory, or may include a volatile memory and a nonvolatile memory. The nonvolatile memory may be a read-only memory (Read-only Memory, ROM), a programmable read-only memory (Programmable ROM, PROM), an erasable programmable read-only memory (Erasable PROM, EPROM), an electrically erasable programmable read-only memory (Electrically EPROM, EEPROM), or a flash memory. The volatile memory may be a random access memory (Random access memory, RAM), used as an external cache. By way of example, and not limitation, random access memories (Random access memories, RAMs) in many forms may be available, for example, a static random-access memory (Static RAM, SRAM), a dynamic random-access memory (DRAM), a synchronous dynamic random access memory (Synchronous DRAM, SDRAM), a double data rate synchronous dynamic random access memory (Double data rate SDRAM, DDR SDRAM), an enhanced synchronous dynamic random access memory (Enhanced SDRAM, ESDRAM), a synchlink dynamic random access memory (Synchlink DRAM, SLDRAM), and a direct rambus random access memory (Direct rambus RAM, DR RAM).

[0243] All or some of the foregoing embodiments may be implemented by software, hardware, firmware, or any combination thereof. When the software is used to implement the embodiments, the foregoing embodiments may be implemented completely or partially in a form of a computer program product. The computer program product includes one or more computer instructions or computer programs. When the program instructions or the computer programs are loaded or executed on a computer, procedures or functions according to embodiments of this application are all or partially generated. The computer may be a general-purpose computer, a dedicated computer, a computer network, or another programmable apparatus. The computer instructions may be stored in a computer-readable storage medium or may be transmitted from a computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from a website, computer, server, or data center to another website, computer, server, or data center in a wired (for example, infrared, radio, or microwave) manner. The computer-readable storage medium may be any usable medium accessible by a computer, or a data storage device, such as a server or a data center, integrating one or more usable media. The usable medium may be a magnetic medium (for example, a floppy disk, a hard disk, or a magnetic tape), an optical medium (for example, a DVD), or a semiconductor medium. The semiconductor medium may be a solid-state drive.

[0244] It should be understood that the term "and / or" in this specification describes only an association relationship between associated objects and represents that three relationships may exist. For example, A and / or B may represent the following three cases: Only A exists, both A and B exist, and only B exists. In addition, the character " / " in this specification generally represents an "or" relationship between associated objects.

[0245] It should be understood that sequence numbers of the foregoing processes do not mean execution sequences in various embodiments of this application. The execution sequences of the processes should be determined based on functions and internal logic of the processes. This should not be construed as any limitation on the implementation processes of embodiments of this application.

[0246] A person of ordinary skill in the art may be aware that, in combination with the examples described in embodiments disclosed in this specification, units and algorithm steps may be implemented by electronic hardware or a combination of computer software and electronic hardware. Whether the functions are performed by hardware or software depends on particular applications and design constraint conditions of the technical solutions. A person skilled in the art may use different methods to implement the described functions for each particular application, but it should not be considered that the implementation goes beyond the scope of this application. It may be clearly understood by a person skilled in the art that, for the purpose of convenient and brief description, for a detailed working process of the foregoing system, apparatus, and unit, refer to a corresponding process in the foregoing method embodiments. Details are not described herein again. In the several embodiments provided in this application, it should be understood that the disclosed system, apparatus, and method may be implemented in other manners. For example, the described apparatus embodiment is merely an example. For example, division into the units is merely a logical function division and may be another division during actual implementation. For example, a plurality of units or components may be combined or integrated into another system, or some features may be ignored or not performed. In addition, a displayed or discussed mutual coupling or direct coupling or communication connection may be implemented through some interfaces. An indirect coupling or communication connection between apparatuses or units may be implemented in electronic, mechanical, or other forms.

[0247] The units described as separate components may or may not be physically separate, and components displayed as units may or may not be physical units, that is, may be located at one position, or may be distributed on a plurality of network units. Some or all of the units may be selected based on an actual requirement to achieve an objective of the solutions of the embodiments. In addition, functional units in embodiments of this application may be integrated into one processing unit, each of the units may exist alone physically, or two or more units are integrated into one unit. If the functions are implemented in a form of a software functional unit and sold or used as an independent product, the functions may be stored in a computer-readable storage medium. Based on such an understanding, the technical solutions of this application essentially, or a part contributing to the conventional technology, or some of the technical solutions may be embodied in a form of a software product. The computer software product is stored in a storage medium, and includes several instructions for enabling a computer device (which may be a personal computer, a server, a network device, or the like) to perform all or some of the steps of the methods described in embodiments of this application. The foregoing storage medium includes any medium that can store a program code, such as a USB flash drive, a removable hard disk, a read-only memory (Read-Only Memory, ROM), a random access memory (Random Access Memory, RAM), a magnetic disk, or an optical disc.

[0248] The foregoing descriptions are merely specific implementations of this application, but are not intended to limit the protection scope of this application. Any variation or replacement readily figured out by a person skilled in the art within the technical scope disclosed in this application shall fall within the protection scope of this application. Therefore, the protection scope of this application shall be subject to the protection scope of the claims.

Claims

1. A man-in-the-middle detection method, comprising: receiving (S110), by a communication apparatus in a first physical frame, a first radio resource control RRC message from user equipment UE; receiving (S120), by the communication apparatus, a second RRC message from the UE, wherein the second RRC message comprises frame information of a second physical frame, and security protection is performed on the first RRC message and the second RRC message by using an access stratum AS security context established by the UE and the communication apparatus, wherein the security protection comprises RRC confidentiality protection; determining (S130), by the communication apparatus, whether the first physical frame matches the second physical frame, the determining step comprising; when the first physical frame matches the second physical frame, determining that no man-in-the-middle exists in the air interface between the UE and the communication apparatus; and when the first physical frame does not match the second physical frame, determining that a man-in-the-middle exists in the air interface between the UE and the communication apparatus; wherein the receiving, by a communication apparatus in a first physical frame, a first radio resource control RRC message from user equipment UE comprises: if a preset rule is met, receiving, by the communication apparatus in the first physical frame, the first RRC message from the UE, wherein the preset rule comprises the communication apparatus determining that user plane integrity protection between the communication apparatus and the UE is not enabled.

2. The method according to claim 1, wherein the frame information of the second physical frame comprises a frame number and a subframe number of the second physical frame.

3. The method according to claim 2, wherein the determining, by the communication apparatus, whether the first physical frame matches the second physical frame comprises: if a frame number of the first physical frame is the same as the frame number of the second physical frame and a subframe number of the first physical frame is the same as the subframe number of the second physical frame, determining, by the communication apparatus, that the first physical frame matches the second physical frame; otherwise, determining, by the communication apparatus, that the first physical frame does not match the second physical frame.

4. The method according to any one of claims 1 to 3, wherein after the receiving, by a communication apparatus in a first physical frame, a first radio resource control RRC message from UE, the method further comprises: storing, by the communication apparatus, frame information of the first physical frame.

5. The method according to any one of claims 1 to 4, wherein before the receiving, by a communication apparatus in a first physical frame, a first radio resource control RRC message from UE, the method further comprises: establishing (S310), by the communication apparatus, the AS security context with the UE.

6. The method according to any one of claims 1 to 5, wherein before the receiving, by a communication apparatus in a first physical frame, a first RRC message from UE, the method further comprises: sending, by the communication apparatus, indication information to the UE, wherein the indication information indicates the UE to enable man-in-the-middle detection.

7. A man-in-the-middle detection method, comprising: sending (S260), by a communication apparatus in a second physical frame, a first radio resource control RRC message to a base station, wherein the first RRC message comprises frame information of a first physical frame in which the first RRC message was received by the communication apparatus; sending, by the communication apparatus, a second RRC message to the base station, wherein the second RRC message comprises frame information of the second physical frame, and security protection is performed on the first RRC message and the second RRC message by using an access stratum AS security context established by the communication apparatus and the base station, wherein the security protection comprises RRC confidentiality protection; when the first physical frame matches the second physical frame, determining that no man-in-the-middle exists in the air interface between the base station and the communication apparatus; and when the first physical frame does not match the second physical frame, determining that a man-in-the-middle exists in the air interface between the base station and the communication apparatus; wherein the sending, by a communication apparatus in a second physical frame, a first radio resource control RRC message to a base station comprises: if a preset rule is met, sending, by the communication apparatus in the second physical frame, the first RRC message to the base station, wherein the preset rule comprises the communication apparatus determining that user plane integrity protection between the communication apparatus and the base station is not enabled.

8. The method according to claim 7, wherein the frame information of the second physical frame comprises a frame number and a subframe number of the second physical frame.

9. The method according to claim 7 or 8, wherein before the sending, by a user equipment communication apparatus in a second physical frame, a first radio resource control RRC message to a base station, the method further comprises: receiving (S250), by the communication apparatus, downlink control information DCI, wherein the DCI is used to determine the frame information of the second physical frame; and storing, by the communication apparatus, the frame information of the second physical frame.

10. The method according to any one of claims 7 to 9, wherein before the sending, by a user equipment communication apparatus in a second physical frame, a first radio resource control RRC message to a base station, the method further comprises: accessing, by the communication apparatus, the base station, and establishing (S310) the AS security context with the base station.

11. A man-in-the-middle detection apparatus, comprising: means for performing the method according to any one of claims 1 to 6, or performing the method according to any one of claims 7 to 10.

12. A computer-readable storage medium, wherein the computer-readable storage medium stores a computer program; and when the computer program is run on a computer, the computer is enabled to perform the man-in-the-middle detection method according to any one of claims 1 to 6, or perform the man-in-the-middle detection method according to any one of claims 7 to 10.

13. A chip system (50, 60), comprising: a processor (51, 61), configured to invoke a computer program from a memory (52, 62) and run the computer program, to enable a communication device installed with the chip system to perform the man-in-the-middle detection method according to any one of claims 1 to 6, or perform the man-in-the-middle detection method according to any one of claims 7 to 10.