Communication method and device

Abstract

To provide a communication method and a device that determine a message authentication code (MAC) length that meets requirements in order to improve the flexibility of MAC length selection in short-range communications such as cockpit domain communications.SOLUTION: In communication between a first node and a second node, the first node receives an association request message including information on a security algorithm supported by the second node, determines a signaling plane target security algorithm and a signaling plane target MAC length belonging to a set of security algorithms indicated by the information on the security algorithm according to a first algorithm selection policy, and generates a first MAC, which is the signaling plane target MAC length, by using the signaling plane target security algorithm.SELECTED DRAWING: Figure 3

Description

[Technical field]

[0001] The present invention relates to the field of communication technologies, in particular to the field of short-range communication technologies such as cockpit domain communication. In particular, the present invention relates to a communication method and device. [Background technology]

[0002] With the rapid development of informatization, communication technology has penetrated into people's lives. While people enjoy the convenience of communication, they also face the threat of security vulnerability and privacy leakage. In order to ensure data transmission and storage security in the communication process, integrity protection (or integrity protection for short) needs to be performed on the data. In particular, the integrity protection on the data may be performed in a manner of calculating a message authentication code (MAC) according to an integrity protection algorithm. A message authentication code (MAC) is a small segment of information generated by using a specific algorithm and is used to check the message integrity.

[0003] The message authentication code generated by using the integrity protection algorithm has multiple lengths. However, in the communication process, usually only a fixed-length message authentication code can be used for communication. For example, the MAC length supported by LTE and the 5th generation (5G) communication protocol is 32 bits. In the Wi-Fi WPA2 / WPA3 protocol, if the TKIP, CCMP-128, or GCMP-128 algorithm is used, the MAC length is 64 bits; if the CCMP-256 / GCMP-256 algorithm is used, the MAC length is 128 bits. In the Bluetooth protocol, if the AES-CCM algorithm is used, the MAC length is 32 bits.

[0004] With the development of communication technology, more and more messages are communicated between nodes, and different nodes have different requirements for MAC length. For example, if a relatively long fixed-length MAC (e.g., 256-bit or 128-bit MAC) is used, the MAC occupies a relatively large proportion in the message, so that the message transmission efficiency is greatly affected. As another example, the security of different MAC lengths is different, and a longer MAC length indicates higher security, and if a relatively short MAC is used, data security cannot be ensured. As a result, in the existing communication process, the fixed-length MAC cannot meet the requirements.

[0005] It can be seen that how to determine a MAC length that satisfies the requirements is a technical subject that is being studied by those skilled in the art. Summary of the Invention

[0006] In order to improve the flexibility of selecting the MAC length, the embodiments of the present application disclose a communication method and apparatus to determine a MAC length that meets the requirements.

[0007] According to a first aspect, an embodiment of the present application provides a communication method, the method comprising: receiving an association request message from a second node, wherein the association request message includes information about security algorithms supported by the second node; determining a target security algorithm for a signaling plane and a target MAC length for the signaling plane according to a first algorithm selection policy, where the target security algorithm for the signaling plane belongs to a set of security algorithms indicated by the information about the security algorithms supported by the second node; and generating a first MAC by using the target security algorithm of the signaling plane, where a length of the first MAC is the target MAC length of the signaling plane. Equipped with.

[0008] In an embodiment of the present application, the first node determines the target security algorithm of the signaling plane and the target MAC length of the signaling plane based on the information about the security algorithms supported by the second node and by using an algorithm policy, and then uses the target MAC length of the signaling plane as the MAC length of the signaling message between the first node and the second node. In this way, different MAC lengths can be determined based on different policies configured in the first node, and the flexibility of MAC length is improved. Furthermore, the algorithm selection policy may be pre-configured or pre-defined based on the communication requirements of the first node. For example, an algorithm with a relatively high security and a relatively long MAC length may be preferentially selected to improve data security.

[0009] In a possible implementation of the first aspect, the step of determining a target security algorithm for a signaling plane and a target MAC length for the signaling plane according to a first algorithm selection policy comprises: determining the target security algorithm for the signaling plane and the target MAC length for the signaling plane according to a first length selection policy and the first algorithm selection policy; Includes.

[0010] In another possible implementation of the first aspect, the step of determining the target security algorithm of the signaling plane and the target MAC length of the signaling plane according to a first length selection policy and the first algorithm selection policy comprises: determining the target security algorithm for the signaling plane according to the first algorithm selection policy; and determining the target MAC length for the signaling plane according to a first length selection policy and the target security algorithm for the signaling plane; Includes.

[0011] In another possible implementation of the first aspect, determining a target security algorithm for the signaling plane and a target MAC length for the signaling plane according to a first algorithm selection policy comprises: determining a target security algorithm for the signaling plane according to the first algorithm selection policy, where a MAC length corresponding to the target security algorithm for the signaling plane is the target MAC length for the signaling plane. Includes.

[0012] In another possible implementation of the first aspect, the method further comprises: sending a security context request message to the second node, where the security context request message includes a first MAC, information indicating the target security algorithm of the signaling plane, and the target MAC length of the signaling plane, the first MAC being used to check the integrity of the security context request message; It further comprises:

[0013] The first node may add information indicating a signaling plane target security algorithm and a signaling plane target MAC length to the security context request message, so that the second node knows that it may obtain the signaling plane target security algorithm and the signaling plane target MAC length by using the security context request message. Furthermore, the security context request message may carry a first MAC used by the second node to check the integrity of the security context request message to prevent the security context request message from being tampered with by an attacker.

[0014] In another possible implementation of the first aspect, the method further comprises: sending a security context request message to the second node, where the security context request message includes the first MAC and information indicating the target security algorithm of the signaling plane, the first MAC being used to check the integrity of the security context request message, and the first MAC being further used to indicate the target MAC length of the signaling plane. It further comprises:

[0015] In another possible implementation of the first aspect, after the step of determining a target security algorithm for the signaling plane and a target MAC length for the signaling plane according to a first algorithm selection policy, the method further comprises: sending a security context request message to the second node, where the security context request message includes the first MAC, information indicative of the target security algorithm of the signaling plane, the target MAC length of the signaling plane, and first identity authentication information, where the first MAC is used to check integrity of the security context request message, and the first identity authentication information is generated based on a shared key between the first node and the second node; and receiving a security context response message from the second node, where the security context response message includes second identity authentication information and a second MAC, a length of the second MAC being the target MAC length of the signaling plane, the second identity authentication information being used to verify the identity of the second node, and the second MAC being used to check the integrity of the security context response message. It further comprises:

[0016] The shared key is a secret value shared between the first node and the second node, and may be used to generate an identity credential for verifying the identity of the node. The first node may generate the first identity credential by using the shared key, and it is found that the first identity credential is used by the second node to verify the identity of the first node. Correspondingly, the first node may also verify the identity of the second node by using the second identity credential. If an attacker wants to obtain the signaling plane target security algorithm or the signaling plane target MAC length by forging the identity of the second node, the verification performed by the first node on its identity cannot succeed because the shared key cannot be forged. Thus, the first node is avoided from communicating with untrusted nodes, and the communication security of the first node is improved.

[0017] In another possible implementation of the first aspect, the method further comprises the steps of: checking the integrity of the security context response message based on a target security algorithm of the signaling plane and a second MAC; performing verification on the second identity credential based on the shared key; and sending an association establishment message to the second node if the check on the integrity of the security context response message is successful and the verification on the second identity authentication information is successful, where the association establishment message indicates to the second node that it will establish an association with the first node. It further comprises:

[0018] In another possible implementation of the first aspect, the security context request message further includes a target security algorithm for a user plane, and the method further comprises: determining the target security algorithm of the user plane according to a second algorithm selection policy, where the target security algorithm of the user plane belongs to the set of security algorithms indicated by the information about the security algorithms supported by the second node. It further comprises:

[0019] In another possible implementation of the first aspect, the method further comprises: obtaining an identifier of a first service and / or a data packet size of said first service; determining a target MAC length for the user plane based on at least one of a MAC length supported by the target security algorithm of the user plane and the identifier of the first service and the data packet size of the first service, where the target MAC length for the user plane is used to indicate a MAC length for performing integrity protection on data of the first service; and transmitting a resource scheduling message to the second node, wherein the resource scheduling message includes the target MAC length for the user plane. It further comprises:

[0020] It can be seen that the target MAC length of the user plane may be determined based on the MAC length supported by the security algorithm of the user plane, the identifier of the first service, and the data packet size of the first service. Different MAC lengths may be determined for different services or services with different data packet sizes, which improves the flexibility of the MAC length. For services with relatively high confidentiality, a relatively long MAC length may be used, which makes cracking difficult and improves data security.

[0021] According to a second aspect, an embodiment of the present application comprises: sending an association request message to the first node, where the association request message includes information about security algorithms supported by the second node; and receiving a security context request message from the first node, where the security context request message includes information used to indicate a target security algorithm of a signaling plane and information used to indicate a target MAC length of the signaling plane, the target security algorithm of the signaling plane and the target MAC length of the signaling plane correspond to a first algorithm selection policy, and the target security algorithm of the signaling plane belongs to a set of security algorithms indicated by the information about the security algorithms supported by the second node. The present invention further provides a communication method comprising:

[0022] In an embodiment of the present application, the second node sends information about security algorithms supported by the second node to the first node. The first node determines a target security algorithm of the signaling plane and a target MAC length of the signaling plane based on the information about security algorithms supported by the second node and by using a pre-configured or pre-defined algorithm policy, and then uses the target MAC length of the signaling plane as the MAC length of the signaling message between the first node and the second node. In this way, different MAC lengths can be determined based on different policies configured in the first node, and the flexibility of the MAC length is improved. For example, an algorithm with a relatively high security may be selected from the algorithms supported by the second node, and a relatively long MAC length may be further selected to improve data security.

[0023] In a possible implementation of the second aspect, the security context request message includes a first MAC, and the length of the first MAC is a target MAC length of the signaling plane. checking the integrity of the security context request message based on the first MAC by using a target security algorithm of the signaling plane; It further comprises:

[0024] In another possible implementation of the second aspect, the first MAC is information used to indicate a target MAC length of the signaling plane.

[0025] In another possible implementation of the second aspect, the signaling plane target security algorithm and the signaling plane target MAC length are determined according to a first algorithm selection policy, and the first MAC is generated according to the signaling plane target security algorithm.

[0026] In another possible implementation of the second aspect, the security context request message further includes first identity authentication information. performing verification on the first identity authentication information based on a shared key between the second node and the first node; generating a second MAC by using a signaling plane target security algorithm if the check on the integrity of the security context request message is successful and the verification on the first identity authentication information is successful, where the length of the second MAC is a signaling plane target MAC length; and transmitting a security context response message to the first node, where the security context response message includes a second MAC and a second identity authentication information, the second identity authentication information being generated based on a shared key between the second node and the first node; It further comprises:

[0027] In another possible implementation of the second aspect, the method further comprises receiving an association establishment message from the first node, the association establishment message indicating to the second node to establish an association with the first node.

[0028] In another possible implementation of the second aspect, the security context request message further includes information indicating a target security algorithm of a user plane, the target security algorithm of the user plane corresponding to a second algorithm selection policy, and the target security algorithm of the user plane belongs to the set of security algorithms indicated by the information about the security algorithms supported by the second node. receiving a resource scheduling message from a first node, where the resource scheduling message includes a user plane target MAC length, the user plane target MAC length corresponding to at least one of a user plane target security algorithm and an identifier of the first service and a data packet size of the first service, the user plane target MAC length being used to indicate a MAC length for performing integrity protection on data of the first service; It further comprises:

[0029] It can be seen that the first node may determine a user plane target MAC length based on the MAC length supported by the user plane security algorithm, the identifier of the first service, and the data packet size of the first service, and then use the user plane target MAC length as the MAC length of messages used to process the first service. In this way, different MAC lengths can be determined for different services or services with different data packet sizes to improve the flexibility of the MAC length. For services with relatively high confidentiality, a relatively long MAC length may be used, which makes cracking difficult and improves data security.

[0030] Furthermore, the first node may add information indicating the user plane target security algorithm and the user plane target MAC length to the resource scheduling message, so that the second node may obtain the user plane target security algorithm and the user plane target MAC length by using the resource scheduling message.

[0031] According to a third aspect, an embodiment of the present application comprises: receiving a service attribute report response message from a second node, where the service attribute report response message includes an identifier of a first service and / or a data packet size of the first service; and determining a target MAC length for the user plane based on at least one of a MAC length supported by a target security algorithm of a user plane and the identifier of the first service and the data packet size of the first service, where the target MAC length for the user plane is used to indicate a length of a MAC for performing integrity protection on data of the first service. The present invention further provides a communication method comprising:

[0032] In an embodiment of the present application, a first node may determine the target MAC length of the user plane based on a MAC length supported by a security algorithm of the user plane and the identifier of the first service and / or the data packet size of the first service, and then use the target MAC length of the user plane as the MAC length of messages used to process the first service. In this way, different MAC lengths can be determined for different services or services with different data packet sizes to improve the flexibility of MAC length. For services with relatively high security, a relatively long MAC length may be used, which makes cracking difficult and improves data security. Furthermore, for some messages that do not have high security requirements or have relatively small data packets, a relatively short MAC length may be used to avoid affecting communication efficiency and reduce resource consumption during network transmission.

[0033] In a possible implementation of the third aspect, the step of determining a user plane target MAC length based on at least one of a MAC length supported by a target security algorithm of the user plane and the identifier of the first service and the data packet size of the first service comprises: determining the target MAC length for the user plane based on the MAC length supported by the target security algorithm of the user plane and the identifier of the first service; or determining the target MAC length for the user plane based on the MAC length supported by the target security algorithm of the user plane and the data packet size of the first service; Includes.

[0034] In another possible implementation of the third aspect, the step of determining a target MAC length for the user plane based on at least one of a MAC length supported by a target security algorithm for a user plane and the identifier of the first service and the data packet size of the first service comprises: determining the MAC length corresponding to the identifier of the first service as the target MAC length of the user plane based on a correspondence relationship between the MAC length supported by the target security algorithm of the user plane and the identifier and MAC length of the first service; or determining the MAC length corresponding to the data packet size of the first service as the target MAC length of the user plane based on a correspondence relationship between the MAC length supported by the target security algorithm of the user plane and the data packet size and MAC length of the first service; Includes.

[0035] In another possible implementation of the third aspect, determining the target MAC length for the user plane based on a target security algorithm for a user plane and at least one of the identifier of the first service and the data packet size of the first service comprises: determining a second length selection policy based on the identifier of the first service and / or the data packet size of the first service; and determining the target MAC length for the user plane based on the second length selection policy and the MAC length supported by the target security algorithm for the user plane; Includes.

[0036] In another possible implementation of the third aspect, the identifier of the first service corresponds to a first service type and integrity protection needs to be performed on data of a service whose type is the first service type.

[0037] Services of different service types have different integrity protection requirements. The first node may determine whether to enable integrity protection based on the identifier of the first service, and generate corresponding target MACs of the user plane only for the services for which integrity protection needs to be enabled, thus meeting the security requirements of different services. For example, a video upload service is a service with a relatively high security requirement, so that integrity protection needs to be performed on the data of the video upload service, and therefore the length of the MAC used to protect the data of this service needs to be determined.

[0038] In another possible implementation of the third aspect, the method further comprises: transmitting a resource scheduling message to the second node, where the resource scheduling message includes a user plane target MAC length. Further includes:

[0039] In another possible implementation of the third aspect, the method further comprises: generating a third MAC by using the target security algorithm of the user plane, where a length of the third MAC is the target MAC length of the user plane, and the third MAC is used to perform integrity protection on the data of the first service. It further comprises:

[0040] In another possible implementation of the third aspect, the method further comprises: obtaining information about security algorithms supported by the second node; determining a target security algorithm for a signaling plane and a target MAC length for the signaling plane according to a first algorithm selection policy, where the target security algorithm for the signaling plane belongs to a set of security algorithms indicated by the information about the security algorithms supported by the second node; generating a fourth MAC by using the target security algorithm of the signaling plane, where the length of the fourth MAC is the target MAC length of the signaling plane; and transmitting a resource scheduling message to the second node, where the resource scheduling message includes the fourth MAC and the target MAC length of the user plane, the fourth MAC being used to perform integrity protection on the resource scheduling message. It further comprises:

[0041] In another possible implementation of the third aspect, the method further comprises: determining the target security algorithm of the user plane according to a second algorithm selection policy, where the target security algorithm of the user plane belongs to the set of security algorithms indicated by the information about the security algorithms supported by the second node. It further comprises:

[0042] According to a fourth aspect, an embodiment of the present application comprises: sending a service attribute report response message to a first node, where the service attribute report response message includes an identifier of a first service and / or a data packet size of the first service; and receiving a resource scheduling message from the first node, where the resource scheduling message includes a user plane target MAC length; the user plane target MAC length is a MAC length supported by a user plane target security algorithm, and the user plane target MAC length corresponds to at least one of the identifier of the first service and the data packet size of the first service; the user plane target MAC length is used to indicate a MAC length for performing integrity protection on data of the first service. The present invention further provides a communication method comprising:

[0043] In an embodiment, services of different service types have different integrity protection requirements. The first node may determine whether to enable integrity protection based on the identifier of the first service. For example, the audio noise reduction service is a service with a relatively low security requirement, so there may be no need for integrity protection to be performed on the data of the audio noise reduction service, and therefore the MAC length corresponding to the audio noise reduction service may not be determined.

[0044] Furthermore, the first node may add indication information to the resource scheduling message, so that the second node determines whether integrity protection is enabled for the service based on the indication information.

[0045] In a possible implementation of the fourth aspect, the target MAC length of the user plane is determined based on at least one of a MAC length supported by a target security algorithm of the user plane and an identifier of the first service and a data packet size of the first service.

[0046] In another possible implementation of the fourth aspect, the identifier of the first service corresponds to a first service type and integrity protection needs to be performed on data of a service whose type is the first service type.

[0047] Services of different service types have different integrity protection requirements. The first node may determine whether to enable integrity protection based on the identifier of the first service, and generate corresponding target MACs of the user plane only for the services for which integrity protection needs to be enabled, thus meeting the security requirements of different services. For example, a video upload service is a service with a relatively high security requirement, so integrity protection needs to be performed on the data of the video upload service, and therefore the length of the MAC used to protect the data of this service needs to be determined.

[0048] In another possible implementation of the fourth aspect, the target security algorithm of the user plane corresponds to a second algorithm selection policy, and the target security algorithm of the user plane belongs to a set of security algorithms indicated by information about security algorithms supported by the second node.

[0049] In another possible implementation of the fourth aspect, the resource scheduling message further includes a fourth MAC, and the method further comprises: checking message integrity of the resource scheduling message based on the fourth MAC by using the target security algorithm of the user plane It further comprises:

[0050] According to a fifth aspect, an embodiment of the present application comprises: sending a service attribute report response message to a first node, where the service attribute report response message includes an identifier of a first service and / or a data packet size of the first service; and determining a target MAC length for the user plane based on at least one of a MAC length supported by a target security algorithm of a user plane and the identifier of the first service and the data packet size of the first service, where the target MAC length for the user plane is used to indicate a length of a MAC for performing integrity protection on data of the first service. The present invention further provides a communication method comprising:

[0051] It can be seen that a method for determining a user plane target MAC length, which is the same as that in the first node, is configured in the second node. Thus, the second node may determine the user plane target MAC length based on the MAC length supported by the user plane security algorithm, the identifier of the first service and / or the data packet size of the first service, and then use the user plane target MAC length as the MAC length of messages used to process the first service. In this way, different MAC lengths can be determined for different services or services with different data packet sizes to improve the flexibility of the MAC length.

[0052] However, the same method for determining the user plane target MAC length is configured in both the second node and the first node, so that the first node determines the user plane target MAC length in a certain manner, and therefore the second node also determines the user plane target MAC length in the same manner. In this way, the node does not need to transmit the target MAC length to the peer node, saving network resources.

[0053] In a possible implementation of the fifth aspect, the step of determining a target MAC length for the user plane based on at least one of a MAC length supported by a target security algorithm for a user plane and the identifier of the first service and the data packet size of the first service comprises: determining the MAC length corresponding to the ID of the first service as the target MAC length of the user plane based on a correspondence relationship between the MAC length supported by the target security algorithm of the user plane and the identifier ID and MAC length of the first service; or determining the MAC length corresponding to the data packet size of the first service as the target MAC length of the user plane based on a correspondence relationship between the MAC length supported by the target security algorithm of the user plane and the data packet size and MAC length of the first service; Includes.

[0054] In another possible implementation of the fifth aspect, the step of determining a user plane target MAC length based on at least one of a MAC length supported by a target security algorithm of the user plane and the identifier of the first service and the data packet size of the first service comprises: determining the target MAC length for the user plane based on the MAC length supported by the target security algorithm of the user plane and the identifier of the first service; or determining the target MAC length for the user plane based on the MAC length supported by the target security algorithm of the user plane and the data packet size of the first service; Includes.

[0055] In another possible implementation of the fifth aspect, determining the target MAC length for the user plane based on a target security algorithm for a user plane and at least one of the identifier of the first service and the data packet size of the first service comprises: determining a second length selection policy based on the ID of the first service and / or the data packet size of the first service; and determining the target MAC length for the user plane based on the second length selection policy and the MAC length supported by the target security algorithm for the user plane; Includes.

[0056] In another possible implementation of the fifth aspect, the identifier of the first service corresponds to a first service type and integrity protection needs to be performed on data of a service whose type is the first service type.

[0057] Services of different service types have different integrity protection requirements. The first node may determine whether to enable integrity protection based on the identifier of the first service, and generate corresponding target MACs of the user plane only for the services for which integrity protection needs to be enabled, thus meeting the security requirements of different services. For example, a video upload service is a service with a relatively high security requirement, so that integrity protection needs to be performed on the data of the video upload service, and therefore the length of the MAC used to protect the data of this service needs to be determined.

[0058] In another possible implementation of the fifth aspect, the target security algorithm of the user plane corresponds to a second algorithm selection policy, and the target security algorithm of the user plane belongs to a set of security algorithms indicated by information about security algorithms supported by the second node.

[0059] According to a sixth aspect, an embodiment of the present application comprises: receiving a Service Attribute Report Response message from a second node, where the Service Attribute Report Response message includes at least one service identifier, the at least one service identifier includes an identifier of at least one second service, the identifier of the at least one second service corresponds to a second service type, and no integrity protection needs to be performed on data of a service whose type is the second service type; and transmitting a resource scheduling message to the second node, where the resource scheduling message is used to indicate that integrity protection is not enabled for the service corresponding to the identifier of the at least one second service. The present invention further provides a communication method comprising:

[0060] It can be seen that services of different service types have different integrity protection requirements. The first node may determine whether to enable integrity protection based on the identifier of the first service. For example, the audio noise reduction service is a service with a relatively low security requirement, so there may be no need for integrity protection to be performed on the data of the audio noise reduction service, and therefore the MAC length corresponding to the audio noise reduction service may not be determined.

[0061] Furthermore, the first node may add indication information to the resource scheduling message, so that the second node determines whether integrity protection is enabled for the service based on the indication information.

[0062] In a possible implementation of the sixth aspect, the at least one service identifier includes an identifier of at least one first service, the identifier of the at least one first service corresponds to a first service type, and integrity protection needs to be performed on data of a service whose type is the first service type.

[0063] In another possible implementation of the sixth aspect, the resource scheduling message is further used to indicate a target MAC length of a user plane to be used for the at least one first service.

[0064] It can be seen that for services for which integrity protection needs to be performed, information indicating the target MAC length of the user plane may be added in the first node, which is used to indicate the length of the MAC for performing integrity protection on the data of the service.

[0065] According to a seventh aspect, an embodiment of the present application comprises: sending a service attribute report response message to the first node, where the service attribute report response message includes at least one service identifier, the at least one service identifier includes an identifier of at least one second service, the identifier of the at least one second service corresponds to a second service type, and no integrity protection needs to be performed on data of a service whose type is the second service type; receiving a resource scheduling message from the first node; and determining, based on the resource scheduling message, that integrity protection is not enabled for the service corresponding to the identifier of the at least one second service; The present invention further provides a communication method comprising:

[0066] It can be seen that services of different service types have different integrity protection requirements. The first node may determine whether to enable integrity protection based on the identifier of the first service. For example, the audio noise reduction service is a service with a relatively low security requirement, so there may be no need for integrity protection to be performed on the data of the audio noise reduction service, and therefore the MAC length corresponding to the audio noise reduction service may not be determined.

[0067] In a possible implementation of the seventh aspect, the at least one service identifier comprises an identifier of at least one first service, the identifier of the at least one first service corresponds to a first service type, and integrity protection needs to be performed on data of a service whose type is the first service type. determining, based on the resource scheduling message, that integrity protection is enabled for a service corresponding to the identifier of the at least one first service; It further comprises:

[0068] In another possible implementation of the seventh aspect, the resource scheduling message is further used to indicate a MAC length for performing integrity protection on data of the at least one first service.

[0069] According to an eighth aspect, an embodiment of the present application comprises: a receiving unit configured to receive an association request message from a second node, where the association request message includes information about security algorithms supported by the second node; and a processing unit configured to determine a target security algorithm for a signaling plane and a target MAC length for the signaling plane according to a first algorithm selection policy, where the target security algorithm for the signaling plane belongs to a set of security algorithms indicated by the information about the security algorithms supported by the second node. A communication device comprising:

[0070] The processing unit is further configured to generate a first MAC by using a target security algorithm of the signaling plane, and a length of the first MAC is a target MAC length of the signaling plane.

[0071] In this embodiment of the present application, the device determines a target security algorithm of the signaling plane and a target MAC length of the signaling plane based on information about security algorithms supported by the second node and by using a pre-configured or pre-defined algorithm policy, and then uses the target MAC length of the signaling plane as the MAC length of the signaling message between the first node and the second node. In this way, different MAC lengths can be determined based on different policies configured in the device, and the flexibility of the MAC length is improved. Furthermore, the algorithm selection policy may be pre-configured or pre-defined based on the communication requirements of the first node. For example, an algorithm with a relatively high security and a relatively long MAC length may be preferentially selected to improve data security.

[0072] In a possible implementation of the eighth aspect, the processing unit determining the target security algorithm for the signaling plane and the target MAC length for the signaling plane according to a first length selection policy and the first algorithm selection policy; It is specifically configured to do so.

[0073] In another possible implementation of the eighth aspect, the processing unit: Determine the target security algorithm of the signaling plane according to the first algorithm selection policy, where a MAC length corresponding to the target security algorithm of the signaling plane is the target MAC length of the signaling plane. It is specifically configured to do so.

[0074] In another possible implementation of the eighth aspect, the apparatus comprises: a transmitting unit configured to transmit a security context request message to the second node, where the security context request message includes the first MAC, information indicating the target security algorithm of the signaling plane, and the target MAC length of the signaling plane, and the first MAC is used to check the integrity of the security context request message. It further comprises:

[0075] In another possible implementation of the eighth aspect, the apparatus comprises: a transmitting unit configured to transmit a security context request message to the second node, where the security context request message includes the first MAC and information indicating the target security algorithm of the signaling plane, the first MAC being used to check the integrity of the security context request message, and the first MAC being further used to indicate the target MAC length of the signaling plane. It further comprises:

[0076] In another possible implementation of the eighth aspect, the apparatus further comprises a transmitting unit configured to transmit a security context request message to a second node, the security context request message including a first MAC, information indicating a target security algorithm of the signaling plane, a target MAC length of the signaling plane, and a first identity authentication information; the first MAC is used to check the integrity of the security context request message; and the first identity authentication information is generated based on a shared key between the first node and the second node.

[0077] The receiving unit is further configured to receive a security context response message from the second node, the security context response message including second identity authentication information and a second MAC, the length of the second MAC being a target MAC length of the signaling plane, the second identity authentication information being used to verify the identity of the second node, and the second MAC being used to check the integrity of the security context response message.

[0078] The shared key is a secret value shared between the first node and the second node, and may be used to generate an identity credential for verifying the identity of the node. The device may generate the first identity credential by using the shared key, and it can be seen that the first identity credential is used by the second node to verify the identity of the first node. Correspondingly, the first node may also verify the identity of the second node by using the second identity credential. If an attacker wants to obtain the target security algorithm of the signaling plane or the target MAC length of the signaling plane by forging the identity of the second node, the verification performed by the device on its identity cannot succeed because the shared key cannot be forged. Thus, the first node is avoided from communicating with untrusted nodes, and the communication security of the first node is improved.

[0079] In another possible implementation of the eighth aspect, the security context request message further includes a target security algorithm for a user plane, and the processing unit: determining a target security algorithm for the user plane according to a second algorithm selection policy, where the target security algorithm for the user plane belongs to the set of security algorithms indicated by the information about the security algorithms supported by the second node; It is specifically configured to do so.

[0080] In another possible implementation of the eighth aspect, the receiving unit is further configured to obtain an identifier of the first service and / or a data packet size of the first service.

[0081] The processing unit is further configured to determine a user plane target MAC length based on at least one of a MAC length supported by a user plane target security algorithm and an identifier of the first service and a data packet size of the first service, where the user plane target MAC length is used to indicate a MAC length for performing integrity protection on data of the first service.

[0082] The transmitting unit is further configured to transmit a resource scheduling message to the second node, the resource scheduling message including the target MAC length for the user plane.

[0083] According to a ninth aspect, an embodiment of the present application comprises: a sending unit configured to send an association request message to a first node, where the association request message includes information about security algorithms supported by a second node; and a receiving unit configured to receive a security context request message from the first node, where the security context request message includes information used to indicate a target security algorithm of a signaling plane and information used to indicate a target MAC length of the signaling plane, the target security algorithm of the signaling plane and the target MAC length of the signaling plane correspond to a first algorithm selection policy, and the target security algorithm of the signaling plane belongs to a set of security algorithms indicated by the information about the security algorithms supported by the second node. A communication device comprising:

[0084] In this embodiment of the present application, the device transmits information about security algorithms supported by the second node to the first node. Based on the information about security algorithms supported by the second node and by using a pre-configured or pre-defined algorithm policy, the first node determines a target security algorithm of the signaling plane and a target MAC length of the signaling plane, and then uses the target MAC length of the signaling plane as the MAC length of the signaling message between the first node and the second node. In this way, different MAC lengths can be determined based on different policies configured in the device, and the flexibility of the MAC length is improved. For example, an algorithm with a relatively high security may be selected from the algorithms supported by the second node, and a relatively long MAC length may be further selected to improve data security.

[0085] In a possible implementation of the ninth aspect, the security context request message includes a first MAC, and the length of the first MAC is a target MAC length of the signaling plane. a processing unit configured to check the integrity of the security context request message based on the first MAC by using a target security algorithm of the signaling plane; It further comprises:

[0086] In another possible implementation of the ninth aspect, the first MAC is information used to indicate a target MAC length of the signaling plane.

[0087] In another possible implementation of the ninth aspect, the security context request message further includes a first identity credential, and the processing unit is further configured to perform verification on the first identity credential based on a shared key between the second node and the first node.

[0088] The processing unit is further configured to generate a second MAC by using a target security algorithm of the signaling plane when the check on the integrity of the security context request message is successful and the verification on the first identity authentication information is successful, and the length of the second MAC is a target MAC length of the signaling plane.

[0089] The sending unit is further configured to send a security context response message to the first node, the security context response message including a second MAC and a second identity authentication information, the second identity authentication information being generated based on a shared key between the second node and the first node.

[0090] In another possible implementation of the ninth aspect, the security context request message further includes information indicating a target security algorithm for a user plane, the target security algorithm for the user plane corresponding to a second algorithm selection policy, and the target security algorithm for the user plane belonging to the set of security algorithms indicated by the information about the security algorithms supported by the second node.

[0091] The receiving unit is further configured to receive a resource scheduling message from the first node, the resource scheduling message including a user plane target MAC length, the user plane target MAC length corresponding to at least one of a user plane target security algorithm and an identifier of the first service and a data packet size of the first service, the user plane target MAC length being used to indicate a MAC length for performing integrity protection on data of the first service.

[0092] According to a tenth aspect, an embodiment of the present application comprises: a receiving unit configured to receive a service attribute report response message from a second node, where the service attribute report response message includes an identifier of a first service and / or a data packet size of the first service; and a processing unit configured to determine a target MAC length for the user plane based on at least one of a MAC length supported by a target security algorithm of a user plane and the identifier of the first service and the data packet size of the first service, where the target MAC length for the user plane is used to indicate a length of a MAC for performing integrity protection on data of the first service. A communication device comprising:

[0093] In this embodiment of the present application, the device determines a user plane target MAC length based on the MAC length supported by the security algorithm of the user plane, the identifier of the first service, and the data packet size of the first service, and then uses the user plane target MAC length as the MAC length of the message used to process the first service. In this way, different MAC lengths can be determined for different services or services with different data packet sizes to improve the flexibility of the MAC length. For services with relatively high security, a relatively long MAC length may be used, which makes cracking difficult and improves data security. Furthermore, for some messages that do not have high privacy requirements or have relatively small data packets, a relatively short MAC length may be used to avoid affecting communication efficiency and reducing resource consumption during network transmission.

[0094] In a possible implementation of the tenth aspect, the processing unit comprises: Determine the MAC length corresponding to the identifier of the first service as the target MAC length of the user plane based on a correspondence relationship between a MAC length supported by the target security algorithm of the user plane and the identifier and a MAC length of the first service; or determining, based on a correspondence relationship between the MAC length supported by the target security algorithm of the user plane and the data packet size and MAC length of the first service, the MAC length corresponding to the data packet size of the first service as the target MAC length of the user plane; It is specifically configured to do so.

[0095] In another possible implementation of the tenth aspect, the processing unit: determining a second length selection policy based on the identifier of the first service and / or the data packet size of the first service; and determining the target MAC length for the user plane based on the second length selection policy and the MAC length supported by the target security algorithm for the user plane; It is specifically configured to do so.

[0096] In another possible implementation of the tenth aspect, the identifier of the first service corresponds to a first service type, and integrity protection needs to be performed on data of a service whose type is the first service type.

[0097] In another possible implementation of the tenth aspect, the apparatus further comprises a transmitting unit configured to transmit a resource scheduling message to the second node, the resource scheduling message including the target MAC length for the user plane.

[0098] In another possible implementation of the tenth aspect, the processing unit: Generate a third MAC by using the target security algorithm of the user plane, where a length of the third MAC is the target MAC length of the user plane, and the third MAC is used to perform integrity protection on the data of the first service. It is further structured as follows.

[0099] In another possible implementation of the tenth aspect, the receiving unit is further configured to obtain information about security algorithms supported by the second node.

[0100] The processing unit is further configured to determine a signaling plane target security algorithm and a signaling plane target MAC length according to the first algorithm selection policy, where the signaling plane target security algorithm belongs to a set of security algorithms indicated by the information about security algorithms supported by the second node.

[0101] The processing unit is further configured to generate a fourth MAC by using a target security algorithm of the signaling plane, and the length of the fourth MAC is a target MAC length of the signaling plane.

[0102] The sending unit is further configured to send a resource scheduling message to the second node, the resource scheduling message including a fourth MAC and a user plane target MAC length, the fourth MAC being used to perform integrity protection on the resource scheduling message.

[0103] In another possible implementation of the tenth aspect, the processing unit: determining a target security algorithm for the user plane according to a second algorithm selection policy, where the target security algorithm for the user plane belongs to the set of security algorithms indicated by the information about the security algorithms supported by the second node; It is further structured as follows.

[0104] According to an eleventh aspect, an embodiment of the present application comprises: a sending unit configured to send a service attribute report response message to a first node, where the service attribute report response message includes an identifier of a first service and / or a data packet size of the first service; and a receiving unit configured to receive a resource scheduling message from the first node, where the resource scheduling message includes a target MAC length for a user plane; the target MAC length for the user plane is a MAC length supported by a target security algorithm for the user plane, and the target MAC length for the user plane corresponds to at least one of the identifier of the first service and the data packet size of the first service; and the target MAC length for the user plane is used to indicate a MAC length for performing integrity protection on data of the first service. A communication device comprising:

[0105] In the above embodiment, services of different service types have different integrity protection requirements. The device 170 may determine whether to enable integrity protection based on the identifier of the first service. For example, the audio noise reduction service is a service with a relatively low security requirement, so there may be no need to perform integrity protection on the data of the audio noise reduction service.

[0106] In a possible implementation of the eleventh aspect, the identifier of the first service corresponds to a first service type, and integrity protection needs to be performed on data of a service whose type is the first service type.

[0107] In another possible implementation of the eleventh aspect, the target security algorithm of the user plane corresponds to a second algorithm selection policy, and the target security algorithm of the user plane belongs to a set of security algorithms indicated by information about security algorithms supported by the second node.

[0108] In another possible implementation of the eleventh aspect, the resource scheduling message further includes a fourth MAC, and the processing unit: Checking message integrity of the resource scheduling message based on the fourth MAC by using the target security algorithm of the user plane. It is further structured as follows.

[0109] According to a twelfth aspect, an embodiment of the present application comprises: a sending unit configured to send a service attribute report response message to a first node, where the service attribute report response message includes an identifier of a first service and / or a data packet size of the first service; and a processing unit configured to determine a target MAC length for the user plane based on at least one of a MAC length supported by a target security algorithm of a user plane and the identifier of the first service and the data packet size of the first service, where the target MAC length for the user plane is used to indicate a length of a MAC for performing integrity protection on data of the first service. A communication device comprising:

[0110] The device is configured with a method for determining a user plane target MAC length that is the same as that in the first node. Thus, the device may determine the user plane target MAC length based on the MAC length supported by the user plane security algorithm and the identifier of the first service and / or the data packet size of the first service, and then use the user plane target MAC length as the MAC length of messages used to process the first service. In this way, different MAC lengths can be determined for different services or services with different data packet sizes to improve the flexibility of the MAC length.

[0111] However, the same method for determining the user plane target MAC length is configured in both the device and the first node, so that the first node determines the user plane target MAC length in a specific manner, and therefore the device also determines the user plane target MAC length in the same manner. In this way, the node does not need to transmit the target MAC length to the peer node, saving network resources.

[0112] In a possible implementation of the twelfth aspect, the processing unit Determine the MAC length corresponding to the ID of the first service as the target MAC length of the user plane based on a correspondence relationship between a MAC length supported by the target security algorithm of the user plane and the identifier ID and MAC length of the first service; or determining, based on a correspondence relationship between the MAC length supported by the target security algorithm of the user plane and the data packet size and MAC length of the first service, the MAC length corresponding to the data packet size of the first service as the target MAC length of the user plane; It is specifically configured to do so.

[0113] In another possible implementation of the twelfth aspect, the processing unit: determining a second length selection policy based on the ID of the first service and / or the data packet size of the first service; and determining the target MAC length for the user plane based on the second length selection policy and the MAC length supported by the target security algorithm for the user plane; It is specifically configured to do so.

[0114] In another possible implementation of the twelfth aspect, the identifier of the first service corresponds to a first service type, and integrity protection needs to be performed on data of a service whose type is the first service type.

[0115] In another possible implementation of the twelfth aspect, the target security algorithm of the user plane corresponds to a second algorithm selection policy, and the target security algorithm of the user plane belongs to a set of security algorithms indicated by information about security algorithms supported by the second node.

[0116] According to a thirteenth aspect, an embodiment of the present application comprises: a receiving unit configured to receive a service attribute report response message from a second node, where the service attribute report response message includes at least one service identifier, where the at least one service identifier includes an identifier of at least one second service, where the identifier of the at least one second service corresponds to a second service type, and where no integrity protection needs to be performed on data of a service whose type is the second service type; and a transmitting unit configured to transmit a resource scheduling message to the second node, where the resource scheduling message is used to indicate that integrity protection is not enabled for the service corresponding to the identifier of the at least one second service; A communication device comprising:

[0117] It can be seen that services of different service types have different integrity protection requirements. The above device may determine whether to enable integrity protection based on the identifier of the first service. For example, the audio noise reduction service is a service with a relatively low security requirement, so there may be no need to perform integrity protection on the data of the audio noise reduction service, and therefore the MAC length corresponding to the audio noise reduction service may not be determined.

[0118] In a possible implementation of the thirteenth aspect, the at least one service identifier includes an identifier of at least one first service, the identifier of the at least one first service corresponds to a first service type, and integrity protection needs to be performed on data of a service whose type is the first service type.

[0119] In another possible implementation of the thirteenth aspect, the resource scheduling message is further used to indicate a target MAC length of a user plane to be used for the at least one first service.

[0120] According to a fourteenth aspect, an embodiment of the present application comprises: a sending unit configured to send a service attribute report response message to a first node, where the service attribute report response message includes at least one service identifier, the at least one service identifier includes an identifier of at least one second service, the identifier of the at least one second service corresponds to a second service type, and no integrity protection needs to be performed on data of a service whose type is the second service type; a receiving unit configured to receive a resource scheduling message from the first node; and a processing unit configured to determine, based on the resource scheduling message, that integrity protection is not enabled for the service corresponding to the identifier of the at least one second service; A communication device comprising:

[0121] It can be seen that services of different service types have different integrity protection requirements. The first node may determine whether to enable integrity protection based on the identifier of the first service. For example, the audio noise reduction service is a service with a relatively low security requirement, so there may be no need for integrity protection to be performed on the data of the audio noise reduction service, and therefore the MAC length corresponding to the audio noise reduction service may not be determined.

[0122] In a possible implementation of the fourteenth aspect, the at least one service identifier includes an identifier of at least one first service, the identifier of the at least one first service corresponds to a first service type, and integrity protection needs to be performed on data of a service whose type is the first service type.

[0123] The processing unit is further configured to determine, based on the resource scheduling message, that integrity protection is enabled for a service corresponding to an identifier of the at least one first service.

[0124] In another possible implementation of the fourteenth aspect, the resource scheduling message is further used to indicate a MAC length for performing integrity protection on data of the at least one first service.

[0125] According to a fifteenth aspect, an embodiment of the present application comprises: receiving an association request message from a second node, where the association request message includes information about security algorithms supported by the second node and an identity of the second node; determining a target security algorithm for a signaling plane and a target MAC length for the signaling plane according to a first algorithm selection policy, where the target security algorithm for the signaling plane belongs to a set of security algorithms indicated by the information about the security algorithms supported by the second node; determining a user plane target security algorithm and a user plane target MAC length based on a second algorithm selection policy and an identity of a second node, where the user plane target security algorithm belongs to the set of security algorithms indicated by the information about the security algorithms supported by the second node, and the user plane target MAC length is used to indicate a MAC length for performing integrity protection on data of a first service; and generating a first MAC by using the target security algorithm of the signaling plane, where a length of the first MAC is the target MAC length of the signaling plane; The present invention further provides a communication method comprising:

[0126] In an embodiment of the present application, different policies may be configured in the first node to determine different MAC lengths to improve the flexibility of the MAC length. Furthermore, the first node may determine a user plane target security algorithm and a user plane target MAC based on the identity of the second node to meet the requirements of different types of nodes for the MAC length. For example, some nodes that handle important services may use a relatively long MAC length to improve security. As another example, some assistant nodes or normal nodes may use a relatively short MAC length to reduce resource consumption and improve communication efficiency.

[0127] In a possible implementation of the fifteenth aspect, the step of determining a target security algorithm for a signaling plane and a target MAC length for the signaling plane according to a first algorithm selection policy comprises: determining the target security algorithm for the signaling plane and the target MAC length for the signaling plane according to a first length selection policy and the first algorithm selection policy; Includes.

[0128] In another possible implementation of the fifteenth aspect, the step of determining a target security algorithm for a signaling plane and a target MAC length for the signaling plane according to a first algorithm selection policy includes: determining the target security algorithm for the signaling plane according to the first algorithm selection policy; and determining the target MAC length for the signaling plane according to a first length selection policy and the target security algorithm for the signaling plane; Includes.

[0129] In another possible implementation of the fifteenth aspect, determining a target security algorithm for a signaling plane and a target MAC length for the signaling plane according to a first algorithm selection policy comprises: determining a target security algorithm for the signaling plane according to the first algorithm selection policy, where a MAC length corresponding to the target security algorithm for the signaling plane is the target MAC length for the signaling plane. Includes.

[0130] In another possible implementation of the fifteenth aspect, determining a user plane target security algorithm and a user plane target MAC length based on a second algorithm selection policy and an identity of the second node comprises: determining a target security algorithm for the user plane according to a second algorithm selection policy; determining a second length selection policy based on the identity of the second node; and determining a signaling plane target MAC length based on a second length selection policy and a user plane target security algorithm; Includes.

[0131] In another possible implementation of the fifteenth aspect, determining a user plane target security algorithm and a user plane target MAC length based on a second algorithm selection policy and an identity of the second node comprises: determining a target security algorithm for the user plane according to a second algorithm selection policy; and determining a MAC length corresponding to the identity of the second node as a target MAC length of the user plane based on a MAC length supported by a target security algorithm of the user plane and a correspondence relationship between the identity and the MAC length of the second node; Includes.

[0132] In another possible implementation of the fifteenth aspect, the method further comprises: sending a security context request message to the second node, where the security context request message includes a first MAC, information indicating the target security algorithm of the signaling plane, information indicating the target security algorithm of the user plane, the target MAC length of the signaling plane, and the target MAC length of the user plane, and the first MAC is used to check integrity of the security context request message. It further comprises:

[0133] In another possible implementation of the fifteenth aspect, the method further comprises: sending a security context request message to the second node, where the security context request message includes a first MAC, information indicative of the target security algorithm of the signaling plane, information indicative of the target security algorithm of the user plane, the target MAC length of the signaling plane, the target MAC length of the user plane, and first identity authentication information, where the first MAC is used to check integrity of the security context request message, and the first identity authentication information is generated based on a shared key between the first node and the second node; and receiving a security context response message from the second node, where the security context response message includes second identity authentication information and a second MAC, a length of the second MAC being the target MAC length of the signaling plane, the second identity authentication information being used to verify the identity of the second node, and the second MAC being used to check the integrity of the security context response message. It further comprises:

[0134] In another possible implementation of the fifteenth aspect, the method further comprises the steps of: checking the integrity of the security context response message based on a target security algorithm of the signaling plane and a second MAC; performing verification on the second identity credential based on the shared key; and sending an association establishment message to the second node if the check on the integrity of the security context response message is successful and the verification on the second identity authentication information is successful, where the association establishment message indicates to the second node that it will establish an association with the first node. It further comprises:

[0135] According to a sixteenth aspect, an embodiment of the present application comprises: sending an association request message to the first node, where the association request message includes information about security algorithms supported by the second node and an identity of the second node; receiving a security context request message from the first node, where the security context request message includes information used to indicate a signaling plane target security algorithm, information used to indicate a user plane target security algorithm, a signaling plane target MAC length, a user plane target MAC length, and a first MAC; the signaling plane target security algorithm and the signaling plane target MAC length correspond to a first algorithm selection policy, and the signaling plane target security algorithm belongs to a set of security algorithms indicated by the information about security algorithms supported by the second node; the user plane target security algorithm and the user plane target MAC length correspond to a second algorithm selection policy and an identity of the second node, and the user plane target security algorithm belongs to a set of security algorithms indicated by the information about security algorithms supported by the second node; the first MAC length is the signaling plane target MAC length; and checking the integrity of the security context request message based on the first MAC by using a target security algorithm of the signaling plane; The present invention further provides a communication method comprising:

[0136] In an embodiment of the present application, different policies may be configured in the first node to determine different MAC lengths to improve the flexibility of the MAC length. Furthermore, the first node may determine a user plane target security algorithm and a user plane target MAC based on the identity of the second node to meet the requirements of different types of nodes for the MAC length. The second node obtains the target MAC length from the first node and protects message integrity by using the target MAC length. For example, some nodes that handle important services may use a relatively long MAC length to improve security. As another example, some assistant nodes or normal nodes may use a relatively short MAC length to reduce resource consumption and improve communication efficiency.

[0137] In a possible implementation of the sixteenth aspect, a target security algorithm for the signaling plane and a target MAC length for the signaling plane are determined according to a first algorithm selection policy, the target security algorithm for the signaling plane belongs to a set of security algorithms indicated by the information about security algorithms supported by the second node, and the first MAC is generated according to the target security algorithm for the signaling plane.

[0138] In another possible implementation of the sixteenth aspect, the user plane target security algorithm and the user plane target MAC length are determined according to a second algorithm selection policy, the user plane target security algorithm belongs to a set of security algorithms indicated by the information about security algorithms supported by the second node, and the first MAC is generated according to the signaling plane target security algorithm.

[0139] In another possible implementation of the sixteenth aspect, the security context request message further includes first identity authentication information. performing verification on the first identity authentication information based on a shared key between the second node and the first node; generating a second MAC by using the target security algorithm of the signaling plane if the check on the integrity of the security context request message is successful and the verification on the first identity authentication information is successful, where a length of the second MAC is the target MAC length of the signaling plane; and sending a security context response message to the first node, where the security context response message includes the second MAC and second identity authentication information, the second identity authentication information being generated based on the shared key between the second node and the first node; It further comprises:

[0140] In another possible implementation of the sixteenth aspect, the method further comprises receiving an association establishment message from the first node, the association establishment message indicating to the second node to establish an association with the first node.

[0141] According to a seventeenth aspect, an embodiment of the present application comprises: a receiving unit configured to receive an association request message from a second node, where the association request message includes information about security algorithms supported by the second node and an identity of the second node; and a processing unit configured to determine a target security algorithm for a signaling plane and a target MAC length for the signaling plane according to a first algorithm selection policy, where the target security algorithm for the signaling plane belongs to a set of security algorithms indicated by the information about the security algorithms supported by the second node. There is further provided a communication device comprising:

[0142] The processing unit is further configured to determine a user plane target security algorithm and a user plane target MAC length based on the second algorithm selection policy and the identity of the second node, where the user plane target security algorithm belongs to a set of security algorithms indicated by the information about security algorithms supported by the second node, and the user plane target MAC length is used to indicate a MAC length for performing integrity protection on data of the first service.

[0143] The processing unit is further configured to generate a first MAC by using a target security algorithm of the signaling plane, and a length of the first MAC is a target MAC length of the signaling plane.

[0144] In an embodiment of the present application, different policies may be configured in the above device to determine different MAC lengths to improve the flexibility of the MAC length. Furthermore, the above device may determine a user plane target security algorithm and a user plane target MAC based on the identity of the second node to meet the requirements of different types of nodes for the MAC length. For example, some nodes that handle important services may use a relatively long MAC length to improve security. As another example, some assistant nodes or normal nodes may use a relatively short MAC length to reduce resource consumption and improve communication efficiency.

[0145] In a possible implementation of the seventeenth aspect, the processing unit: determining the target security algorithm for the signaling plane and the target MAC length for the signaling plane according to a first length selection policy and the first algorithm selection policy; It is specifically configured to do so.

[0146] In another possible implementation of the seventeenth aspect, the processing unit: determining the target security algorithm for the signaling plane according to the first algorithm selection policy; and determining the target MAC length for the signaling plane according to the first length selection policy and the target security algorithm for the signaling plane; It is specifically configured to do so.

[0147] In another possible implementation of the seventeenth aspect, the processing unit: Determine the target security algorithm of the signaling plane according to the first algorithm selection policy, where a MAC length corresponding to the target security algorithm of the signaling plane is the target MAC length of the signaling plane. It is specifically configured to do so.

[0148] In another possible implementation of the seventeenth aspect, the processing unit determining a target security algorithm for the user plane according to a second algorithm selection policy; determining a second length selection policy based on the identity of the second node; and determining a target MAC length for the signaling plane based on a second length selection policy and a target security algorithm for the user plane; It is specifically configured to do so.

[0149] In another possible implementation of the seventeenth aspect, the processing unit determining a target security algorithm for the user plane according to a second algorithm selection policy; and Based on a MAC length supported by a target security algorithm of the user plane and a correspondence relationship between the identity and the MAC length of the second node, a MAC length corresponding to the identity of the second node is determined as a target MAC length of the user plane. It is specifically configured to do so.

[0150] In another possible implementation of the seventeenth aspect, the apparatus further comprises a transmitting unit, the transmitting unit configured to transmit a security context request message to a second node, the security context request message including a first MAC, information indicating a target security algorithm of a signaling plane, information indicating a target security algorithm of a user plane, a target MAC length of the signaling plane, and a target MAC length of the user plane, and the first MAC is used to check the integrity of the security context request message.

[0151] In another possible implementation of the seventeenth aspect, the apparatus further comprises a transmitting unit. The transmitting unit is configured to transmit a security context request message to a second node. The security context request message includes a first MAC, information indicating a target security algorithm of a signaling plane, information indicating a target security algorithm of a user plane, a target MAC length of the signaling plane, a target MAC length of the user plane, and a first identity authentication information. The first MAC is used to check the integrity of the security context request message, and the first identity authentication information is generated based on a shared key between the first node and the second node.

[0152] The receiving unit is further configured to receive a security context response message from the second node, the security context response message including second identity authentication information and a second MAC, the length of the second MAC being a target MAC length of the signaling plane, the second identity authentication information being used to verify the identity of the second node, and the second MAC being used to check the integrity of the security context response message.

[0153] In another possible implementation of the seventeenth aspect, the processing unit is further configured to check the integrity of the security context response message based on a target security algorithm of the signaling plane and the second MAC.

[0154] The processing unit is further configured to perform verification on the second identity credential based on the shared key.

[0155] The sending unit is further configured to send an association establishment message to the second node if the check on the integrity of the security context response message is successful and the verification on the second identity authentication information is successful, The association establishment message indicates to the second node to establish an association with the first node.

[0156] According to an eighteenth aspect, an embodiment of the present application comprises: a transmitting unit configured to transmit an association request message to a first node, where the association request message includes information about security algorithms supported by a second node and an identity of the second node; a receiving unit configured to receive a security context request message from a first node, where the security context request message includes information used to indicate a target security algorithm of a signaling plane, information used to indicate a target security algorithm of a user plane, a target MAC length of the signaling plane, a target MAC length of the user plane, and a first MAC; the target security algorithm of the signaling plane and the target MAC length of the signaling plane correspond to a first algorithm selection policy, and the target security algorithm of the signaling plane belongs to a set of security algorithms indicated by the information about security algorithms supported by the second node; the target security algorithm of the user plane and the target MAC length of the user plane correspond to a second algorithm selection policy and an identity of the second node, and the target security algorithm of the user plane belongs to a set of security algorithms indicated by the information about security algorithms supported by the second node; the length of the first MAC is the target MAC length of the signaling plane; and a processing unit configured to check the integrity of the security context request message based on the first MAC by using a target security algorithm of the signaling plane; There is further provided a communication device comprising:

[0157] In an embodiment of the present application, different policies may be configured in the first node to determine different MAC lengths to improve the flexibility of the MAC length. Furthermore, the first node may determine a user plane target security algorithm and a user plane target MAC based on the identity of the second node to meet the requirements of different types of nodes for the MAC length. The above device obtains the target MAC length from the first node and protects message integrity by using the target MAC length. For example, some nodes that handle important services may use a relatively long MAC length to improve security. As another example, some assistant nodes or normal nodes may use a relatively short MAC length to reduce resource consumption and improve communication efficiency.

[0158] In a possible implementation of the 18th aspect, a target security algorithm for the signaling plane and a target MAC length for the signaling plane are determined according to a first algorithm selection policy, the target security algorithm for the signaling plane belongs to a set of security algorithms indicated by the information about security algorithms supported by the second node, and the first MAC is generated according to the target security algorithm for the signaling plane.

[0159] In another possible implementation of the 18th aspect, the user plane target security algorithm and the user plane target MAC length are determined according to a second algorithm selection policy, the user plane target security algorithm belongs to a set of security algorithms indicated by the information about security algorithms supported by the second node, and the first MAC is generated according to the signaling plane target security algorithm.

[0160] In another possible implementation of the eighteenth aspect, the security context request message further includes a first identity authentication information. The processing unit performs a verification on the first identity authentication information based on a shared key between the second node and the first node; and If the check on the integrity of the security context request message is successful and the verification on the first identity authentication information is successful, generate a second MAC by using a target security algorithm of the signaling plane, where the length of the second MAC is a target MAC length of the signaling plane. It is further structured as follows.

[0161] The receiving unit is further configured to send a security context response message to the first node, the security context response message including a second MAC and a second identity authentication information, the second identity authentication information being generated based on a shared key between the second node and the first node.

[0162] In another possible implementation of the eighteenth aspect, the receiving unit is further configured to receive an association establishment message from the first node, the association establishment message indicating to the second node to establish an association with the first node.

[0163] According to a nineteenth aspect, an embodiment of the present application further provides a communication device, comprising at least one processor and a communication interface, the at least one processor configured to invoke a computer program stored in at least one memory, such that the device performs the method described in the first aspect or any one of the possible implementations of the first aspect, or the method described in the third aspect or any one of the possible implementations of the third aspect, or the method described in the sixth aspect or any one of the possible implementations of the sixth aspect, or the method described in the fifteenth aspect or any one of the possible implementations of the fifteenth aspect.

[0164] According to a twentieth aspect, an embodiment of the present application further provides a communication device, comprising at least one processor and a communication interface, the at least one processor configured to invoke a computer program stored in at least one memory, such that the device performs the method described in the second aspect or any one of the possible implementations of the second aspect, or the method described in the fourth aspect or any one of the possible implementations of the fourth aspect, or the method described in the fifth aspect or any one of the possible implementations of the fifth aspect, or the method described in the seventh aspect or any one of the possible implementations of the seventh aspect, or the method described in the sixteenth aspect or any one of the possible implementations of the sixteenth aspect.

[0165] According to a twenty-first aspect, an embodiment of the present application further provides a communication system. The communication system comprises a first node and a second node. The first node includes an apparatus as described in the eighth aspect or any one of the possible implementations of the eighth aspect. The second node includes an apparatus as described in the ninth aspect or any one of the possible implementations of the ninth aspect.

[0166] According to a twenty-second aspect, an embodiment of the present application further provides a communication system. The communication system comprises a first node and a second node. The first node includes an apparatus as described in the tenth aspect or any one of the possible implementations of the tenth aspect. The second node includes an apparatus as described in the eleventh aspect or any one of the possible implementations of the eleventh aspect.

[0167] According to a twenty-third aspect, an embodiment of the present application further provides a communication system. The communication system comprises a first node and a second node. The first node includes an apparatus as described in the tenth aspect or any one of the possible implementations of the tenth aspect. The second node includes an apparatus as described in the twelfth aspect or any one of the possible implementations of the twelfth aspect.

[0168] According to a twenty-fourth aspect, an embodiment of the present application further provides a communication system. The communication system comprises a first node and a second node. The first node includes an apparatus as described in the thirteenth aspect or any one of the possible implementations of the thirteenth aspect. The second node includes an apparatus as described in the fourteenth aspect or any one of the possible implementations of the fourteenth aspect.

[0169] According to a twenty-fifth aspect, an embodiment of the present application further provides a communication system. The communication system comprises a first node and a second node. The first node includes an apparatus as described in the seventeenth aspect or any one of the possible implementations of the seventeenth aspect. The second node includes an apparatus as described in the eighteenth aspect or any one of the possible implementations of the eighteenth aspect.

[0170] According to a twenty-sixth aspect, an embodiment of the present application discloses a computer-readable storage medium. The computer-readable storage medium stores a computer program. When the computer program is executed on one or more processors, the method described in the first aspect or any one of the possible implementations of the first aspect is performed, or the method described in the third aspect or any one of the possible implementations of the third aspect is performed, or the method described in the sixth aspect or any one of the possible implementations of the sixth aspect is performed, or the method described in the fifteenth aspect or any one of the possible implementations of the fifteenth aspect is performed.

[0171] According to a twenty-seventh aspect, an embodiment of the present application discloses a computer-readable storage medium. The computer-readable storage medium stores a computer program. When the computer program is executed on one or more processors, the method described in the second aspect or any one of the possible implementations of the second aspect is performed, or the method described in the fourth aspect or any one of the possible implementations of the fourth aspect is performed, or the method described in the fifth aspect or any one of the possible implementations of the fifth aspect is performed, or the method described in the seventh aspect or any one of the possible implementations of the seventh aspect is performed, or the method described in the sixteenth aspect or any one of the possible implementations of the sixteenth aspect is performed.

[0172] According to a twenty-eighth aspect, an embodiment of the present application discloses a chip system, comprising at least one processor and a communication interface, the at least one processor configured to call a computer program stored in at least one memory, so that an apparatus in which the chip system is arranged performs the method described in the first aspect or any one of the possible implementations of the first aspect, or the method described in the third aspect or any one of the possible implementations of the third aspect, or the method described in the sixth aspect or any one of the possible implementations of the sixth aspect, or the method described in the fifteenth aspect or any one of the possible implementations of the fifteenth aspect.

[0173] According to a twenty-ninth aspect, an embodiment of the present application discloses a chip system, comprising at least one processor and a communication interface, the at least one processor configured to call a computer program stored in at least one memory, such that an apparatus in which the chip system is arranged performs the method described in the second aspect or any one of the possible implementations of the second aspect, or the method described in the fourth aspect or any one of the possible implementations of the fourth aspect, or the method described in the fifth aspect or any one of the possible implementations of the fifth aspect, or the method described in the seventh aspect or any one of the possible implementations of the seventh aspect, or the method described in the sixteenth aspect or any one of the possible implementations of the sixteenth aspect.

[0174] According to a thirtieth aspect, the embodiment of the present application further provides a smart cockpit product. The smart cockpit product includes a first node (e.g., a vehicle cockpit domain controller CDC). The first node includes the device described in the first aspect or any one of the possible implementations of the first aspect, or the device described in the third aspect or any one of the possible implementations of the third aspect, or the device described in the sixth aspect or any one of the possible implementations of the sixth aspect, or the method described in the fifteenth aspect or any one of the possible implementations of the fifteenth aspect.

[0175] Furthermore, the smart cockpit product further comprises a second node (e.g., at least one of modules such as a camera, a screen, a microphone, a speaker, a radar, an electronic key, and a passive entry passive start system controller). The second node includes the device described in the second aspect or any one of the possible implementations of the second aspect, or the device described in the fourth aspect or any one of the possible implementations of the fourth aspect, or the device described in the fifth aspect or any one of the possible implementations of the fifth aspect, or the device described in the seventh aspect or any one of the possible implementations of the seventh aspect, or the method described in the sixteenth aspect or any one of the possible implementations of the sixteenth aspect.

[0176] According to a thirty-first aspect, an embodiment of the present application further provides a vehicle. The vehicle comprises a first node (e.g., a vehicle cockpit domain controller CDC). The first node includes an apparatus described in the first aspect or any one of the possible implementations of the first aspect, or an apparatus described in the third aspect or any one of the possible implementations of the third aspect, or an apparatus described in the sixth aspect or any one of the possible implementations of the sixth aspect, or a method described in the fifteenth aspect or any one of the possible implementations of the fifteenth aspect.

[0177] Furthermore, the vehicle further comprises a second node (e.g., at least one of modules such as a camera, a screen, a microphone, a speaker, a radar, an electronic key, and a passive entry passive start system controller). The second node includes an apparatus described in the second aspect or any one of the possible implementations of the second aspect, or an apparatus described in the fourth aspect or any one of the possible implementations of the fourth aspect, or an apparatus described in the fifth aspect or any one of the possible implementations of the fifth aspect, or an apparatus described in the seventh aspect or any one of the possible implementations of the seventh aspect, or a method described in the sixteenth aspect or any one of the possible implementations of the sixteenth aspect. [Brief description of the drawings]

[0178] The accompanying drawings used in the embodiments of the present application will be described below.

[0179] [Figure 1] FIG. 1 is a schematic diagram of the architecture of a communication system according to an embodiment of the present application;

[0180] [Diagram 2] FIG. 2 is a schematic diagram of an application scenario of a communication method according to an embodiment of the present application;

[0181] [Diagram 3] 1 is a schematic flowchart of a communication method according to an embodiment of the present application;

[0182] [Figure 4] FIG. 2 is a schematic diagram of an algorithm selection policy according to an embodiment of the present application.

[0183] [Diagram 5] FIG. 2 is a schematic diagram of a stage of determining a target MAC length in the signaling plane according to an embodiment of the present application;

[0184] [Figure 6]FIG. 2 is another schematic diagram of the stage of determining a target MAC length in the signaling plane according to an embodiment of the present application;

[0185] [Figure 7] FIG. 2 is another schematic diagram of the stage of determining a target MAC length in the signaling plane according to an embodiment of the present application;

[0186] [Figure 8] 4 is a schematic flowchart of another communication method according to an embodiment of the present application;

[0187] [Figure 9A] FIG. 2 is a schematic diagram of the step of determining a user plane target MAC length according to an embodiment of the present application; [Figure 9B] FIG. 2 is a schematic diagram of the step of determining a user plane target MAC length according to an embodiment of the present application;

[0188] [Figure 10] FIG. 2 is another schematic diagram of the step of determining a user plane target MAC length according to an embodiment of the present application;

[0189] [Figure 11] 4 is a schematic flowchart of another communication method according to an embodiment of the present application;

[0190] [Figure 12] 4 is a schematic flowchart of another communication method according to an embodiment of the present application;

[0191] [Figure 13] 4 is a schematic flowchart of another communication method according to an embodiment of the present application;

[0192] [Figure 14] 1 is a schematic diagram of the structure of a communication device according to an embodiment of the present application;

[0193] [Figure 15]1 is a schematic diagram of the structure of another communication device according to an embodiment of the present application;

[0194] [Figure 16] 1 is a schematic diagram of the structure of another communication device according to an embodiment of the present application;

[0195] [Figure 17] 1 is a schematic diagram of the structure of another communication device according to an embodiment of the present application;

[0196] [Figure 18] 1 is a schematic diagram of the structure of another communication device according to an embodiment of the present application;

[0197] [Figure 19] 1 is a schematic diagram of the structure of another communication device according to an embodiment of the present application;

[0198] [Figure 20] 1 is a schematic diagram of the structure of another communication device according to an embodiment of the present application;

[0199] [Figure 21] 1 is a schematic diagram of the structure of another communication device according to an embodiment of the present application;

[0200] [Figure 22] 1 is a schematic diagram of the structure of another communication device according to an embodiment of the present application;

[0201] [Figure 23] 1 is a schematic diagram of the structure of another communication device according to an embodiment of the present application;

[0202] [Figure 24] 1 is a schematic diagram of the structure of another communication device according to an embodiment of the present application;

[0203] [Diagram 25] 1 is a schematic diagram of the structure of another communication device according to an embodiment of the present application;

[0204] [Figure 26] 1 is a schematic diagram of the structure of another communication device according to an embodiment of the present application;

[0205] [Figure 27] 1 is a schematic diagram of the structure of another communication device according to an embodiment of the present application;

[0206] [Figure 28] 1 is a schematic diagram of the structure of another communication device according to an embodiment of the present application;

[0207] [Figure 29] 1 is a schematic diagram of the structure of another communication device according to an embodiment of the present application;

[0208] [Diagram 30] 1 is a schematic diagram of the structure of another communication device according to an embodiment of the present application;

[0209] [Diagram 31] 1 is a schematic diagram of the structure of another communication device according to an embodiment of the present application; DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0210] Hereinafter, the embodiments of the present application will be described with reference to the accompanying drawings of the embodiments of the present application. Please note that in this application, the words "example" or "for example" are used to indicate giving an example, illustration, or explanation. Any embodiment or design solution described by using "example" or "for example" in this application should not be construed as being preferred or more advantageous than another embodiment or design solution. The use of words such as "example" or "for example" is intended to present the related concept in a particular manner.

[0211] In the following, for ease of understanding, the relevant technologies and technical terms in this application will be briefly described.

[0212] 1. Node

[0213] A node is an electronic device that has data reception and transmission capabilities. For example, a node may be a vehicle cockpit domain device or a module in a vehicle cockpit domain device (one or more of modules such as a cockpit domain controller (CDC), a camera, a screen, a microphone, a speaker, an electronic key, and a passive entry passive start system controller). In a specific implementation process, a node may be a data transit device such as a router, a repeater, a bridge or a switch; or may be various types of terminal devices such as user equipment (UE), a mobile phone, a tablet computer (pad), a desktop computer, a headset or a speaker; or may include machine intelligent devices such as self-driving devices, transportation safety devices, virtual reality (VR) terminal devices, augmented reality (AR) terminal devices, machine type communication (MTC) devices, industrial control devices, remote medical devices, smart grid devices or smart city devices; or may include wearable devices (such as smart watches, smart bands or pedometers) or the like. In some technology scenarios, the name of a device with similar data receiving and transmitting capabilities may not be "node". However, for ease of explanation, electronic devices having data reception and transmission capabilities are collectively referred to as nodes in the embodiments of this application.

[0214] 2. Message authentication code (MAC)

[0215] Message Authentication Code (MAC) is a verification mechanism used by both communicating entities in encryption. It is a tool to ensure message integrity. Before sending a message, the sender first calculates the MAC by using an integrity protection algorithm (or even using a key) negotiated by both communicating parties. Then the MAC and the data are transmitted together. After receiving the packet, the receiver calculates the MAC by using the same integrity protection algorithm (or even using a key) as the sender and compares the calculated MAC with the received MAC. If they are the same, the message integrity check is successful.

[0216] For example, in a Long Term Evolution (LTE) system, the integrity protection function of LTE is located in the Packet Data Convergence Protocol (PDCP) layer, and a node at the transmitting side may perform integrity protection on the header and data part of a PDCP Protocol Data Unit (PDU). In particular, the node at the transmitting side calculates a 32-bit Message Authentication Code for Integrity (MAC-I) by using an integrity protection algorithm configured in an upper protocol layer and using at least one of parameters such as a key, a COUNT value, a radio bearer identifier, a DIRECTION, and a message as an input parameter, and then inserts the 32-bit Message Authentication Code for Integrity into the MAC-I domain of the PDCP PDU. After receiving a message, a node at the receiving side calculates an authentication code XMAC-I expected by the message by using the same method, and then performs an integrity check by comparing the XMAC-I with the MAC-I. If MAC-I is equal to XMAC-I, the receiver determines that the integrity check was successful; otherwise, if MAC-I is not equal to XMAC-I, the receiver determines that the integrity check failed.

[0217] 3. Integrity Protection Algorithm

[0218] A MAC may be generated by using an integrity protection algorithm, which may alternatively be referred to as a MAC algorithm, an integrity protection algorithm, etc. Optionally, the integrity protection algorithm may be implemented by using another encryption algorithm. For example, an integrity protection algorithm implemented by using a hash algorithm is referred to as a hash-based message authentication code (HMAC) algorithm. The hash algorithm may be one of MD5, SHA-1, SHA-256, and the like. These different HMAC implementations are commonly marked as HMAC-MD5, HMAC-SHA1, HMAC-SHA256, and the like. As another example, a MAC algorithm implemented based on a block cipher algorithm may be referred to as a Cipher-based Message Authentication Code (CMAC) algorithm, and the block cipher algorithm may be the Advanced Encryption Standard (AES). Since there are four operation modes of block encryption: ECB, CBC, CFB, and OFB, the integrity protection algorithm implemented based on the block encryption algorithm in different operation modes can be called ECB-MAC algorithm, CBC-MAC algorithm, etc. Furthermore, by improving the CBC-MAC algorithm, One-key Message Authentication Code (One-key CBC-MAC, OMAC) is obtained, which was listed as a recommended standard by the National Institute of Standards and Technology (NIST) in 2005.

[0219] Additionally, the integrity protection algorithm may further include a Galois message authentication code (GMAC), a ZUC encryption algorithm (such as ZUC128 and ZUC256), and a message digest (MD) algorithm (such as MD2, MD4, or MD5). Additionally, the encryption algorithm may further include a rapid amplification of cDNA ends (RACE) Integrity Primitives Evaluation Message Digest (RIPEMD) algorithm.

[0220] Furthermore, the integrity protection algorithm may combine two or more algorithms so that even if one of the algorithms is found to be weak, the other can still protect the message integrity. For example, in Transport Layer Security (TLS), the input data is split into two halves, and these two halves are processed respectively by using different integrity protection algorithms (MD5 and SHA-1), and then these two processed parts are XORed to obtain a MAC.

[0221] An integrity protection algorithm may be used to generate at least one length of MAC. Table 1 shows information about the length of MAC generated by using possible MAC algorithms provided in the embodiment of the present application. MAC generated by using CMAC algorithm usually supports 128-bit, 64-bit or 32-bit cipher block; the length of MAC generated by using GMAC may be from 32-bit to 128-bit; it can be seen that HMAC may be used to generate multiple length of digest as MAC. Table 1. MAC lengths generated by using different integrity protection algorithms [Table 1]

[0222] In some specific scenarios, for a given original text, data may be encrypted and a message authentication code may also be generated by using an authenticated encryption algorithm. Therefore, it may be considered that in the process of performing authentication and encryption on a message, integrity protection is performed on the message. For example, the AES algorithm based on GMAC (AES-Galois / Counter Mode, AES-GCM), the AES algorithm based on CMAC / Counter Mode (AES-CMAC / Counter Mode, AES-CCM), and the like may be used to perform authentication and encryption on a message, and a MAC may be generated in the process of performing authentication and encryption to protect the integrity of the message. Optionally, for the length of the MAC generated by using different authenticated encryption algorithms, please refer to the length of the MAC generated by using an integrity protection algorithm. For example, for the length of the MAC generated based on the AES-GCM algorithm, please refer to the length of the MAC generated by using GMAC.

[0223] 4.Shared key (SK)

[0224] In the communication process, data is transmitted between communicating nodes. If the data needs to be kept confidential, it needs to be encrypted by using a key. The shared key is the same secret value stored in the nodes of both communicating parties. The shared key may be predefined or preconfigured in the nodes of both communicating parties, or may be generated by both communicating parties by using the same key derivation method, or may be transmitted to the first node and the second node by a trusted device (such as a Key Distribution Center (KDC)).

[0225] For example, a cockpit domain controller (CDC) of a vehicle and an on-board radar device are two nodes that can communicate with each other. When deploying the CDC and the on-board radar, workers at an automobile factory pre-configure a shared key between the CDC and the on-board radar. By using the shared key, the security of the communication between the CDC of a vehicle and the on-board radar can be ensured.

[0226] As another example, the CDC and the vehicle owner's mobile phone are two nodes that can communicate with each other. The vehicle owner needs to associate with the vehicle's CDC by using the mobile phone, and the vehicle owner may obtain a shared key by using a key derivation method, for example, the shared key is generated by exchanging key agreement algorithm parameters between the mobile phone and the vehicle's CDC by using a key agreement algorithm. If the mobile phone subsequently requests to associate with the vehicle's CDC again, the shared key may be used to verify the identities of the two nodes.

[0227] 5. Key Derivation

[0228] Key derivation is the process of deriving one or more secret values ​​from a secret value. The algorithm used to derive a key is called a key derivation function (KDF) or a key derivation algorithm. For example, a new secret value DK derived from a secret value Key can be expressed as DK=KDF(Key).

[0229] Common key derivation algorithms include password-based key derivation function (PBKDF), scrypt algorithm, etc. The PBKDF algorithm further includes a first generation PBKDF1 and a second generation PBKDF2. Optionally, during a particular implementation, a hash algorithm may be used in the key derivation process to perform a hash modification on the input secret value. Thus, in the KDF, an algorithm identifier may further be received as an input to indicate the particular hash algorithm to be used.

[0230] 6. Signalling Plane and User Plane

[0231] In a communication system, there is usually a user plane and a control plane. With the emergence of Software Defined Networking (SDN) technology, control plane and user plane (CU) separation has gradually become the development direction of a communication system. The control plane is also called a signaling plane or control plane, and is usually used to transmit control signaling. For ease of explanation, the description in the embodiments of the present application will uniformly use "signaling plane". The user plane is also called a data plane, and is usually used to transmit user data. For ease of explanation, the description in the embodiments of the present application will uniformly use "user plane".

[0232] For example, in a voice call process, the control plane is used to transmit signaling used to control call procedure establishment, maintenance, and release, and the user plane is used to transmit voice data.

[0233] In some specific application scenarios, the network transmission is divided into a radio network layer and a transport network layer. The user plane in the radio network layer is the Circuit Switching Domain (CS) service (such as voice coding and video coding) or the Packet Switching Domain (PS) service, i.e., the true user data. The control plane in the radio network layer includes one or more of the Radio Access Network Application Part (RANAP), the Radio Network Subsystem Application Part (RNSAP) protocol, the NodeB Application Part (NBAP) protocol, and the like, and is used to control the signaling of the call process. The transport network layer is the lowest layer bearer. Therefore, the user plane in the transport network layer includes both user data and signaling data. In other words, the messages of the radio network layer (control plane and user plane) are the user plane messages of the transport network layer, and are carried by the transport network layer for transmission / reception. The control plane at the transport network layer is an independent control plane, located only at the transport network layer and used to set up transport bearers for user plane data at the radio network layer (creating, maintaining and releasing Asynchronous Transfer Mode Adaptation Layer (AAL2) connections).

[0234] Furthermore, it should be noted that "authentication", "check", and "verification" referred to in the embodiments of the present application may mean whether the check is correct or valid. In the embodiments of the present application, "association" refers to a process in which a first node establishes a connection to a second node. In some specific technical scenarios, "association" may alternatively be described as "access".

[0235] The following describes the system architecture and service scenarios in the embodiments of the present application. It should be noted that the system architecture and service scenarios described in the present application are intended to more clearly describe the technical solutions in the present application, and do not constitute limitations on the technical solutions provided in the present application. With the evolution of system architecture and the emergence of new service scenarios, those skilled in the art may recognize that the technical solutions provided in the present application can also be applied to similar technical problems.

[0236] 1 is a schematic diagram of an architecture of a communication system according to an embodiment of the present application. The communication system comprises a first node 101 and a second node 102. The second node 202 may request to associate with the first node 101. After successful association, the first node 101 may communicate with the second node 102 via a data link. Optionally, the data link used for communication between the first node 101 and the second node 102 may include various types of connection media, for example short-range connection technologies including 802.11b / g, Bluetooth, ZigBee, radio frequency identification (RFID) technology, Ultra Wideband (UWB) technology, and the like; as another example, long-range connection technologies including radio access type technologies such as Global System for Mobile communications (GSM), General Packet Radio Service (GPRS), and Universal Mobile Telecommunications System (UMTS). Of course, it is not excluded that other technologies may be used to support communication between the first node and the second node.

[0237] To ensure the security of the communication between the first node and the second node, the first node may perform integrity protection on the message by using a message authentication code. For example, the first node generates a MAC based on some or all of the data in the message by using an integrity protection algorithm (or further using an integrity protection key), adds the MAC in the message (e.g., in the prefix or suffix of the message), and sends the message to the second node. After receiving the message, the second node first generates a check value based on the corresponding part or all of the data by using a corresponding integrity protection algorithm (or further using a corresponding integrity protection key). If the check value matches the MAC, it indicates that the corresponding data in the message has not been tampered with.

[0238] Optionally, the first node 101 may be a communication initiator and may be referred to as a primary node or an access point (AP), and correspondingly, the second node 102 may be a communication receiver and may be referred to as a secondary node.

[0239] Moreover, the first node 101 and the second node 102 may be the same type of device or different type of device. For example, FIG. 2 is a schematic diagram of an application scenario of the communication method according to an embodiment of the present application. A cockpit domain controller (CDC) 201 in a vehicle is a control center in a smart cockpit device and may be regarded as the first node 101. A smartphone 202 is a device with data receiving and transmitting capabilities and may be regarded as the second node 102. A message sent by the CDC 201 to the smartphone 202 may carry a MAC, and the smartphone 202 receives the message, checks the integrity of the message by using the MAC, and then performs a corresponding operation based on the message. However, in the existing message authentication code technology, the length of the message authentication code is usually fixed, which is difficult to meet the requirements of users. For example, the smartphone 202 is connected to the CDC 201 by using Bluetooth. When the CDC 201 needs to send voice data to the smartphone 202, the in-car voice data has a relatively high privacy requirement, and since the length of the message authentication code in the Bluetooth communication process is 32 bits, the message authentication code is easy to be cracked by attackers and cannot meet the security requirement, so a longer MAC length is required to protect the data.

[0240] 3 is a schematic flowchart of a communication method according to an embodiment of the present application. The communication method may be implemented based on the communication system shown in FIG 1. The method includes at least the following steps:

[0241] Step S301: A second node sends an association request message to a first node.

[0242] In particular, the association request message includes information about security algorithms supported by the second node, which may be a name, an identifier, a predefined symbol, or the like of the security algorithms. The security algorithms supported by the second node include one or more of information about an integrity protection algorithm, information about an authenticated encryption algorithm, or the like. Optionally, the information about security algorithms supported by the second node may alternatively be referred to as security capabilities (Sec Capabilities) of the second node.

[0243] Table 2 is a possible algorithm information table provided in this embodiment of the present application. The information about security algorithms supported by the second node in the association request message may be an algorithm name or an algorithm identifier. For example, the information about security algorithms supported by the second node may be "GIA2, GIA3, GAC1", indicating that the second node supports the ZUC (ZUC) encryption algorithm, the AES-CMAC algorithm (particularly, the AES-CMAC algorithm supporting 64-bit MAC length and 128-bit MAC length), and the AES-GCM algorithm (particularly, the AES-GCM algorithm supporting 32-bit MAC length). As another example, the information about security algorithms supported by the second node may be "0010, 0011, 1000", indicating that the second node supports the ZUC (ZUC) encryption algorithm, the AES-CMAC algorithm, and the AES-GCM algorithm. Table 2 Algorithm Information Table [Table 2]

[0244] Optionally, the association request message may further include a fresh parameter obtained (or generated) by the second node. The fresh parameter may include at least one of a nonce (number once, NONCE), a counter, a sequence number, and the like. For ease of description, in the embodiment of the present application, the fresh parameter obtained (or generated) by the second node in the first association request message is referred to as a first fresh parameter.

[0245] Optionally, the first node may transmit an access message or a broadcast message, and the second node receives the access message or the broadcast message from the first node. The second node transmits a first association request message to the first node based on the access message or the broadcast message. In particular, the access message or the broadcast message of the first node may include at least one of an identity of the first node, descriptive information of the first node, information used to indicate access by another node, or the like.

[0246] Step S302: The first node determines a target security algorithm of the signaling plane and a target MAC length of the signaling plane according to a first algorithm selection policy.

[0247] In particular, the signaling plane target security algorithm includes one of a signaling plane integrity protection algorithm, an authenticated encryption algorithm, and the like. The signaling plane target security algorithm is used for integrity protection of a signaling plane message, and the signaling plane target security algorithm belongs to a set of security algorithms indicated by the information about security algorithms supported by the second node. For example, the information about security algorithms supported by the second node may be "GIA2, GIA3, GAC1", indicating that the second node supports a ZUC (ZUC) encryption algorithm, an AES-CMAC algorithm (particularly, an AES-CMAC algorithm supporting a 64-bit MAC length and a 128-bit MAC length), and an AES-GCM algorithm (particularly, an AES-GCM algorithm supporting a 32-bit MAC length). In this case, the target security algorithm for the signaling plane determined by the first node belongs to a set including the ZUC encryption algorithm, the AES-CMAC algorithm (in particular, the AES-CMAC algorithm supporting a 64-bit MAC length and a 128-bit MAC length), and the AES-GCM algorithm (in particular, the AES-GCM algorithm supporting a 32-bit MAC length).

[0248] The first algorithm selection policy may be a pre-configured or pre-defined selection policy in the first node. Optionally, the first algorithm selection policy may be implemented by using a priority, or may be implemented according to a pre-configured or pre-defined selection sequence, or may be implemented in the manner of an algorithm, a model, or the like. For example, FIG. 4 is a schematic diagram of a possible first algorithm selection policy according to an embodiment of the present application. Please refer to area 401. The priority of an algorithm whose identifier is "0001" (the corresponding algorithm is the AES-CMAC algorithm) is 1. This may indicate that the first node preferentially selects the AES-CMAC algorithm as the target security algorithm of the signaling plane (see Table 2 for details, which is the AES-CMAC algorithm that supports 32-bit MAC length). As another example, a first model is pre-configured in the first node. The first model is a neural network obtained through deep reinforcement learning training. This neural network is obtained through training by using multiple sample data. Thus, the first model may determine an optimal target security algorithm based on information about the security algorithms supported by the second node. In this manner, the first model may be considered as a first algorithm selection policy.

[0249] Optionally, the first node determining the target security algorithm of the signaling plane and the target MAC length of the signaling plane according to the first algorithm selection policy includes at least the following two cases:

[0250] Case 1: A first node determines a target security algorithm for a signaling plane and a target MAC length for a signaling plane according to a first length selection policy and a first algorithm selection policy. The first length selection policy may be a preconfigured or predefined selection policy in the first node, may be implemented by using a priority, or may be implemented according to a preconfigured or predefined selection sequence, or may be implemented in the manner of an algorithm, model, or the like. For example, the first length selection policy may be to select the longest MAC length or the shortest MAC length. Further optionally, selecting the longest MAC length may be a length selection policy configured as a default length selection policy in the first node.

[0251] Optionally, the first node determining the target security algorithm of the signaling plane and the target MAC length of the signaling plane according to the first length selection policy and the first algorithm selection policy may include, in particular, at least the following two implementations:

[0252] Implementation 1: A first node determines a target security algorithm for the signaling plane according to a first algorithm selection policy, and determines a target MAC length for the signaling plane according to a first length selection policy and the target security algorithm for the signaling plane.

[0253] For example, FIG. 5 is a schematic diagram of a method for determining possible target MAC lengths of a signaling plane according to an embodiment of the present application. With reference to region 501, it can be seen that the information about security algorithms supported by the second node indicates that the information about security algorithms supported by the second node is "0011, 1010", and indicates that the algorithms supported by the second node are AES-CMAC algorithm and AES-GCM algorithm. The first node implements a first algorithm selection policy in a priority order manner. With reference to region 502, it can be seen that the priority of the AES-CMAC algorithm is 2, and the priority of the AES-GCM algorithm is 3. Therefore, AES-CMAC is determined as the target security algorithm of the signaling plane according to the first algorithm selection policy. The MAC lengths supported by the AES-CMAC algorithm corresponding to the identifier "0011" are 64 bits and 128 bits. It can be seen that the priority of 64 bits is higher than the priority of 128 bits according to the first length selection policy shown in FIG. 5. Therefore, 64 bits is determined as the target MAC length for the signaling plane (see area 503).

[0254] As another example, the default first length selection policy configured in the first node may be to select the longest MAC length among the MAC lengths supported by the target security algorithm. For example, the MAC lengths supported by the AES-CMAC algorithm corresponding to the identifier "0011" are 64 bits and 128 bits, and the first node may select 128 bits as the target MAC length for the signaling plane by default. Alternatively, the default first length selection policy configured in the first node may be to select the shortest MAC length among the MAC lengths supported by the target security algorithm.

[0255] Implementation 2: A first node determines an algorithm or set of algorithms that supports a first length according to a first length selection policy. The first node determines a first algorithm in the algorithm or set of algorithms that supports the first length according to the first algorithm selection policy, and if the first algorithm is a security algorithm supported by the second node, determines the first algorithm as a target security algorithm for the signaling plane and determines the first length as a target MAC length for the signaling plane.

[0256] For example, Figure 6 is a schematic diagram of another possible method for determining a target MAC length of the signaling plane according to an embodiment of the present application. With reference to region 602, the first node determines an algorithm group (i.e., algorithms corresponding to identifiers "0011, 1010, and 1011", respectively) that supports a 128-bit MAC length according to a first length selection policy. With reference to region 603, the first node determines an algorithm with the highest priority (i.e., the AES-CMAC algorithm corresponding to identifier "0011") according to a first algorithm selection policy. With reference to region 601, it can be seen that the second node supports an algorithm corresponding to identifier "0011". Therefore, the AES-CMAC algorithm is determined as the target security algorithm of the signaling plane, and 128 bits is determined as the target MAC length of the signaling plane.

[0257] It may be understood that if an algorithm supporting a particular length is not supported by the second node, an algorithm or set of algorithms supporting the next length may be selected. For example, if an algorithm supporting 128 bits (i.e., algorithms corresponding to identifiers "0011, 1010, and 1011", respectively) is not supported by the second node, a target security algorithm may be selected from algorithms corresponding to MAC lengths of the next priority. Case 2: The first node determines a target security algorithm for the signaling plane according to a first algorithm selection policy, and the MAC length corresponding to the target security algorithm for the signaling plane is the target MAC length for the signaling plane. In particular, there may be at least two implementations:

[0258] Implementation 3: The target security algorithm of the signaling plane supports the generation of only one length MAC. In this case, the first node determines the target security algorithm of the signaling plane according to the first algorithm selection policy, and determines the MAC length supported by the target security algorithm of the signaling plane as the target MAC length of the signaling plane. For example, an algorithm whose identifier is "0001" (the corresponding algorithm is the AES-CMAC algorithm) supports the generation of only one length MAC of 32 bits. If the first node determines according to the first algorithm selection policy that the target security algorithm of the signaling plane is the algorithm whose identifier is "0001", the corresponding 32 bits are used as the target MAC length of the signaling plane. As another example, the HMAC256 algorithm is one of the HMAC algorithms and can generate only a 256-bit MAC length. Therefore, if the second node only supports the HMAC256 algorithm, then 256 bits corresponding to HMAC256 are used as the target MAC length in the signaling plane.

[0259] Implementation 4: The first node pre-stores a correspondence relationship between a target security algorithm and a MAC length, and the first node determines a MAC length corresponding to the target security algorithm of the signaling plane as the target MAC length of the signaling plane based on the correspondence relationship between the target security algorithm of the signaling plane and the MAC length. This correspondence relationship may be pre-configured or pre-defined. For example, FIG. 7 is a schematic diagram of another possible first algorithm selection policy according to an embodiment of the present application. Referring to area 701, the first algorithm policy may further indicate a correspondence relationship between security algorithms and lengths. Different correspondence relationships indicate different priorities. The priority of the AES-CMAC algorithm whose identifier is "0001" and the corresponding 32-bit MAC length is 1. After determining the AES-CMAC algorithm whose identifier is "0001" as the target security algorithm of the signaling plane according to the first algorithm selection policy, the first node determines, based on the correspondence relationship between the AES-CMAC algorithm and the MAC length, 32 bits corresponding to the AES-CMAC algorithm whose identifier is "0001" as the target MAC length of the signaling plane.

[0260] Step S303: The first node generates a first MAC by using the target security algorithm of the signaling plane.

[0261] In particular, the length of the first MAC is a target MAC length in the signaling plane, and the first MAC is used by the second node to check the integrity of the security context request message.

[0262] Optionally, in addition to the target security algorithm, when the first MAC is generated, a shared key (which may be an integrity protection key in particular) between the first node and the second node and message data on which integrity protection needs to be performed by using the first MAC are further requested. For example, the first MAC may be obtained according to a Cipher-based Message Authentication Code (CMAC) algorithm by using a shared key K1 (which may be an integrity protection key in particular) and some or all of the data other than the first MAC data1 in the security context request message. For example, the first MAC=CMAC(K1, data1).

[0263] Optionally, the communication method in this embodiment of the present application may further include step S304 or some or all of steps S304 to S311. Steps S304 to S311 are particularly as follows:

[0264] Step S304: The first node sends a security context request message to the second node.

[0265] In particular, the security context request message includes information used to indicate a target security algorithm of the signaling plane and information used to indicate a target MAC length of the signaling plane. Furthermore, the security context request message includes a first MAC. The length of the first MAC is the target MAC length of the signaling plane, and the first MAC is further used to check the integrity of the security context request message. In particular, the first MAC is used by the second node to check the integrity of the security context request message.

[0266] Optionally, the information used to indicate the target MAC length of the signaling plane may have at least the following multiple possible cases:

[0267] Case 1: The information used to indicate the signaling plane target MAC length may be the signaling plane target MAC length directly. For example, the security context request message includes "signaling plane MAC length: 64 bits", and the second node may obtain the signaling plane target MAC length based on the context request message. In this case, the security context request message includes the first MAC, the information used to indicate the signaling plane target security algorithm, and the signaling plane target MAC length.

[0268] Case 2: The information used to indicate the signaling plane target MAC length may be a first MAC. In particular, the length of the first MAC is the signaling plane target MAC length, and the second node may determine the signaling plane target MAC length based on the length of the first MAC. In this case, the security context request message includes the first MAC and the information used to indicate the signaling plane target security algorithm.

[0269] Case 3: If the determined target security algorithm of the signaling plane corresponds to only one MAC length, the information used to indicate the target MAC length of the signaling plane may be the information used to indicate the target security algorithm of the signaling plane. For example, an algorithm whose identifier is "0001" (corresponding algorithm is the AES-CMAC algorithm) supports the generation of MACs of only one length of 32 bits. Therefore, if the target security algorithm of the signaling plane corresponds to the identifier "0001", the identifier "0001" may be held in the security context request message. The identifier "0001" is used to indicate the target security algorithm of the signaling plane. Since this algorithm corresponds to only 32-bit MAC, this identifier may also indicate that the target MAC length of the signaling plane is 32 bits. In this case, the security context request message includes the first MAC and the information used to indicate the target security algorithm of the signaling plane.

[0270] It should be noted that the embodiment of the present application has an optional design. When the determined target security algorithm of the signaling plane corresponds to only one MAC length, the first node may add information indicating the target security algorithm of the signaling plane to the message sent to the second node, and the information indicating the target security algorithm of the signaling plane may also be used to indicate the target MAC length of the signaling plane. Correspondingly, when the determined target security algorithm of the user plane corresponds to only one MAC length, the first node may add information indicating the target security algorithm of the user plane to the message, and the information indicating the target security algorithm of the user plane may also be used to indicate the target MAC length of the user plane.

[0271] Optionally, the security context request message may further include a freshness parameter obtained (or generated) by the first node. The freshness parameter may include at least one of a nonce (number once, NONCE), a counter, a sequence number, and the like. For ease of explanation, the freshness parameter in the security context request message is referred to as a second freshness parameter.

[0272] Optionally, the security context request message further includes a first identity credential. The first identity credential is generated by the first node based on a shared key between the first node and the second node. The shared key may be a pre-shared key between the first node and the second node. For example, the first node may generate the first identity credential AUTHa based on the pre-shared key PSK by using the KDF, i.e., AUTHa=KDF(PSK). Optionally, if the association request message includes a first fresh parameter, the first identity credential may be generated based on the shared key and the first fresh parameter. For example, the first identity credential AUTHa is generated based on the pre-shared key PSK and the first fresh parameter NONCEe by using the KDF, e.g., AUTHa=KDF(PSK, NONCEe).

[0273] Further optionally, during actual processing, the parameters used by the first node to generate the first identity authentication information may further include other information. For example, the generated first identity authentication information AUTHa may satisfy AUTHa=KDF(PSK, association request message).

[0274] Further optionally, when the security context request message includes a second freshness parameter, the first identity authentication information AUTHa generated by the first node may further satisfy AUTHa=KDF(PSK, NONCEa, association request message), where NONCEa is the second freshness parameter in the security context request message.

[0275] Optionally, the first node may encrypt some or all of the data in the security context request message by using an encryption key, and correspondingly, the second node may receive the security context request message and decrypt the corresponding encrypted portion to obtain the message content.

[0276] Step S305: The second node checks the integrity of the security context request message based on the first MAC by using the target security algorithm of the signaling plane.

[0277] In particular, the second node checks the message integrity of the security context request message based on the first MAC, to prevent the content of the security context request message from being tampered with by an attacker.

[0278] In a possible solution, the first node generates the first MAC in a certain manner, and therefore the second node also generates the check value in the same manner. If the generated check value is the same as the first MAC, the message integrity check is successful. For example, if the first MAC is obtained by the first node by using a target security algorithm of the signaling plane based on the shared key K1 and part or all of the data data1 other than the first MAC in the security context request message, the second node also generates the check value check1 in the same manner, i.e., check1=CMAC(K1, data1). If check1 is the same as the first MAC, it indicates that the data data1 has not been tampered with and the integrity check for the security context request message is successful.

[0279] Optionally, if the integrity check fails, it indicates that the security context request message may have been tampered with by an attacker, and thus the second node may further include discarding the security context request message, or ignoring the security context request message, or skipping application of the target security algorithm in the security context request message, or skipping application of the target MAC information in the security context request message.

[0280] Step S306: The second node performs verification on the first identity authentication information based on the shared key between the second node and the first node.

[0281] In particular, the first identity authentication information is generated by the first node based on a shared key between the first node and the second node, and the second node then also verifies whether the first identity authentication information is correct based on the shared key.

[0282] In an optional solution, according to the protocol specification, if the first node uses a certain parameter to generate the first identity authentication information, the second node should also use the same parameter to generate the check information. If the check information is the same as the first identity authentication information, the verification is deemed successful. For example, the first identity authentication information is generated by using a KDF. Therefore, the second node may use a KDF to generate the check information, which is also referred to as a check value test1. The second node verifies whether the first identity authentication information is correct by using the check information. An example is used below for explanation.

[0283] For example, if the first identity authentication information AUTHa is KDF(PSK, NONCEe), the second node obtains the check value test1=KDF(PSK, NONCEe) based on the PSK and the first fresh parameter NONCEe by using KDF. If the check value test1 is the same as AUTHa, the verification is successful.

[0284] Optionally, if the verification for the first identity authentication information fails, it indicates that the identity of the first node is not trusted. Therefore, the second node may further include discarding the security context request message, or ignoring the security context request message, or skipping application of the target security algorithm in the security context request message, or skipping application of the target MAC length in the security context request message. Furthermore, the second node may be disconnected from the first node to associate with the correct node.

[0285] Optionally, the second node may first perform the operation of step S306, and then perform the operation of step S305.

[0286] Step S307: The second node generates a second MAC by using the target security algorithm of the signaling plane.

[0287] In particular, the length of the second MAC is a target MAC length of the signaling plane, and the second MAC is used by the first node to check the integrity of the security context response message. During a particular implementation, in addition to the target security algorithm, if the second MAC is generated, a shared key between the second node and the first node (which may in particular be an integrity protection key) and message data for which integrity protection needs to be performed by using the second MAC are further required.

[0288] For example, the second MAC may be obtained according to the CMAC algorithm by using the shared key K1 (which may be, in particular, an integrity protection key) and some or all of the non-second MAC data data2 in the security context response message, e.g., second MAC=CMAC(K1, data2).

[0289] Step S308: The second node sends a security context response message to the first node.

[0290] In particular, the security context response message includes a second MAC, and the second MAC is used to verify the integrity of the security context response message.

[0291] Optionally, the security context response message further includes a second identity credential. The second identity credential is generated by the second node based on a shared key between the second node and the first node. The shared key may be a pre-shared key between the second node and the first node. For example, the second node may generate the second identity credential AUTHe based on the pre-shared key PSK by using KDF, for example, AUTHe=KDF(PSK).

[0292] Optionally, when the security context request message includes a second fresh parameter, a second identity credential may be generated by the second node based on the shared key and the second fresh parameter. For example, the second node generates a second identity credential AUTHe based on the pre-shared key PSK and the second fresh parameter NONCEa by using the KDF, for example, AUTHe=KDF(PSK, NONCEa).

[0293] Further, optionally, during actual processing, the parameters used by the second node to generate the second identity authentication information may further include other information. For example, the generated second identity authentication information AUTHe may satisfy AUTHe=KDF(PSK, security context request message).

[0294] Further optionally, when the association request message includes a first fresh parameter, the second identity authentication information AUTHe generated by the second node may further satisfy AUTHe=KDF(PSK, NONCEa, security context request message), where NONCEa is the first fresh parameter in the association request message.

[0295] Optionally, the second node may encrypt some or all of the data in the security context response message by using an encryption key, and correspondingly, the first node may receive the security context response message and decrypt the corresponding encrypted portion to obtain the message content.

[0296] Step S309: The second node checks the integrity of the security context response message based on the second MAC by using the target security algorithm of the signaling plane.

[0297] In particular, the first node checks the message integrity of the security context response message based on the second MAC to prevent the content in the security context response message from being tampered with by an attacker.

[0298] In a possible solution, the second node generates the second MAC in a certain manner, and therefore the first node also generates the check value in the same manner. If the generated check value is the same as the second MAC, the message integrity check is successful. For example, if the second MAC is obtained by the second node by using a target security algorithm of the signaling plane based on the shared key K1 and part or all of the data data2 other than the second MAC in the security context request message, the first node also generates the check value check2 in the same manner, i.e., check2=CMAC(K1, data2). If check2 is the same as the second MAC, it indicates that the data data2 has not been tampered with and the integrity check for the security context request message is successful.

[0299] Optionally, if the integrity check fails, it indicates that the security context response message may have been tampered with by an attacker, and therefore the first node may further include discarding the security context response message, or ignoring the security context response message, or skipping application of the target security algorithm of the signaling plane, or skipping application of the target MAC length of the signaling plane.

[0300] Step S310: The first node performs verification on the second identity authentication information based on a shared key between the first node and the second node.

[0301] In particular, the second identity authentication information is generated by the second node based on a shared key between the second node and the first node, and the first node then also verifies whether the second identity authentication information is correct based on the shared key.

[0302] In an optional solution, according to the protocol specification, if the second node uses a certain parameter to generate the second identity authentication information, the first node should also use the same parameter to generate the check information. If the check information is the same as the second identity authentication information, the verification is deemed successful. For example, the second identity authentication information is generated by using a KDF. Therefore, the first node may use a KDF to generate the check information, which is also referred to as a check value test2. The first node verifies whether the second identity authentication information is correct by using this check information. In the following, an example is used for explanation.

[0303] For example, if the second identity authentication information AUTHe is KDF(PSK, NONCEa), the first node obtains the check value test2 to be KDF(PSK, NONCEa) based on the PSK and the second fresh parameter NONCEa by using KDF. If the check value test2 is the same as AUTHe, the verification is successful.

[0304] Optionally, if the verification for the second identity authentication information fails, it indicates that the identity of the second node is not trusted. Therefore, the first node may further include discarding the security context response message, or ignoring the security context response message, or skipping application of the target security algorithm of the signaling plane, or skipping application of the target MAC length of the signaling plane. Furthermore, the first node may be disconnected from the second node to associate with the correct node.

[0305] Optionally, the second node may first perform the operation of step S310, and then perform the operation of step S309.

[0306] Step S311: The first node sends an association establishment message to the second node.

[0307] In particular, the association establishment message may indicate to the second node to establish an association with the first node.

[0308] Optionally, the association establishment message may further carry a MAC that protects the integrity of the association establishment message. The MAC that protects the integrity of the association establishment message may be generated by using a target security algorithm of the signaling plane. The length of the MAC that protects the integrity of the association establishment message is the target MAC length of the signaling plane.

[0309] Optionally, the first node may encrypt some or all of the data in the association establishment message by using an encryption key, and correspondingly, the second node may receive the association establishment message and decrypt the corresponding encrypted portion to obtain the message content.

[0310] Optionally, the first node may further determine a target security algorithm of the user plane according to a second algorithm policy. The target security algorithm of the user plane belongs to a set of security algorithms indicated by the information about security algorithms supported by the second node. The target security algorithm of the user plane may be sent to the second node by using a security context request message, so that the second node receives the security context request message and obtains the target security algorithm of the user plane. Furthermore, optionally, the second algorithm policy and the first algorithm policy may be the same algorithm policy.

[0311] Optionally, the first node may further obtain an identifier of the first service and / or a data packet size of the first service. The first node may determine a user plane target MAC length based on at least one of a MAC length supported by a target security algorithm of the user plane and an identifier of the first service and a data packet size of the first service. The user plane target MAC length is used to indicate a MAC length for performing integrity protection on data of the first service. Further, optionally, the first node may send a resource scheduling message to the second node. The resource scheduling message includes the user plane target MAC length. Correspondingly, the second node receives the resource scheduling message to obtain the user plane target MAC length. It should be noted that the first service may be a service processed (or executed) by the second node, or a service processed by another node and forwarded by the second node.

[0312] In the method shown in Fig. 3, the first node determines a target security algorithm of the signaling plane and a target MAC length of the signaling plane based on information about security algorithms supported by the second node and according to a pre-configured or pre-defined algorithm policy, and then uses the target MAC length of the signaling plane as the MAC length of the signaling message between the first node and the second node. In this way, the first node may formulate different selection policies based on requirements and determine a MAC length that meets the requirements to improve the flexibility of the MAC length. For example, an algorithm with relatively high security may be selected from the algorithms supported by the second node, and a relatively long MAC length may be further selected so that it is difficult for an attacker to crack the MAC, thereby enhancing the integrity of the message protected by the MAC and improving data security in the node communication process.

[0313] 8 is a schematic flowchart of a communication method according to an embodiment of the present application. The communication method may be implemented based on the communication system shown in FIG 1. The method includes at least the following steps:

[0314] Step S801: The second node sends a service attribute report response message to the first node.

[0315] In particular, the service attribute report response message includes an identifier of the first service and / or a data packet size of the first service.

[0316] Optionally, the first node may send a service attribute report request message to one or more nodes, including the second node. In response, the second node receives the service attribute report request message from the first node and sends the service attribute report response message to the first node. In particular, the service attribute report request message of the first node may include at least one of the identity of the first node, identity description information of the first node, information used to indicate sending the service attribute report response message, or the like. After receiving the service attribute report request message, the second node sends a service attribute report response message to the first node.

[0317] Step S802: The first node determines a target MAC length of the user plane based on at least one of a MAC length supported by a target security algorithm of the user plane, an identifier of the first service, and a data packet size of the first service.

[0318] In particular, the user plane target MAC length is used to indicate the length of the MAC for performing integrity protection on the data of the first service. In a specific implementation process, at least the following four cases are included:

[0319] Case 1: The first node determines a second length selection policy based on an identifier of the first service and / or a data packet size of the first service. The second node determines a user plane target MAC length based on the second length selection policy and a MAC length supported by a user plane target security algorithm. The user plane target MAC length is used to indicate a MAC length that performs integrity protection on the data of the first service. The second length selection policy may be a pre-configured or pre-defined selection policy in the first node, and may be implemented by using a priority, or may be implemented according to a pre-configured or pre-defined selection sequence, or may be implemented in the manner of an algorithm, model, or the like.

[0320] For example, Figures 9A and 9B are schematic diagrams of a method for determining a user plane target MAC length according to an embodiment of the present application. Region 901 includes identification numbers (IDs) of several services, which may be used as identifiers of the services. Different service identifiers generally correspond to different services. For example, identifier "0001" indicates video upload, identifier "0002" indicates voice call, and identifier "0003" indicates audio playback. See region 902. It can be seen that different length selection policies can be determined based on identifiers of different services. For example, a video upload service whose identifier is "0001" corresponds to length selection policy A. The first node may determine that the length of the user plane target MAC is 128 bits (see region 904) based on the length selection policy A corresponding to the service and the length 903 supported by the user plane target security algorithm, and the MAC generated based on the MAC length is used to perform integrity protection on the data of the service whose identifier is "0001". Similarly, by referring to area 905, it can be seen that the length of the MAC for performing integrity protection for the service whose identifier is "0002" is 64 bits. By referring to area 906, it can be seen that the length of the MAC for performing integrity protection for the service whose identifier is "0003" is 64 bits.

[0321] It should be noted that it may be determined that integrity protection is not enabled for a service by using the identifier of the service. For example, referring to Figures 9A and 9B, integrity protection may not be enabled for the noise reduction service whose identifier is "0004". Furthermore, whether to enable integrity protection may alternatively be determined by using a length selection policy. For example, in length selection policy C, if the MAC length is 0, it indicates that integrity protection is not enabled.

[0322] As another example, Fig. 10 is a schematic diagram of a method for determining a target MAC length of a user plane according to an embodiment of the present application. In region 1001, identifiers and corresponding data packet sizes of several services are provided. For example, the data packet size corresponding to the identifier "0001" is 500 bits. See region 1002. It can be seen that different length selection policies can be determined based on different data packet sizes. For example, a data packet size between 65 bits and 256 bits corresponds to length selection policy F. Based on the length selection policy F corresponding to the data packet size and the length 1003 supported by the target security algorithm of the user plane, the first node may determine that the target MAC length of the user plane is 64 bits (see region 1004), and the MAC generated based on the MAC length is used to perform integrity protection on the data of the service whose identifier is "0002". Similarly, with reference to region 1004, it can be seen that the length of the MAC for performing integrity protection on the service whose identifier is "0001" is 128 bits. Of course, the data packet size shown in Figure 10 is just an example. In a specific implementation process, there may be another data packet size, or the corresponding length selection policy may be determined by using a range of data packet sizes. Details will not be described again in this specification.

[0323] Case 2: The first node determines a target MAC length for the user plane based on a MAC length supported by a target security algorithm for the user plane and an identifier of the first service.

[0324] Optionally, the correspondence between the identifier and the MAC length of the first service is in the first node, and the correspondence may be pre-configured or pre-defined. The first node may determine a MAC length corresponding to the identifier of the first service as a target MAC length of the user plane based on the MAC length supported by the target security algorithm of the user plane and the correspondence between the identifier and the MAC length of the first service. Table 3. Correspondence between service identifiers and MAC lengths [Table 3]

[0325] For example, Table 3 shows possible correspondences between identifiers and MAC lengths of services according to one embodiment of the present application. Identifier "0001" indicates a video upload service, and the corresponding MAC length is 128 bits. If the target security algorithm of the user plane supports a 128-bit MAC length, 128 bits may be determined as the target MAC length of the user plane.

[0326] It can be understood that if the target security algorithm of the user plane does not support the MAC length corresponding to the service, a relatively close MAC length may be selected as the target MAC length of the user plane from the lengths supported by the target security algorithm of the user plane. The specific implementation process is not described again.

[0327] Optionally, the service report request message may include identifiers of multiple services, and correspondingly, the first node may determine multiple corresponding target MAC lengths of the user plane, which are used separately to perform integrity protection on data of the multiple services.

[0328] Case 3: The first node determines a target MAC length for the user plane based on a MAC length supported by a target security algorithm for the user plane and a data packet size of the first service. In particular, the first node may pre-configure or pre-define a correspondence between a data packet size and a MAC length for the first service. The first node may determine a MAC length corresponding to the data packet size of the first service as the target MAC length for the user plane based on the correspondence between a MAC length supported by a target security algorithm for the user plane and a data packet size and a MAC length for the first service.

[0329] Case 4: If the target security algorithm of the user plane supports only one MAC length, the first node may determine the MAC length as the target MAC length of the user plane based on the MAC length corresponding to the target security algorithm of the user plane. For example, an algorithm whose identifier is "0001" (the corresponding algorithm is the AES-CMAC algorithm) supports the generation of only one length MAC of 32 bits. If the target security algorithm of the user plane is an algorithm whose identifier is "0001", the corresponding 32 bits are used as the target MAC length of the user plane. As another example, HMAC256 supports the generation of only 256-bit MAC length. Thus, if the target security algorithm of the user plane is the HMAC256 algorithm, the 256 bits corresponding to HMAC256 are used as the target MAC length of the user plane.

[0330] Optionally, before determining the target MAC length of the user plane, the first node first determines that integrity protection needs to be performed on the data of the first service. In particular, services of different service types have different integrity protection requirements. The first node may determine whether to enable integrity protection based on the identifier of the first service, and generate the corresponding target MAC of the user plane only for the service for which the integrity protection needs to be enabled, thus meeting the security requirements of the different services. For example, a video upload service is a service with a relatively high security requirement, so integrity protection needs to be performed on the data of the video upload service, and therefore the length of the MAC used to protect the data of this service needs to be determined. As another example, the identifier of the first service corresponds to a first service type, and integrity protection needs to be performed on the data of the service whose type is the first service type, and therefore the MAC length of the service belonging to the first service type is determined.

[0331] Optionally, the target security algorithm of the user plane belongs to a set of security algorithms indicated by the information about security algorithms supported by the second node. Optionally, the target security algorithm of the user plane may be determined by the first node by using a second algorithm selection policy, which may be a pre-configured or pre-defined selection policy in the first node. Optionally, the second algorithm selection policy may be implemented by using a priority order, or may be implemented according to a pre-configured or pre-defined selection order. For example, FIG. 4 is a schematic diagram of a possible algorithm selection policy according to an embodiment of the present application. See area 401. The priority order of the AES-CMAC algorithm is 1, indicating that if the second node supports the AES-CMAC algorithm, the AES-CMAC algorithm is preferentially selected as the target security algorithm of the user plane.

[0332] Optionally, the communication method in this embodiment of the present application may further include one or both of step S803 and step S804. Step S803 and step S804 are particularly as follows:

[0333] Step S803: The second node determines a target MAC length of the user plane based on at least one of a MAC length supported by a target security algorithm of the user plane and an identifier of the first service and a data packet size of the first service.

[0334] In particular, a method for determining a user plane target MAC length that is the same as that in the first node is configured in the second node, so that the user plane target MAC length can be determined on the second node. In a possible solution, according to the protocol specification, the first node determines the user plane target MAC length in a specific manner, and therefore the second node also determines the user plane target MAC length in the same manner. In this way, the node does not need to transmit the target MAC length to the peer node, saving network resources. It can be understood that for a specific method for determining the user plane target MAC length, reference is made to the specific description in step S802. Details will not be described again in this specification.

[0335] Step S804: The first node sends a resource scheduling message to the second node.

[0336] In particular, the resource scheduling message may include the user plane target MAC length, or the resource scheduling message includes information used to indicate the user plane target MAC length. Optionally, if the second node determines the user plane target MAC length by using step S803, the resource scheduling message may not include the user plane target MAC length.

[0337] Optionally, the second node may further send a resource response message to the first node, where the resource response message is used to indicate that the second node has received the resource scheduling message.

[0338] Optionally, the first node and / or the second node may further generate a third MAC by using the user plane target security algorithm and the user plane target MAC length, and the third MAC is used to perform integrity protection on the data of the first service. For example, if the first node determines that the MAC length of the video upload service (i.e., the service whose identifier is "0001") is 128 bits, the first node and / or the second node may generate a third MAC whose length is 128 bits. The third MAC is used to ensure the message integrity of the video upload service.

[0339] Optionally, the service attribute report request message, the service attribute report response message, the resource scheduling message, the resource response message, and the like are signaling plane messages. Thus, integrity protection may be performed on the message content by using a signaling plane target security algorithm. The signaling plane target security algorithm corresponds to a first algorithm selection policy. Further optionally, the first node may further obtain information about the security algorithm of the second node, and the first node may determine the signaling plane target security algorithm and the signaling plane target MAC length based on the first algorithm selection policy. The signaling plane target security algorithm belongs to a set of security algorithms indicated by the information about the security algorithms supported by the second node. The resource scheduling message is used as an example. The first node may generate a fourth MAC by using the signaling plane target security algorithm. The length of the fourth MAC is the signaling plane target MAC length. The fourth MAC may be kept in a prefix or suffix of the resource scheduling message to ensure the integrity of the resource scheduling message.

[0340] Further optionally, the first node may send a security context request message to the second node, the security context request message including a target security algorithm for the signaling plane, a target security algorithm for the user plane, and a target MAC length for the signaling plane. Correspondingly, the second node receives the security context request message to obtain the target security algorithm for the signaling plane, the target security algorithm for the user plane, and the target MAC length for the signaling plane.

[0341] In the method shown in FIG. 8, the first node may determine a user plane target MAC length based on a MAC length supported by a security algorithm of the user plane and an identifier of the first service and / or a data packet size of the first service, and then use the user plane target MAC length as the MAC length of messages used to process the first service. In this way, different MAC lengths can be determined for different services or services with different data packet sizes to improve the flexibility of the MAC length. For services with relatively high security, a relatively long MAC length may be used, which makes cracking difficult and improves data security. Furthermore, for some messages that do not have high security requirements or have relatively small data packets, a relatively short MAC length may be used to avoid affecting communication efficiency and reducing resource consumption during network transmission.

[0342] 11 is a schematic flowchart of a communication method according to an embodiment of the present application. The communication method may be implemented based on the communication system shown in FIG 1. The method includes at least the following steps:

[0343] Step S1101: The second node sends a service attribute report response message to the first node, and in response, the first node receives the service attribute report response message.

[0344] In particular, the service attribute report response message includes at least one service identifier, and further, the at least one service identifier may include an identifier of at least one second service, where the identifier of the at least one second service corresponds to a second service type, and no integrity protection needs to be performed on data of the service whose type is the second service type.

[0345] For example, Table 4 shows possible service types corresponding to service identifiers according to this embodiment of the present application. It can be seen that identifier "0001" indicates a video upload service, is a major service type, and integrity protection needs to be enabled. Correspondingly, identifier "0004" indicates an audio noise reduction service, is a minor service type, and integrity protection does not need to be enabled. Table 4 Service types corresponding to service identifiers [Table 4]

[0346] Step S1102: The first node sends a resource scheduling message to the second node.

[0347] In particular, the resource scheduling message includes information indicating to enable integrity protection and / or information indicating to not enable integrity protection. For services that do not need to enable integrity protection, the resource scheduling message may include information indicating not to enable integrity protection for that service. Correspondingly, for services that require integrity protection to be enabled, the resource scheduling message may include a MAC length indicating to perform integrity protection on the data of that service.

[0348] For example, the second service identifier corresponds to a second service type, and integrity protection does not need to be performed on data of the service whose type is the second service type. Thus, the resource scheduling message may include a first field, and data in the first field may be used to indicate that integrity protection is not enabled for the service corresponding to the at least one second service identifier. For example, when the data in the first field is "0", it indicates that integrity protection is not enabled for the service corresponding to the second service identifier.

[0349] The first node transmits a resource scheduling message to the second node, and in response, the second node receives the resource scheduling message from the first node.

[0350] Step S1103: The second node determines, based on the resource scheduling message, that integrity protection is not enabled for a service corresponding to the identifier of at least one second service. Note that this step is optional and is performed only when at least one second service exists.

[0351] In particular, the resource scheduling message may include a first field, and data in the first field may be used to indicate that integrity protection is not enabled for a service corresponding to the at least one second service identifier. For example, when the data in the first field is "0", it indicates that integrity protection is not enabled for a service corresponding to the second service identifier.

[0352] Step S1104: The second node determines, based on the resource scheduling message, that integrity protection is enabled for a service corresponding to the identifier of at least one first service. Note that this step is optional and is performed only when there is at least one first service. In particular, for a service for which integrity protection needs to be enabled, the resource scheduling message may include a MAC length indicating that integrity protection is performed on the data of the service. For example, the identifier of the first service corresponds to a first service type, and integrity protection needs to be performed on the data of the service whose type is the first service type. Therefore, the resource scheduling message includes information indicating that integrity protection is enabled for a service corresponding to the identifier of the first service. In particular, there may be three implementations:

[0353] Manner 1: The resource scheduling message may include a second field, and the data in the second field may be used to indicate that integrity protection is enabled. For example, if the data in the second field is “1”, it indicates that integrity protection is enabled for a service corresponding to the identifier of the first service.

[0354] Manner 2: If the resource scheduling message carries an algorithm / or MAC length for performing integrity protection on the data of the service, the resource scheduling message may indicate to the second node to enable integrity protection for the service. For example, the resource scheduling message includes a target MAC length of the user plane corresponding to the first service, or the resource scheduling message includes information used to indicate a target MAC length of the user plane corresponding to the first service. The target MAC length of the user plane corresponding to the first service is used to indicate a MAC length for performing integrity protection on the data of the first service. Furthermore, the target MAC length of the user plane corresponding to the first service may be determined based on the method described in the embodiment shown in FIG. 8, and the details will not be described again here.

[0355] Optionally, the second node may further send a resource response message to the first node, where the resource response message is used to indicate that the second node has received the resource scheduling message.

[0356] In the method shown in Figure 11, services of different service types have different integrity protection requirements. The first node may determine whether to enable integrity protection based on the identifier of the first service. For example, the audio noise reduction service is a service with a relatively low security requirement, so there may be no need for integrity protection to be performed on the data of the audio noise reduction service, and therefore the MAC length corresponding to the audio noise reduction service may not be determined.

[0357] Furthermore, the first node may add indication information to the resource scheduling message, so that the second node determines whether integrity protection is enabled for the service based on the indication information.

[0358] The embodiment of the above-mentioned method shown in Fig. 11 includes many possible implementation solutions. Some implementation solutions are described below with reference to Fig. 12. Please note that for related concepts or operations or logical relationships not described in Fig. 12, reference is made to the corresponding descriptions in the embodiment shown in Fig. 11.

[0359] 12 is a schematic flowchart of a communication method according to an embodiment of the present application. The communication method may be implemented based on the communication system shown in FIG 1. The method includes at least the following steps:

[0360] Step S1201: The second node sends a service attribute report response message to the first node.

[0361] In particular, the service attribute report response message includes at least one service identifier, and the at least one service identifier includes a service identifier of the first service. Optionally, the service attribute report response message may further include a data packet size of the at least one service, and the at least one data packet size includes the data packet size of the first service.

[0362] Optionally, the first node may send a service attribute report request message to one or more nodes including the second node, and the second node receives the service attribute report request message from the first node and sends a service attribute report response message to the first node.

[0363] Step S1202: The first node determines whether to enable integrity protection for the first service in the at least one service.

[0364] In particular, the first node may determine whether to enable integrity protection for a first service by using the identifier of the service. For example, Table 4 is possible service types corresponding to service identifiers according to this embodiment of the present application. The identifier "0001" indicates a video upload service, and it can be recognized that integrity protection needs to be enabled. Correspondingly, the identifier "0004" indicates an audio noise reduction service, and integrity protection does not need to be enabled.

[0365] Step S1203: If the first node determines that integrity protection needs to be enabled for the first service, the first node determines a target MAC length for the user plane based on at least one of a MAC length supported by a target security algorithm of the user plane and an identifier of the first service and a data packet size of the first service.

[0366] In particular, the service attribute report message includes a service identifier of the first service. Therefore, the first node may determine a target MAC length of the user plane based on the MAC length supported by the user plane and the identifier of the first service. Furthermore, optionally, if the service attribute report message includes a data packet size corresponding to the first service, the first node may determine a target MAC length of the user plane based on at least one of the MAC length supported by the target security algorithm of the user plane, the identifier of the first service, and the data packet size of the first service. The target MAC length of the user plane is used to indicate the length of the MAC for performing integrity protection on the data of the first service. For a specific method for determining the target MAC length of the user plane, please refer to the detailed description of step S802. Details will not be described again in this specification.

[0367] Step S1204: The first node sends a resource scheduling message to the second node.

[0368] In particular, if integrity protection needs to be enabled for the first service, the resource scheduling message includes a user plane target MAC length, or the resource scheduling message includes information used to indicate the user plane target MAC length, which is used to indicate the MAC length for performing integrity protection on the data of the first service.

[0369] Correspondingly, the second node may receive the resource scheduling message and obtain the target MAC length for the user plane.

[0370] Step S1205: If the first node determines that integrity protection does not need to be enabled for the first service, the first node sends a resource scheduling message to the second node.

[0371] In particular, when integrity protection does not need to be enabled for a first service, a first field may be present in the resource scheduling message, and data in the first field may be used to indicate that integrity protection is not enabled for a service corresponding to the identifier of the first service. For example, when the data in the first field is "0", it indicates that integrity protection is not enabled for a service corresponding to the identifier of the first service.

[0372] Optionally, the service attribute report response message may carry identifiers of multiple services. In this case, the second node may determine whether integrity protection is enabled for the multiple services. Correspondingly, the resource scheduling message may be used to indicate whether integrity protection is enabled for the multiple services. For the services for which integrity protection needs to be enabled, MAC lengths corresponding to the multiple services separately need to be further included.

[0373] In response, the second node may receive the resource scheduling message and decide not to enable integrity protection for the first service.

[0374] Optionally, the second node may further send a resource response message to the first node, which is used to indicate that the first node has received the resource scheduling message.

[0375] 13 is a schematic flowchart of a communication method according to an embodiment of the present application. The communication method may be implemented based on the communication system shown in FIG 1. The method includes at least the following steps:

[0376] Step S1301: A second node sends an association request message to a first node.

[0377] In particular, the first message includes information about security algorithms supported by the second node and an identity of the second node. The security algorithms supported by the second node include one or more of an encryption algorithm, an integrity protection algorithm, an authentication encryption algorithm, or the like, supported by the second node. Optionally, the information about the security algorithms supported by the second node may alternatively be referred to as security capabilities of the second node. The identity of the second node is also referred to as a device identifier of the second node, and the identity of the second node may be an ID, a media access control (MAC) address, a domain name, a domain address, or another user-defined identifier of the second node. The ID of the second node may be a fixed ID or a temporary ID.

[0378] Optionally, the first message may further include fresh parameters obtained (or generated) by the second node.

[0379] Optionally, the first node may send an access message or a broadcast message, and the second node receives the access message or the broadcast message from the first node and sends a first association request message to the first node.

[0380] Step S1302: The first node determines a target security algorithm of the signaling plane and a target MAC length of the signaling plane according to a first algorithm selection policy.

[0381] For a specific explanation, please refer to step S302.

[0382] Step S1303: The first node determines a user plane target security algorithm and a user plane target MAC length based on the identity of the second node and the second algorithm selection policy.

[0383] In particular, there are at least three possible approaches:

[0384] Manner 1: The first node determines a user plane target security algorithm according to a second algorithm selection policy. Furthermore, the first node determines a second length selection policy based on the identity of the second node, so that a user plane target MAC length may be determined based on the second length selection policy and the user plane target security algorithm.

[0385] Method 2: The first node determines a target security algorithm of the user plane according to a second algorithm selection policy, and further determines a MAC length corresponding to the identity of the second node as a target MAC length of the user plane based on the MAC length supported by the target security algorithm of the user plane and the correspondence between the identity and MAC length of the second node.

[0386] Manner 3: The first node determines a user plane target security algorithm based on a second algorithm selection policy. The first node may determine a second length selection policy and determine a user plane target MAC length according to the second length selection policy. The user plane target MAC length is a MAC length supported by the user plane target security algorithm. Optionally, the second length selection policy may be a pre-configured or pre-defined length selection policy in the first node. Thus, when the second length selection policy is determined, the identity of the second node may not be used.

[0387] Step S1304: The first node generates a first MAC by using the target security algorithm of the signaling plane.

[0388] For a specific explanation, please refer to step S303.

[0389] Optionally, the communication method in this embodiment of the present application may further include step S1305 or some or all of steps S1305 to S1312. Steps S1305 to S1312 are particularly as follows:

[0390] Step S1305: The first node sends a security context request message to the second node.

[0391] In particular, the security context request message includes a first MAC, information indicating a target security algorithm for the signaling plane, information indicating a target security algorithm for the user plane, information indicating a target MAC length for the signaling plane, and information indicating a target MAC length for the user plane, where the first MAC is used to verify the integrity of the security context request message. Optionally, the security context request message may further include a second fresh parameter obtained (or generated) by the first node.

[0392] Optionally, the security context request message further includes a first identity authentication information. The first identity authentication information is generated by the first node based on a shared key between the first node and the second node. For detailed description, please refer to the corresponding description in S304.

[0393] Optionally, the security context request message may be encrypted by using an encryption key of the first node. Correspondingly, after receiving the security context request message, the second node decrypts the message content by using the corresponding encryption key.

[0394] Step S1306: The second node checks the integrity of the security context request message based on the first MAC by using the target security algorithm of the signaling plane.

[0395] For a specific explanation, please refer to step S305.

[0396] Step S1307: The second node performs verification on the first identity authentication information based on the shared key between the second node and the first node.

[0397] For a specific explanation, please refer to step S306.

[0398] Step S1308: The second node generates a second MAC by using the target security algorithm of the signaling plane.

[0399] For a specific explanation, please refer to step S307.

[0400] Step S1309: The second node sends a security context response message to the first node.

[0401] For a specific explanation, please refer to step S308.

[0402] Step S1310: The second node checks the integrity of the security context response message based on the second MAC by using the target security algorithm of the signaling plane.

[0403] For a specific explanation, please refer to step S309.

[0404] Step S1311: The first node performs verification on the second identity authentication information based on a shared key between the first node and the second node.

[0405] For a specific explanation, please refer to step S310.

[0406] Step S1312: The first node sends an association establishment message to the second node.

[0407] In particular, the association establishment message indicates to a second node to establish an association with the first node.

[0408] For a specific explanation, please refer to step S311.

[0409] In the embodiment shown in FIG. 13, different policies may be configured in the first node to determine different MAC lengths to improve the flexibility of the MAC length. Furthermore, the first node may determine a user plane target security algorithm and a user plane target MAC based on the identity of the second node to meet the requirements of different types of nodes for the MAC length. For example, some nodes that handle important services may use a relatively long MAC length to improve security. As another example, some assistant nodes or normal nodes may use a relatively short MAC length to reduce resource consumption and improve communication efficiency.

[0410] The method in the embodiment of the present application has been described in detail above. The apparatus in the embodiment of the present application is provided below.

[0411] 14 is a schematic diagram of the structure of a communication device 140 according to an embodiment of the present application. The device 140 may be a node, or a component such as a chip or integrated circuit in a node. The device 140 may include a receiving unit 1401 and a processing unit 1402. The description of these units is as follows:

[0412] The receiving unit 1401 is configured to receive an association request message from a second node. The association request message includes information about security algorithms supported by the second node.

[0413] The processing unit 1402 is further configured to determine a target security algorithm for the signaling plane and a target MAC length for the signaling plane according to the first algorithm selection policy, where the target security algorithm for the signaling plane belongs to a set of security algorithms indicated by the information about security algorithms supported by the second node.

[0414] The processing unit 1402 is further configured to generate a first MAC by using a target security algorithm of the signaling plane, the length of the first MAC being a target MAC length of the signaling plane.

[0415] In this embodiment of the present application, the device 140 determines a target security algorithm of the signaling plane and a target MAC length of the signaling plane based on information about security algorithms supported by the second node and by using a pre-configured or pre-defined algorithm policy, and then uses the target MAC length of the signaling plane as the MAC length of the signaling message between the first node and the second node. In this way, different MAC lengths can be determined based on different policies configured in the device 140, and the flexibility of the MAC length is improved. Furthermore, the algorithm selection policy may be pre-configured or pre-defined based on the communication requirements of the first node. For example, an algorithm with a relatively high security and a relatively long MAC length may be preferentially selected to improve data security.

[0416] In a possible implementation, the processing unit 1402 may include: determining a target security algorithm for the signaling plane and a target MAC length for the signaling plane according to a first length selection policy and a first algorithm selection policy; It is specifically configured to do so.

[0417] In another possible implementation, the processing unit 1402 may: Determine a target security algorithm of the signaling plane according to the first algorithm selection policy, and a MAC length corresponding to the target security algorithm of the signaling plane is a target MAC length of the signaling plane. It is specifically configured to do so.

[0418] In another possible implementation, the device 140 A sending unit 1403 configured to send a security context request message to a second node, the security context request message including a first MAC, information indicating a target security algorithm of a signaling plane, and a target MAC length of the signaling plane, the first MAC being used to check the integrity of the security context request message. It further comprises:

[0419] In another possible implementation, the device 140 A sending unit 1403 configured to send a security context request message to a second node, the security context request message including a first MAC and information indicating a target security algorithm of a signaling plane, the first MAC being used to check the integrity of the security context request message, and the first MAC being further used to indicate a target MAC length of the signaling plane. It further comprises:

[0420] In another possible implementation, the apparatus further comprises a sending unit 1403 configured to send a security context request message to the second node, where the security context request message includes a first MAC, information indicating a target security algorithm of the signaling plane, a target MAC length of the signaling plane, and a first identity authentication information; the first MAC is used to check the integrity of the security context request message; and the first identity authentication information is generated based on a shared key between the first node and the second node.

[0421] The receiving unit 1401 is further configured to receive a security context response message from a second node, where the security context response message includes second identity authentication information and a second MAC, where the length of the second MAC is a target MAC length of a signaling plane, where the second identity authentication information is used to verify the identity of the second node, and the second MAC is used to check the integrity of the security context response message.

[0422] In another possible implementation, the security context request message further includes a target security algorithm of the user plane, and the processing unit 1402: Determine a target security algorithm for the user plane according to a second algorithm selection policy, where the target security algorithm for the user plane belongs to a set of security algorithms indicated by the information about security algorithms supported by the second node. It is specifically configured to do so.

[0423] In another possible implementation, the receiving unit 1401 is further configured to obtain an identifier of the first service and / or a data packet size of the first service.

[0424] The processing unit 1402 is further configured to determine a user plane target MAC length based on at least one of a MAC length supported by a user plane target security algorithm, an identifier of the first service, and a data packet size of the first service. The user plane target MAC length is used to indicate a MAC length for performing integrity protection on data of the first service.

[0425] The sending unit 1403 is further configured to send a resource scheduling message to the second node, where the resource scheduling message includes a target MAC length of the user plane.

[0426] Please note that for the implementation of each unit, reference is made to the corresponding description in the embodiment shown in Figure 3. The device 140 is the first node in the embodiment shown in Figure 3.

[0427] Furthermore, in the embodiment of the present application, the division of units in the device is merely a logical division based on functions, and is not used as a limitation to a specific structure of the device. In a specific implementation, some functional modules may be subdivided into smaller functional modules, or some functional modules may be combined into one functional module. However, regardless of whether these functional modules are subdivided or combined, the procedures performed are roughly the same. For example, the device 140 is used as an example. The receiving unit 1401 and the transmitting unit 1403 may alternatively be combined into a communication unit, and the communication unit is configured to implement the functions of the receiving unit 1401 and the transmitting unit 1403. Typically, each unit corresponds to the program code (or program instructions) of that unit. When the program code corresponding to that unit is executed on a processor, the units are enabled to execute corresponding procedures to implement the corresponding functions.

[0428] 15 is a schematic diagram of the structure of a communication device 150 according to an embodiment of the present application. The device 150 may be a node, or a component such as a chip or integrated circuit in a node. The device 150 may include a sending unit 1501 and a receiving unit 1502. The description of these units is as follows:

[0429] The sending unit 1501 is configured to send an association request message to the first node, where the association request message includes information about security algorithms supported by the second node.

[0430] The receiving unit 1502 is configured to receive a security context request message from a first node, where the security context request message includes information used to indicate a target security algorithm of a signaling plane and information used to indicate a target MAC length of the signaling plane, where the target security algorithm of the signaling plane and the target MAC length of the signaling plane correspond to a first algorithm selection policy, and where the target security algorithm of the signaling plane belongs to a set of security algorithms indicated by the information about security algorithms supported by the second node.

[0431] In this embodiment of the present application, the device 150 sends information about security algorithms supported by the second node to the first node. Based on the information about security algorithms supported by the second node and by using a pre-configured or pre-defined algorithm policy, the first node determines a target security algorithm of the signaling plane and a target MAC length of the signaling plane, and then uses the target MAC length of the signaling plane as the MAC length of the signaling message between the first node and the second node. In this way, different MAC lengths can be determined based on different policies configured in the device 150, and the flexibility of the MAC length is improved. For example, an algorithm with a relatively high security may be selected from the algorithms supported by the second node, and a relatively long MAC length may be further selected to improve data security.

[0432] In a possible implementation, the security context request message includes a first MAC, and the length of the first MAC is a target MAC length of a signaling plane. A processing unit 1503 configured to check the integrity of the security context request message based on the first MAC by using a target security algorithm of the signaling plane. It further comprises:

[0433] In a possible implementation, the first MAC is information used to indicate a target MAC length of the signaling plane. In a possible implementation, the security context request message further includes first identity authentication information. The processing unit is further configured to perform verification on the first identity authentication information based on a shared key between the second node and the first node.

[0434] The processing unit 1503 is further configured to generate a second MAC by using a target security algorithm of the signaling plane when the check on the integrity of the security context request message is successful and the verification on the first identity authentication information is successful, and the length of the second MAC is a target MAC length of the signaling plane.

[0435] The sending unit 1501 is further configured to send a security context response message to the first node, the security context response message including a second MAC and a second identity authentication information, the second identity authentication information being generated based on a shared key between the second node and the first node.

[0436] In another possible implementation, the security context request message further includes information indicating a target security algorithm for the user plane, where the target security algorithm for the user plane corresponds to a second algorithm selection policy, and where the target security algorithm for the user plane belongs to a set of security algorithms indicated by the information about security algorithms supported by the second node.

[0437] The receiving unit 1502 is further configured to receive a resource scheduling message from the first node, the resource scheduling message including a user plane target MAC length, the user plane target MAC length corresponding to at least one of a user plane target security algorithm and an identifier of the first service and a data packet size of the first service, the user plane target MAC length being used to indicate a MAC length for performing integrity protection on data of the first service.

[0438] Please note that for the implementation of each unit, reference is made to the corresponding description in the embodiment shown in Figure 3. The device 150 is a second node in the embodiment shown in Figure 3.

[0439] 16 is a schematic diagram of the structure of a communication device 160 according to an embodiment of the present application. The device 160 may be a node, or may be a component such as a chip or integrated circuit in a node. The device 160 may include a receiving unit 1601 and a processing unit 1602. The description of these units is as follows:

[0440] The receiving unit 1601 is configured to receive a service attribute report response message from the second node, where the service attribute report response message includes an identifier of the first service and / or a data packet size of the first service.

[0441] The processing unit 1602 is configured to determine a user plane target MAC length based on at least one of a MAC length supported by a user plane target security algorithm and an identifier of the first service and a data packet size of the first service, where the user plane target MAC length is used to indicate a MAC length for performing integrity protection on data of the first service.

[0442] In this embodiment of the present application, the device 160 determines a user plane target MAC length based on the MAC length supported by the security algorithm of the user plane, the identifier of the first service, and the data packet size of the first service, and then uses the user plane target MAC length as the MAC length of the message used to process the first service. In this way, different MAC lengths can be determined for different services or services with different data packet sizes to improve the flexibility of the MAC length. For services with relatively high security, a relatively long MAC length may be used, which makes cracking difficult and improves data security. Furthermore, for some messages that do not have high privacy requirements or have relatively small data packets, a relatively short MAC length may be used to avoid affecting communication efficiency and reducing resource consumption during network transmission.

[0443] In a possible implementation, the processing unit 1602 may include: Determine, based on a MAC length supported by a target security algorithm of the user plane and a correspondence relationship between the identifier and the MAC length of the first service, a MAC length corresponding to the identifier of the first service as a target MAC length of the user plane; or Based on a MAC length supported by a target security algorithm of the user plane and a correspondence relationship between a data packet size and a MAC length of the first service, a MAC length corresponding to the data packet size of the first service is determined as a target MAC length of the user plane. It is specifically configured to do so.

[0444] In another possible implementation, the processing unit 1602 may: determining a second length selection policy based on an identifier of the first service and / or a data packet size of the first service; and determining a target MAC length for the user plane based on a second length selection policy and a MAC length supported by a target security algorithm for the user plane; It is specifically configured to do so.

[0445] In another possible implementation, the identifier of the first service corresponds to a first service type, and integrity protection should be performed on data of the service whose type is the first service type.

[0446] In another possible implementation, the apparatus 160 further comprises a sending unit 1603 configured to send a resource scheduling message to the second node, where the resource scheduling message includes a target MAC length for the user plane.

[0447] In another possible implementation, the processing unit 1602 may: Generate a third MAC by using a target security algorithm of a user plane, where the length of the third MAC is a target MAC length of the user plane, and the third MAC is used to perform integrity protection on the data of the first service. It is further structured as follows.

[0448] In another possible implementation, the receiving unit 1601 is further configured to obtain information about security algorithms supported by the second node.

[0449] The processing unit 1602 is further configured to determine a signaling plane target security algorithm and a signaling plane target MAC length according to the first algorithm selection policy, where the signaling plane target security algorithm belongs to a set of security algorithms indicated by the information about security algorithms supported by the second node.

[0450] The processing unit 1602 is further configured to generate a fourth MAC by using a target security algorithm of the signaling plane, where the length of the fourth MAC is a target MAC length of the signaling plane.

[0451] The sending unit 1603 is further configured to send a resource scheduling message to the second node, the resource scheduling message including a fourth MAC and a user plane target MAC length, where the fourth MAC is used to perform integrity protection on the resource scheduling message.

[0452] In another possible implementation, the processing unit 1602 may: Determine a target security algorithm for the user plane according to a second algorithm selection policy, where the target security algorithm for the user plane belongs to a set of security algorithms indicated by the information about security algorithms supported by the second node. It is further structured as follows.

[0453] Please note that for the implementation of each unit, reference is made to the corresponding description in the embodiment shown in Figure 8. The device 160 is the first node in the embodiment shown in Figure 8.

[0454] 17 is a schematic diagram of the structure of a communication device 170 according to an embodiment of the present application. The device 170 may be a node, or may be a component such as a chip or integrated circuit in a node. The device 170 may include a sending unit 1701 and a receiving unit 1702. The description of these units is as follows:

[0455] The sending unit 1701 is configured to send a service attribute report response message to the first node, where the service attribute report response message includes an identifier of the first service and / or a data packet size of the first service.

[0456] The receiving unit 1702 is configured to receive a resource scheduling message from a first node, where the resource scheduling message includes a user plane target MAC length; the user plane target MAC length is a MAC length supported by a user plane target security algorithm, and the user plane target MAC length corresponds to at least one of an identifier of the first service and a data packet size of the first service; the user plane target MAC length is used to indicate a MAC length for performing integrity protection on data of the first service.

[0457] In an embodiment, services of different service types have different integrity protection requirements. The device 170 may determine whether to enable integrity protection based on the identifier of the first service. For example, an audio noise reduction service is a service with a relatively low security requirement, so integrity protection may not need to be performed on the data of the audio noise reduction service.

[0458] In a possible implementation, the identifier of the first service corresponds to a first service type, and integrity protection must be performed on data of the service whose type is the first service type.

[0459] In another possible implementation, the target security algorithm of the user plane corresponds to a second algorithm selection policy, and the target security algorithm of the user plane belongs to a set of security algorithms indicated by the information about security algorithms supported by the second node.

[0460] In another possible implementation, the resource scheduling message further includes a fourth MAC, and the processing unit: Checking message integrity of the resource scheduling message based on the fourth MAC by using a target security algorithm of the user plane. It is further structured as follows.

[0461] Please note that for the implementation of each unit, reference is made to the corresponding description in the embodiment shown in Figure 8. The device 170 is the second node in the embodiment shown in Figure 8.

[0462] 18 is a schematic diagram of the structure of a communication device 180 according to an embodiment of the present application. The device 180 may be a node, or a component such as a chip or integrated circuit in a node. The device 180 may include a sending unit 1801 and a processing unit 1802. The description of these units is as follows:

[0463] The sending unit 1801 is configured to send a service attribute report response message to the first node, where the service attribute report response message includes an identifier of the first service and / or a data packet size of the first service.

[0464] The processing unit 1802 is configured to determine a user plane target MAC length based on at least one of a MAC length supported by a user plane target security algorithm and an identifier of the first service and a data packet size of the first service, where the user plane target MAC length is used to indicate a MAC length for performing integrity protection on data of the first service.

[0465] A method for determining a user plane target MAC length that is the same as that in the first node is configured in the device 180. Thus, the device 180 may determine the user plane target MAC length based on the MAC length supported by the security algorithm of the user plane and the identifier of the first service and / or the data packet size of the first service, and then use the user plane target MAC length as the MAC length of messages used to process the first service. In this way, different MAC lengths can be determined for different services or services with different data packet sizes to improve the flexibility of the MAC length.

[0466] However, the same method for determining the user plane target MAC length is configured in both the device 180 and the first node, so that the first node determines the user plane target MAC length in a particular manner, and therefore the device 180 also determines the user plane target MAC length in the same manner. In this way, the node does not need to transmit the target MAC length to the peer node, saving network resources.

[0467] In another possible implementation, the processing unit 1802 may: According to a correspondence relationship between a MAC length supported by a target security algorithm of the user plane and an identifier ID and a MAC length of the first service, determine a MAC length corresponding to the identifier ID of the first service as a target MAC length of the user plane; or Based on a MAC length supported by a target security algorithm of the user plane and a correspondence relationship between a data packet size and a MAC length of the first service, a MAC length corresponding to the data packet size of the first service is determined as a target MAC length of the user plane. It is specifically configured to do so.

[0468] In another possible implementation, the processing unit 1802 may: determining a second length selection policy based on an ID of the first service and / or a data packet size of the first service; and determining a target MAC length for the user plane based on a second length selection policy and a MAC length supported by a target security algorithm for the user plane; It is specifically configured to do so.

[0469] In another possible implementation, the identifier of the first service corresponds to a first service type, and integrity protection should be performed on data of the service whose type is the first service type.

[0470] In another possible implementation, the target security algorithm of the user plane corresponds to a second algorithm selection policy, and the target security algorithm of the user plane belongs to a set of security algorithms indicated by the information about security algorithms supported by the second node.

[0471] Please note that for the implementation of each unit, reference is made to the corresponding description in the embodiment shown in Figure 8. The device 180 is the second node in the embodiment shown in Figure 8.

[0472] 19 is a schematic diagram of the structure of a communication device 190 according to an embodiment of the present application. The device 190 may be a node, or may be a component such as a chip or integrated circuit in a node. The device 190 may include a receiving unit 1901 and a transmitting unit 1902. The description of these units is as follows:

[0473] The receiving unit 1901 is configured to receive a service attribute report response message from a second node, where the service attribute report response message includes at least one service identifier, where the at least one service identifier includes an identifier of at least one second service, where the identifier of the at least one second service corresponds to a second service type, and where no integrity protection needs to be performed on data of a service whose type is the second service type.

[0474] The sending unit 1902 is configured to send a resource scheduling message to the second node, where the resource scheduling message is used to indicate that integrity protection is not enabled for a service corresponding to the identifier of the at least one second service.

[0475] It can be seen that services of different service types have different integrity protection requirements. The above device may determine whether to enable integrity protection based on the identifier of the first service. For example, the audio noise reduction service is a service with a relatively low security requirement, so there may be no need to perform integrity protection on the data of the audio noise reduction service, and therefore the MAC length corresponding to the audio noise reduction service may not be determined.

[0476] In a possible implementation, the at least one service identifier includes an identifier of at least one first service, the identifier of the at least one first service corresponds to a first service type, and integrity protection needs to be performed on data of a service whose type is the first service type.

[0477] In another possible implementation, the resource scheduling message is further used to indicate a target MAC length of the user plane to be used for the at least one first service.

[0478] Please note that for the implementation of each unit, reference is made to the corresponding description in the embodiment shown in Fig. 11 or 12. The device 190 may be the first node in the embodiment shown in Fig. 11 or 12.

[0479] 20 is a schematic diagram of the structure of a communication device 200 according to an embodiment of the present application. The device 200 may be a node, or a component such as a chip or integrated circuit in a node. The device 200 may include a sending unit 2001, a receiving unit 2002, and a processing unit 2003. The description of these units is as follows:

[0480] The sending unit 2001 is configured to send a service attribute report response message to the first node, where the service attribute report response message includes at least one service identifier, where the at least one service identifier includes an identifier of at least one second service, where the identifier of the at least one second service corresponds to a second service type, and where no integrity protection needs to be performed on data of a service whose type is the second service type.

[0481] The receiving unit 2002 is configured to receive a resource scheduling message from a first node.

[0482] The processing unit 2003 is configured to determine, based on the resource scheduling message, that integrity protection is not enabled for a service corresponding to the identifier of the at least one second service.

[0483] It can be seen that services of different service types have different integrity protection requirements. The first node may determine whether to enable integrity protection based on the identifier of the first service. For example, the audio noise reduction service is a service with a relatively low security requirement, so there may be no need for integrity protection to be performed on the data of the audio noise reduction service, and therefore the MAC length corresponding to the audio noise reduction service may not be determined.

[0484] In a possible implementation, the at least one service identifier includes an identifier of at least one first service, the identifier of the at least one first service corresponds to a first service type, and integrity protection needs to be performed on data of a service whose type is the first service type.

[0485] The processing unit 2003 is further configured to determine, based on the resource scheduling message, that integrity protection is enabled for a service corresponding to the identifier of the at least one first service.

[0486] In another possible implementation, the resource scheduling message is further used to indicate a MAC length for performing integrity protection on the data of the at least one first service.

[0487] Please note that for the implementation of each unit, reference is made to the corresponding description in the embodiment shown in Fig. 11 or 12. The device 200 is a second node in the embodiment shown in Fig. 11 or 12.

[0488] 21 is a schematic diagram of the structure of a communication device 210 according to an embodiment of the present application. The device 210 may be a node, or a component such as a chip or integrated circuit in a node. The device 210 may include a receiving unit 2101 and a processing unit 2102. The description of these units is as follows:

[0489] The receiving unit 2101 is configured to receive an association request message from a second node, where the association request message includes information about security algorithms supported by the second node and an identity of the second node.

[0490] The processing unit 2102 is configured to determine a target security algorithm for the signaling plane and a target MAC length for the signaling plane according to a first algorithm selection policy, where the target security algorithm for the signaling plane belongs to a set of security algorithms indicated by the information about security algorithms supported by the second node.

[0491] The processing unit 2102 is further configured to determine a user plane target security algorithm and a user plane target MAC length based on the second algorithm selection policy and the identity of the second node, where the user plane target security algorithm belongs to a set of security algorithms indicated by the information about security algorithms supported by the second node, and the user plane target MAC length is used to indicate a MAC length for performing integrity protection on data of the first service.

[0492] The processing unit 2102 is further configured to generate a first MAC by using a target security algorithm of the signaling plane, and the length of the first MAC is a target MAC length of the signaling plane.

[0493] In the embodiment of the present application, to improve the flexibility of the MAC length, different policies may be configured in the device 210 to determine different MAC lengths. Furthermore, the device 210 may determine a user plane target security algorithm and a user plane target MAC based on the identity of the second node to meet the requirements of different types of nodes for the MAC length. For example, some nodes that handle important services may use a relatively long MAC length to improve security. As another example, some assistant nodes or normal nodes may use a relatively short MAC length to reduce resource consumption and improve communication efficiency.

[0494] In a possible implementation, the processing unit 2102 may include: determining a target security algorithm for the signaling plane and a target MAC length for the signaling plane according to a first length selection policy and a first algorithm selection policy; It is specifically configured to do so.

[0495] In another possible implementation, the processing unit 2102 may: determining a target security algorithm for the signaling plane according to a first algorithm selection policy; and determining a signaling plane target MAC length according to a first length selection policy and a signaling plane target security algorithm; It is specifically configured to do so.

[0496] In another possible implementation, the processing unit 2102 may: Determine a target security algorithm of the signaling plane according to the first algorithm selection policy, and a MAC length corresponding to the target security algorithm of the signaling plane is a target MAC length of the signaling plane. It is specifically configured to do so.

[0497] In another possible implementation, the processing unit 2102 may: determining a target security algorithm for the user plane according to a second algorithm selection policy; and determining a second length selection policy based on the identity of the second node; and determining a target MAC length for the signaling plane based on a second length selection policy and a target security algorithm for the user plane; It is specifically configured to do so.

[0498] In another possible implementation, the processing unit 2102 may: determining a target security algorithm for the user plane according to a second algorithm selection policy; and Based on a MAC length supported by a target security algorithm of the user plane and a correspondence relationship between the identity and the MAC length of the second node, a MAC length corresponding to the identity of the second node is determined as a target MAC length of the user plane. It is specifically configured to do so.

[0499] In another possible implementation, the above apparatus further includes a sending unit 2103. The sending unit 2103 is configured to send a security context request message to a second node. The security context request message includes a first MAC, information indicating a target security algorithm of a signaling plane, information indicating a target security algorithm of a user plane, a target MAC length of the signaling plane, and a target MAC length of the user plane, and the first MAC is used to check the integrity of the security context request message.

[0500] In another possible implementation, the above apparatus further comprises a sending unit 2103. The sending unit 2103 is configured to send a security context request message to a second node. The security context request message includes a first MAC, information indicating a target security algorithm of a signaling plane, information indicating a target security algorithm of a user plane, a target MAC length of a signaling plane, a target MAC length of a user plane, and a first identity authentication information. The first MAC is used to check the integrity of the security context request message, and the first identity authentication information is generated based on a shared key between the first node and the second node.

[0501] The receiving unit 2101 is further configured to receive a security context response message from a second node, where the security context response message includes second identity authentication information and a second MAC, where the length of the second MAC is a target MAC length of a signaling plane, where the second identity authentication information is used to verify the identity of the second node, and the second MAC is used to check the integrity of the security context response message.

[0502] In another possible implementation, the processing unit 2102 is further configured to check the integrity of the security context response message based on a target security algorithm of the signaling plane and the second MAC.

[0503] The processing unit 2102 is further configured to perform verification on the second identity credential based on the shared key.

[0504] The apparatus further comprises a sending unit 2103 . The sending unit 2103 is configured to send an association establishment message to the second node if the check on the integrity of the security context response message is successful and the verification on the second identity authentication information is successful, where the association establishment message indicates to the second node to establish an association with the first node.

[0505] Please note that for the implementation of each unit, reference is made to the corresponding description in the embodiment shown in Figure 13. The device 210 is the first node in the embodiment shown in Figure 13.

[0506] 22 is a schematic diagram of the structure of a communication device 220 according to an embodiment of the present application. The device 220 may be a node, or a component such as a chip or integrated circuit in a node. The device 220 may include a sending unit 2201, a receiving unit 2202, and a processing unit 2203. The description of these units is as follows:

[0507] The sending unit 2201 is configured to send an association request message to a first node, where the association request message includes information about security algorithms supported by the second node and an identity of the second node.

[0508] The receiving unit 2202 is configured to receive a security context request message from a first node, the security context request message including information used to indicate a target security algorithm of a signaling plane, information used to indicate a target security algorithm of a user plane, a target MAC length of the signaling plane, a target MAC length of the user plane, and a first MAC; the target security algorithm of the signaling plane and the target MAC length of the signaling plane correspond to a first algorithm selection policy, and the target security algorithm of the signaling plane belongs to a set of security algorithms indicated by the information about security algorithms supported by the second node; the target security algorithm of the user plane and the target MAC length of the user plane correspond to a second algorithm selection policy and an identity of the second node, and the target security algorithm of the user plane belongs to a set of security algorithms indicated by the information about security algorithms supported by the second node; and the length of the first MAC is the target MAC length of the signaling plane.

[0509] The processing unit 2203 is configured to check the integrity of the security context request message based on the first MAC by using a target security algorithm of the signaling plane.

[0510] In the embodiment of the present application, different policies may be configured in the first node to determine different MAC lengths to improve the flexibility of the MAC length. Furthermore, the first node may determine a user plane target security algorithm and a user plane target MAC based on the identity of the second node to meet the requirements of different types of nodes for the MAC length. The device 220 obtains the target MAC length from the first node and protects message integrity by using the target MAC length. For example, some nodes that handle important services may use a relatively long MAC length to improve security. As another example, some assistant nodes or normal nodes may use a relatively short MAC length to reduce resource consumption and improve communication efficiency.

[0511] In a possible implementation, a signaling plane target security algorithm and a signaling plane target MAC length are determined according to a first algorithm selection policy, the signaling plane target security algorithm belongs to a set of security algorithms indicated by the information about security algorithms supported by the second node, and the first MAC is generated according to the signaling plane target security algorithm.

[0512] In another possible implementation, the user plane target security algorithm and the user plane target MAC length are determined according to a second algorithm selection policy, the user plane target security algorithm belongs to a set of security algorithms indicated by the information about security algorithms supported by the second node, and the first MAC is generated according to the signaling plane target security algorithm.

[0513] In another possible implementation, the security context request message further includes a first identity credential. The processing unit 2203 is further configured to perform verification on the first identity credential based on a shared key between the second node and the first node.

[0514] The processing unit 2202 is further configured to generate a second MAC by using a target security algorithm of the signaling plane when the check on the integrity of the security context request message is successful and the verification on the first identity authentication information is successful, and the length of the second MAC is a target MAC length of the signaling plane.

[0515] The receiving unit 2202 is further configured to send a security context response message to the first node, the security context response message including a second MAC and a second identity authentication information, the second identity authentication information being generated based on a shared key between the second node and the first node.

[0516] In another possible implementation, the receiving unit 2202 is further configured to receive an association establishment message from the first node, the association establishment message indicating to the second node to establish an association with the first node.

[0517] Please note that for the implementation of each unit, reference is made to the corresponding description in the embodiment shown in FIG 13. The device 220 is the second node in the embodiment shown in FIG 13.

[0518] 23 is a schematic diagram of the structure of a communication device 230 according to an embodiment of the present application. The device 230 may be a node or a component in a node. The device 230 may include at least one memory 2301 and at least one processor 2302. Optionally, the device may further include a bus 2303. Optionally, the device may further include a communication interface 2304. The memory 2301, the processor 2302 and the communication interface 2304 are connected through the bus 2303.

[0519] The memory 2301 is configured to provide a storage space that may store data such as an operating system and computer programs, etc. The memory 2301 may be one or a combination of random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), compact disc read-only memory (CD-ROM), or the like.

[0520] The processor 2302 is a module that performs arithmetic and / or logical operations and may be one or a combination of processing modules such as a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor unit (MPU), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA), and a complex programmable logic device (CPLD), among others.

[0521] The communication interface 2304 is configured to receive data transmitted from the outside and / or transmit data to the outside, and may be a wired link interface, such as an Ethernet cable, or may be a wireless link (Wi-Fi, Bluetooth, or the like) interface. Optionally, the communication interface 2304 may further include a transmitter (e.g., a radio frequency transmitter or antenna), a receiver, or the like coupled to the interface.

[0522] The processor 2302 in the device 230 is configured to read the computer program stored in the memory 2301 and execute the communication methods described above, for example the communication methods described in Figures 3, 8, 11, 12, or 13.

[0523] For example, the processor 2302 in the device 230 reads a computer program stored in the memory 2301 to perform the following operations: receiving an association request message from the second node via the communications interface 2304, the association request message including information about security algorithms supported by the second node; determining a signaling plane target security algorithm and a signaling plane target MAC length according to the first algorithm selection policy, the signaling plane target security algorithm belonging to a set of security algorithms indicated by the information about security algorithms supported by the second node; and generating a first MAC by using a signaling plane target security algorithm, the length of the first MAC being a signaling plane target MAC length; is configured to run

[0524] In this embodiment of the present application, the device 230 determines a target security algorithm of the signaling plane and a target MAC length of the signaling plane based on information about security algorithms supported by the second node and by using a pre-configured or pre-defined algorithm policy, and then uses the target MAC length of the signaling plane as the MAC length of the signaling message between the first node and the second node. In this way, different MAC lengths can be determined based on different policies configured in the device 230, and the flexibility of the MAC length is improved. Furthermore, the algorithm selection policy may be pre-configured or pre-defined based on the communication requirements of the first node. For example, an algorithm with a relatively high security and a relatively long MAC length may be preferentially selected to improve data security.

[0525] In one possible implementation, the processor 2302 may: determining a target security algorithm for the signaling plane and a target MAC length for the signaling plane according to a first length selection policy and a first algorithm selection policy; It is specifically configured to do so.

[0526] In another possible implementation, the processor 2302 may: determining a target security algorithm for the signaling plane according to a first algorithm selection policy; and determining a signaling plane target MAC length according to a first length selection policy and a signaling plane target security algorithm; It is specifically configured to do so.

[0527] In another possible implementation, the processor 2302 may: Determine a target security algorithm of the signaling plane according to the first algorithm selection policy, and a MAC length corresponding to the target security algorithm of the signaling plane is a target MAC length of the signaling plane. It is specifically configured to do so.

[0528] In another possible implementation, the processor 2302 is further configured to send a security context request message to the second node through the communication interface 2304, where the security context request message includes the first MAC, information indicating a target security algorithm for the signaling plane, and a target MAC length for the signaling plane, where the first MAC is used to check the integrity of the security context request message.

[0529] The apparatus 230 may add information indicating a target security algorithm of the signaling plane and a target MAC length of the signaling plane to the security context request message, so that the second node knows that it may obtain the target security algorithm of the signaling plane and the target MAC length of the signaling plane by using the security context request message. Furthermore, the security context request message may carry a first MAC used by the second node to check the integrity of the security context request message to prevent the security context request message from being tampered with by an attacker.

[0530] In another possible implementation, the processor 2302 is further configured to send a security context request message to the second node through the communication interface 2304, the security context request message including a first MAC and information indicating a target security algorithm of the signaling plane, the first MAC being used to check integrity of the security context request message, and the first MAC being further used to indicate a target MAC length of the signaling plane.

[0531] In another possible implementation, after determining the target security algorithm of the signaling plane and the target MAC length of the signaling plane according to the first algorithm selection policy, the processor 2302: sending a security context request message to the second node through the communication interface 2304, the security context request message including a first MAC, information indicating a target security algorithm for the signaling plane, a target MAC length for the signaling plane, and first identity authentication information, the first MAC being used to check the integrity of the security context request message, and the first identity authentication information being generated based on a shared key between the first node and the second node; and receiving a security context response message from a second node through the communication interface 2304, the security context response message including second identity authentication information and a second MAC, the length of the second MAC being a target MAC length of the signaling plane, the second identity authentication information being used to verify the identity of the second node, and the second MAC being used to check the integrity of the security context response message; It is further structured as follows.

[0532] The shared key is a secret value shared between the first node and the second node, and may be used to generate an identity credential for verifying the identity of the node. The device 230 may generate the first identity credential by using the shared key, and it is found that the first identity credential is used by the second node to verify the identity of the first node. Correspondingly, the first node may also verify the identity of the second node by using the second identity credential. If an attacker wants to obtain the target security algorithm of the signaling plane or the target MAC length of the signaling plane by forging the identity of the second node, the verification performed by the device 230 on its identity cannot succeed because the shared key cannot be forged. Thus, the first node is avoided from communicating with untrusted nodes, and the communication security of the first node is improved.

[0533] In another possible implementation, the processor 2302 may: Checking the integrity of the security context response message based on the target security algorithm and the second MAC of the signaling plane; performing verification on the second identity credential based on the shared key; and If the check on the integrity of the security context response message is successful and the verification on the second identity authentication information is successful, send an association establishment message to the second node, the association establishment message indicating to the second node that it will establish an association with the first node. It is further structured as follows.

[0534] In another possible implementation, the security context request message further includes a target security algorithm for a user plane. The processor 2302 is further configured to determine a target security algorithm for the user plane according to a second algorithm selection policy, where the target security algorithm for the user plane belongs to a set of security algorithms indicated by the information about security algorithms supported by the second node.

[0535] In another possible implementation, the processor 2302 may: Obtaining an identifier of a first service and / or a data packet size of the first service; determining a user plane target MAC length based on at least one of a MAC length supported by a user plane target security algorithm and an identifier of the first service and a data packet size of the first service, where the user plane target MAC length is used to indicate a MAC length for performing integrity protection on the data of the first service; and Send a resource scheduling message to the second node through the communication interface 2304, the resource scheduling message including a target MAC length for the user plane. It is further structured as follows.

[0536] It can be seen that the target MAC length of the user plane may be determined based on the MAC length supported by the security algorithm of the user plane, the identifier of the first service, and the data packet size of the first service. Different MAC lengths may be determined for different services or services with different data packet sizes, which improves the flexibility of the MAC length. For services with relatively high security, a relatively long MAC length may be used, which makes cracking difficult and improves data security.

[0537] Please note that for the implementation of each unit, reference is made to the corresponding description in the embodiment shown in Figure 3. The device 230 is the first node in the embodiment shown in Figure 3.

[0538] 24 is a schematic diagram of a structure of a communication device 240 according to an embodiment of the present application. The device 240 may be a node or a component in a node. The device 240 may include at least one memory 2401 and at least one processor 2402. Optionally, the device may further include a bus 2403. Optionally, the device may further include a communication interface 2404. The memory 2401, the processor 2402 and the communication interface 2404 are connected through the bus 2403.

[0539] The memory 2401 is configured to provide a storage space, which may store data such as an operating system and computer programs, etc. The memory 2401 may be one or a combination of RAM, ROM, EPROM, CD-ROM, and the like.

[0540] The processor 2402 is a module that performs arithmetic and / or logical operations, and may be one or a combination of processing modules such as a CPU, GPU, MPU, ASIC, FPGA, and CPLD, among others.

[0541] The communication interface 2404 is configured to receive data transmitted from the outside and / or transmit data to the outside, and may be a wired link interface, such as an Ethernet cable, or may be a wireless link (Wi-Fi, Bluetooth, or the like) interface. Optionally, the communication interface 2404 may further include a transmitter (e.g., a radio frequency transmitter or antenna), a receiver, or the like coupled to the interface.

[0542] The processor 2402 in the device 240 is configured to read the computer program stored in the memory 2401 and to execute the communication method described above, for example the communication method illustrated in FIG.

[0543] For example, the processor 2402 in the device 240 may read a computer program stored in the memory 2401 to perform the following operations: sending an association request message to the first node over the communication interface 2404, the association request message including information about security algorithms supported by the second node; and receiving a security context request message from a first node through the communication interface 2404, the security context request message including information used to indicate a target security algorithm of a signaling plane, a target MAC length of the signaling plane, and a first MAC, the target security algorithm of the signaling plane and the target MAC length of the signaling plane correspond to a first algorithm selection policy, and the target security algorithm of the signaling plane belongs to a set of security algorithms indicated by the information about security algorithms supported by the second node; is configured to run

[0544] In this embodiment of the present application, the device 240 sends information about security algorithms supported by the second node to the first node. The first node determines a target security algorithm of the signaling plane and a target MAC length of the signaling plane based on the information about security algorithms supported by the second node and by using a pre-configured or pre-defined algorithm policy, and then uses the target MAC length of the signaling plane as the MAC length of the signaling message between the first node and the second node. In this way, different MAC lengths can be determined based on different policies configured in the device 240, and the flexibility of the MAC length is improved. For example, an algorithm with a relatively high security may be selected from the algorithms supported by the second node, and a relatively long MAC length may be further selected to improve data security.

[0545] In a possible implementation, the security context request message includes a first MAC, and the length of the first MAC is a target MAC length of the signaling plane. The processor 2402 is particularly configured to check the integrity of the security context request message based on the first MAC by using the target security algorithm of the signaling plane.

[0546] In a possible implementation, the first MAC is information used to indicate the target MAC length of the signaling plane.

[0547] In a possible implementation, a signaling plane target security algorithm and a signaling plane target MAC length are determined according to a first algorithm selection policy, and the first MAC is generated according to the signaling plane target security algorithm.

[0548] In another possible implementation, the security context request message further includes the first identity authentication information. performing verification on the first identity credential based on a shared key between the second node and the first node; If the check on the integrity of the security context request message is successful and the verification on the first identity authentication information is successful, generate a second MAC by using a target security algorithm of the signaling plane, and the length of the second MAC is a target MAC length of the signaling plane; and Send a security context response message to the first node through the communication interface 2404, the security context response message including a second MAC and a second identity authentication information, the second identity authentication information being generated based on a shared key between the second node and the first node. It is further structured as follows.

[0549] In another possible implementation, the processor 2402 is further configured to receive an association establishment message from the first node through the communication interface 2404. The association establishment message indicates to the second node to establish an association with the first node.

[0550] In another possible implementation, the security context request message further includes information indicating a target security algorithm of a user plane, where the target security algorithm of the user plane corresponds to a second algorithm selection policy, and the target security algorithm of the user plane belongs to a set of security algorithms indicated by the information about security algorithms supported by the second node. receiving a resource scheduling message from the first node through the communication interface 2404, where the resource scheduling message includes a user plane target MAC length, the user plane target MAC length corresponding to at least one of a user plane target security algorithm and an identifier of the first service and a data packet size of the first service, the user plane target MAC length being used to indicate a MAC length for performing integrity protection on data of the first service; It further comprises:

[0551] It can be seen that, in order to improve the flexibility of the MAC length, different MAC lengths can be determined for different services or services with different data packet sizes. For services with relatively high security, a relatively long MAC length may be used, which makes cracking difficult and improves data security.

[0552] Further, the first node may add information indicating a user plane target security algorithm and a user plane target MAC length to the resource scheduling message, so that the device 240 may obtain the user plane target security algorithm and the user plane target MAC length by using the resource scheduling message.

[0553] Please note that for the implementation of each unit, reference is made to the corresponding description in the embodiment shown in Figure 3. The device 240 is the second node in the embodiment shown in Figure 3.

[0554] 25 is a schematic diagram of the structure of a communication device 240 according to an embodiment of the present application. The device 250 may be a node or a component in a node. The device 250 may include at least one memory 2501 and at least one processor 2502. Optionally, the device may further include a bus 2503. Optionally, the device may further include a communication interface 2504. The memory 2501, the processor 2502 and the communication interface 2504 are connected through the bus 2503.

[0555] The memory 2501 is configured to provide a storage space, which may store data such as an operating system and computer programs, etc. The memory 2501 may be one or a combination of RAM, ROM, EPROM, CD-ROM, and the like.

[0556] The processor 2502 is a module that performs arithmetic and / or logical operations, and may be one or a combination of processing modules such as a CPU, GPU, MPU, ASIC, FPGA, and CPLD, among others.

[0557] The communication interface 2504 is configured to receive data transmitted from the outside and / or transmit data to the outside, and may be a wired link interface, such as an Ethernet cable, or may be a wireless link (Wi-Fi, Bluetooth, or the like) interface. Optionally, the communication interface 2504 may further include a transmitter (e.g., a radio frequency transmitter or antenna), a receiver, or the like coupled to the interface.

[0558] The processor 2502 in the device 250 is configured to read the computer program stored in the memory 2501 and to execute the communication method described above, for example the communication method illustrated in FIG.

[0559] For example, the processor 2502 in the device 250 reads a computer program stored in the memory 2501 to perform the following operations: receiving a service attribute report response message from the second node through the communication interface 2504, the service attribute report response message including an identifier of the first service and / or a data packet size of the first service; and determining a user plane target MAC length based on at least one of a MAC length supported by a user plane target security algorithm, an identifier of the first service, and a data packet size of the first service, wherein the user plane target MAC length is used to indicate a MAC length for performing integrity protection on data of the first service; is configured to run

[0560] In this embodiment of the present application, the device 250 determines a user plane target MAC length based on the MAC length supported by the security algorithm of the user plane, the identifier of the first service, and the data packet size of the first service, and then uses the user plane target MAC length as the MAC length of the message used to process the first service. In this way, different MAC lengths can be determined for different services or services with different data packet sizes to improve the flexibility of the MAC length. For services with relatively high security, a relatively long MAC length may be used, which makes cracking difficult and improves data security. Furthermore, for some messages that do not have high privacy requirements or have relatively small data packets, a relatively short MAC length may be used to avoid affecting communication efficiency and reducing resource consumption during network transmission.

[0561] In a possible implementation, the processor 2502 determines a target MAC length for the user plane based on a MAC length supported by a target security algorithm for the user plane and an identifier of the first service; or Determine a target MAC length for the user plane based on a MAC length supported by a target security algorithm for the user plane and a data packet size of the first service. It is specifically configured to do so.

[0562] In another possible implementation, the processor 2502 may: Determine, based on a MAC length supported by a target security algorithm of the user plane and a correspondence relationship between the identifier and the MAC length of the first service, a MAC length corresponding to the identifier of the first service as a target MAC length of the user plane; or Based on a MAC length supported by a target security algorithm of the user plane and a correspondence relationship between a data packet size and a MAC length of the first service, a MAC length corresponding to the data packet size of the first service is determined as a target MAC length of the user plane. It is specifically configured to do so.

[0563] In another possible implementation, the step of determining a target MAC length for the user plane based on at least one of a target security algorithm for the user plane and an identifier of the first service and a data packet size of the first service comprises: determining a second length selection policy based on an identifier of the first service and / or a data packet size of the first service; and determining a user plane target MAC length based on a second length selection policy and a MAC length supported by a user plane target security algorithm; Includes.

[0564] In another possible implementation, the identifier of the first service corresponds to a first service type, and integrity protection should be performed on data of the service whose type is the first service type.

[0565] Services of different service types have different integrity protection requirements. The first node may determine whether to enable integrity protection based on the identifier of the first service, and generate corresponding target MACs of the user plane only for the services for which integrity protection needs to be enabled, thus meeting the security requirements of different services. For example, a video upload service is a service with a relatively high security requirement, so that integrity protection needs to be performed on the data of the video upload service, and therefore the length of the MAC used to protect the data of this service needs to be determined.

[0566] In another possible implementation, the processor 2502 is further configured to send a resource scheduling message to the second node through the communication interface 2504, where the resource scheduling message includes the target MAC length for the user plane.

[0567] In a possible implementation, the method comprises: generating a third MAC by using a target security algorithm of a user plane, the length of the third MAC being a target MAC length of the user plane, the third MAC being used to perform integrity protection on the data of the first service; It further comprises:

[0568] In another possible implementation, the processor 2502 may: Obtaining information about security algorithms supported by the second node; determine a signaling plane target security algorithm and a signaling plane target MAC length according to the first algorithm selection policy, where the signaling plane target security algorithm belongs to a set of security algorithms indicated by the information about security algorithms supported by the second node; generating a fourth MAC by using a signaling plane target security algorithm, the length of the fourth MAC being a signaling plane target MAC length; and Send a resource scheduling message to the second node through the communication interface 2504, the resource scheduling message including a fourth MAC and a user plane target MAC length, the fourth MAC being used to perform integrity protection on the resource scheduling message. It is further structured as follows.

[0569] In another possible implementation, the processor 2502 may: The second node is further configured to determine a target security algorithm for the user plane according to a second algorithm selection policy, the target security algorithm for the user plane belonging to a set of security algorithms indicated by the information about security algorithms supported by the second node.

[0570] Please note that for the implementation of each unit, reference is made to the corresponding description in the embodiment shown in Figure 8. The device 250 is the first node in the embodiment shown in Figure 8.

[0571] 26 is a schematic diagram of a structure of a communication device 260 according to an embodiment of the present application. The device 260 may be a node or a component in a node. The device 260 may include at least one memory 2601 and at least one processor 2602. Optionally, the device may further include a bus 2603. Optionally, the device may further include a communication interface 2604. The memory 2601, the processor 2602 and the communication interface 2604 are connected through the bus 2603.

[0572] The memory 2601 is configured to provide a storage space, which may store data such as an operating system and computer programs, etc. The memory 2601 may be one or a combination of RAM, ROM, EPROM, CD-ROM, and the like.

[0573] The processor 2602 is a module that performs arithmetic and / or logical operations, and may be one or a combination of processing modules such as a CPU, GPU, MPU, ASIC, FPGA, and CPLD, among others.

[0574] The communication interface 2604 is configured to receive data transmitted from the outside and / or transmit data to the outside, and may be a wired link interface, such as an Ethernet cable, or may be a wireless link (Wi-Fi, Bluetooth, or the like) interface. Optionally, the communication interface 2604 may further include a transmitter (e.g., a radio frequency transmitter or antenna), a receiver, or the like coupled to the interface.

[0575] The processor 2602 in the device 260 is adapted to read the computer program stored in the memory 2601 and to execute the communication method previously described, for example the communication method illustrated in FIG.

[0576] For example, the processor 2602 in the device 260 may The computer program stored in the memory 2601 is read to perform the following operations: sending a service attribute report response message to the first node through the communication interface 2604, the service attribute report response message including an identifier of the first service and / or a data packet size of the first service; and receiving a resource scheduling message from a first node through the communication interface 2604, the resource scheduling message including a user plane target MAC length; the user plane target MAC length is a MAC length supported by a user plane target security algorithm, the user plane target MAC length corresponding to at least one of an identifier of the first service and a data packet size of the first service; the user plane target MAC length is used to indicate a MAC length for performing integrity protection on data of the first service. is configured to run

[0577] In an embodiment, services of different service types have different integrity protection requirements. The device 260 may determine whether to enable integrity protection based on the identifier of the first service. For example, an audio noise reduction service is a service with a relatively low security requirement, so integrity protection may not need to be performed on the data of the audio noise reduction service.

[0578] Furthermore, the first node may add indication information to the resource scheduling message, so that the second node determines whether integrity protection is enabled for the service based on the indication information.

[0579] In a possible implementation, the target MAC length of the user plane is determined based on at least one of a MAC length supported by a target security algorithm of the user plane and an identifier of the first service and a data packet size of the first service.

[0580] In another possible implementation, the identifier of the first service corresponds to a first service type, and integrity protection should be performed on data of the service whose type is the first service type.

[0581] Services of different service types have different integrity protection requirements. The first node may determine whether to enable integrity protection based on the identifier of the first service, and generate corresponding target MACs of the user plane only for the services for which integrity protection needs to be enabled, thus meeting the security requirements of different services. For example, a video upload service is a service with a relatively high security requirement, so that integrity protection needs to be performed on the data of the video upload service, and therefore the length of the MAC used to protect the data of this service needs to be determined.

[0582] In another possible implementation, the target security algorithm of the user plane corresponds to a second algorithm selection policy, and the target security algorithm of the user plane belongs to a set of security algorithms indicated by the information about security algorithms supported by the second node.

[0583] In another possible implementation, the resource scheduling message further includes a fourth MAC, and the processor 2602 is further configured to check message integrity of the resource scheduling message based on the fourth MAC by using a user plane target security algorithm.

[0584] Please note that for the implementation of each unit, reference is made to the corresponding description in the embodiment shown in Figure 8. The device 260 is the second node in the embodiment shown in Figure 8.

[0585] 27 is a schematic diagram of a structure of a communication device 270 according to an embodiment of the present application. The device 270 may be a node or a component in a node. The device 270 may include at least one memory 2701 and at least one processor 2702. Optionally, the device may further include a bus 2603. Optionally, the device may further include a communication interface 2704. The memory 2701, the processor 2702 and the communication interface 2704 are connected through the bus 2703.

[0586] The memory 2601 is configured to provide a storage space, which may store data such as an operating system and computer programs. The memory 2701 may be one or a combination of RAM, ROM, EPROM, CD-ROM, and the like.

[0587] The processor 2702 is a module that performs arithmetic and / or logical operations, and may be one or a combination of processing modules such as a CPU, GPU, MPU, ASIC, FPGA, and CPLD, among others.

[0588] The communication interface 2704 is configured to receive data transmitted from the outside and / or transmit data to the outside, and may be a wired link interface, such as an Ethernet cable, or may be a wireless link (Wi-Fi, Bluetooth, or the like) interface. Optionally, the communication interface 2704 may further include a transmitter (e.g., a radio frequency transmitter or antenna), a receiver, or the like coupled to the interface.

[0589] The processor 2702 in the device 270 is configured to read the computer program stored in the memory 2701 to execute the communication method described above, for example the communication method illustrated in FIG.

[0590] For example, the processor 2702 in the device 270 may read a computer program stored in the memory 2701 to perform the following operations: sending a service attribute report response message to the first node through the communication interface 2704, the service attribute report response message including an identifier of the first service and / or a data packet size of the first service; and determining a user plane target MAC length based on at least one of a MAC length supported by a user plane target security algorithm, an identifier of the first service, and a data packet size of the first service, wherein the user plane target MAC length is used to indicate a MAC length for performing integrity protection on data of the first service; is configured to run

[0591] The device 270 is configured with a method for determining a user plane target MAC length that is the same as that in the first node. Thus, the device 270 may determine the user plane target MAC length based on the MAC length supported by the user plane security algorithm and the identifier of the first service and / or the data packet size of the first service, and then use the user plane target MAC length as the MAC length of messages used to process the first service. In this way, different MAC lengths can be determined for different services or services with different data packet sizes to improve the flexibility of the MAC length.

[0592] However, the same method for determining the user plane target MAC length is configured in both the device 270 and the first node, so that the first node determines the user plane target MAC length in a particular manner, and therefore the device 270 also determines the user plane target MAC length in the same manner. In this way, the node does not need to transmit the target MAC length to the peer node, saving network resources.

[0593] In one possible implementation, the processor 2702 may: According to a correspondence relationship between a MAC length supported by a target security algorithm of the user plane and an identifier ID and a MAC length of the first service, determine a MAC length corresponding to the identifier ID of the first service as a target MAC length of the user plane; or Based on a MAC length supported by a target security algorithm of the user plane and a correspondence relationship between a data packet size and a MAC length of the first service, a MAC length corresponding to the data packet size of the first service is determined as a target MAC length of the user plane. It is specifically configured to do so.

[0594] In one possible implementation, the processor 2702 may: determining a user plane target MAC length based on a MAC length supported by a user plane target security algorithm and an identifier of the first service; or Determine a target MAC length for the user plane based on a MAC length supported by a target security algorithm for the user plane and a data packet size of the first service. It is specifically configured to do so.

[0595] In another possible implementation, the processor 2702 may: determining a second length selection policy based on an ID of the first service and / or a data packet size of the first service; and determining a target MAC length for the user plane based on a second length selection policy and a MAC length supported by a target security algorithm for the user plane; It is specifically configured to do so.

[0596] In another possible implementation, the identifier of the first service corresponds to a first service type, and integrity protection should be performed on data of the service whose type is the first service type.

[0597] Services of different service types have different integrity protection requirements. The first node may determine whether to enable integrity protection based on the identifier of the first service, and generate corresponding target MACs of the user plane only for the services for which integrity protection needs to be enabled, thus meeting the security requirements of different services. For example, a video upload service is a service with a relatively high security requirement, so that integrity protection needs to be performed on the data of the video upload service, and therefore the length of the MAC used to protect the data of this service needs to be determined.

[0598] In another possible implementation, the target security algorithm of the user plane corresponds to a second algorithm selection policy, and the target security algorithm of the user plane belongs to a set of security algorithms indicated by the information about security algorithms supported by the second node.

[0599] Please note that for the implementation of each unit, reference is made to the corresponding description in the embodiment shown in Figure 8. The device 270 is the second node in the embodiment shown in Figure 8.

[0600] 28 is a schematic diagram of the structure of a communication device 280 according to an embodiment of the present application. The device 280 may be a node or a component in a node. The device 280 may include at least one memory 2801 and at least one processor 2802. Optionally, the device may further include a bus 2803. Optionally, the device may further include a communication interface 2804. The memory 2801, the processor 2802 and the communication interface 2804 are connected through a bus 2703.

[0601] The memory 2801 is configured to provide a storage space, which may store data such as an operating system and computer programs, etc. The memory 2801 may be one or a combination of RAM, ROM, EPROM, CD-ROM, and the like.

[0602] The processor 2802 is a module that performs arithmetic and / or logical operations, and may be one or a combination of processing modules such as a CPU, GPU, MPU, ASIC, FPGA, and CPLD, among others.

[0603] The communication interface 2804 is configured to receive data transmitted from the outside and / or transmit data to the outside, and may be a wired link interface, such as an Ethernet cable, or may be a wireless link (Wi-Fi, Bluetooth, or the like) interface. Optionally, the communication interface 2804 may further include a transmitter (e.g., a radio frequency transmitter or antenna), a receiver, or the like coupled to the interface.

[0604] The processor 2802 in the device 280 is configured to read the computer program stored in the memory 2801 and execute the communication method described above, for example the communication method illustrated in FIG. 11 or FIG.

[0605] For example, the processor 2802 in the device 280 may read a computer program stored in the memory 2801 to perform the following operations: receiving a service attribute report response message from the second node through the communication interface 2804, the service attribute report response message including at least one service identifier, the at least one service identifier including an identifier of at least one second service, the identifier of the at least one second service corresponding to a second service type, and no integrity protection needs to be performed on data of the service whose type is the second service type; and transmitting a resource scheduling message to the second node via the communication interface 2804, the resource scheduling message being used to indicate that integrity protection is not enabled for a service corresponding to the identifier of the at least one second service; is configured to run

[0606] It can be seen that services of different service types have different integrity protection requirements. The above device may determine whether to enable integrity protection based on the identifier of the first service. For example, the audio noise reduction service is a service with a relatively low security requirement, so there may be no need to perform integrity protection on the data of the audio noise reduction service, and therefore the MAC length corresponding to the audio noise reduction service may not be determined.

[0607] Furthermore, the first node may add indication information to the resource scheduling message, so that the second node determines whether integrity protection is enabled for the service based on the indication information.

[0608] In a possible implementation, the at least one service identifier includes an identifier of at least one first service, the identifier of the at least one first service corresponds to a first service type, and integrity protection needs to be performed on data of a service whose type is the first service type.

[0609] In another possible implementation, the resource scheduling message is further used to indicate a target MAC length of the user plane to be used for the at least one first service.

[0610] It can be appreciated that for services for which integrity protection needs to be performed, information indicating the user plane target MAC length may be added in the device 280, which is used to indicate the length of the MAC for performing integrity protection on the data of the service.

[0611] Please note that for the implementation of each unit, reference is made to the corresponding description in the embodiment shown in Fig. 11 or 12. The device 280 may be the first node in the embodiment shown in Fig. 11 or 12.

[0612] 29 is a schematic diagram of the structure of a communication device 290 according to an embodiment of the present application. The device 290 may be a node or a component in a node. The device 290 may include at least one memory 2801 and at least one processor 2902. Optionally, the device may further include a bus 2903. Optionally, the device may further include a communication interface 2904. The memory 2901, the processor 2902 and the communication interface 2904 are connected through a bus 2703.

[0613] The memory 2901 is configured to provide a storage space, which may store data such as an operating system and computer programs, etc. The memory 2901 may be one or a combination of RAM, ROM, EPROM, CD-ROM, and the like.

[0614] The processor 2902 is a module that performs arithmetic and / or logical operations, and may be one or a combination of processing modules such as a CPU, GPU, MPU, ASIC, FPGA, and CPLD, among others.

[0615] The communication interface 2904 is configured to receive data transmitted from the outside and / or transmit data to the outside, and may be a wired link interface, such as an Ethernet cable, or may be a wireless link (Wi-Fi, Bluetooth, or the like) interface. Optionally, the communication interface 2904 may further include a transmitter (e.g., a radio frequency transmitter or antenna), a receiver, or the like, coupled to the interface.

[0616] The processor 2902 in the device 290 is configured to read the computer program stored in the memory 2901 and execute the communication method described above, for example the communication method illustrated in FIG. 11 or FIG.

[0617] For example, the processor 2902 in the device 290 reads a computer program stored in the memory 2901 to perform the following operations: sending a service attribute report response message to the first node through the communication interface 2904, the service attribute report response message including at least one service identifier, the at least one service identifier including an identifier of at least one second service, the identifier of the at least one second service corresponding to a second service type, and no integrity protection needs to be performed on data of the service whose type is the second service type; receiving a resource scheduling message from the first node via the communication interface 2904; and determining, based on the resource scheduling message, that integrity protection is not enabled for a service corresponding to the identifier of the at least one second service; is configured to run

[0618] It can be seen that services of different service types have different integrity protection requirements. The first node may determine whether to enable integrity protection based on the identifier of the first service. For example, the audio noise reduction service is a service with a relatively low security requirement, so there may be no need for integrity protection to be performed on the data of the audio noise reduction service, and therefore the MAC length corresponding to the audio noise reduction service may not be determined.

[0619] In another possible implementation, the at least one service identifier includes an identifier of at least one first service, the identifier of the at least one first service corresponds to a first service type, and integrity protection needs to be performed on data of the service whose type is the first service type. determining, based on the resource scheduling message, that integrity protection is enabled for a service corresponding to the identifier of the at least one first service; It further comprises:

[0620] In another possible implementation, the resource scheduling message is further used to indicate a MAC length for performing integrity protection on the data of the at least one first service.

[0621] Please note that for the implementation of each unit, reference is made to the corresponding description in the embodiment shown in Fig. 11 or Fig. 12. The device 290 is the second node in the embodiment shown in Fig. 11 or Fig. 12.

[0622] 30 is a schematic diagram of the structure of a communication device 300 according to an embodiment of the present application. The device 300 may be a node or a component in a node. The device 300 may include at least one memory 3001 and at least one processor 3002. Optionally, the device may further include a bus 3003. Optionally, the device may further include a communication interface 3004. The memory 3001, the processor 3002 and the communication interface 3004 are connected through the bus 3003.

[0623] The memory 3001 is configured to provide a storage space, which may store data such as an operating system and computer programs, etc. The memory 3001 may be one or a combination of RAM, ROM, EPROM, CD-ROM, and the like.

[0624] The processor 3002 is a module that performs arithmetic and / or logical operations, and may be one or a combination of processing modules such as a CPU, GPU, MPU, ASIC, FPGA, and CPLD, among others.

[0625] The communication interface 3004 is configured to receive data transmitted from the outside and / or transmit data to the outside, and may be a wired link interface, such as an Ethernet cable, or may be a wireless link (Wi-Fi, Bluetooth, or the like) interface. Optionally, the communication interface 3004 may further include a transmitter (e.g., a radio frequency transmitter or antenna), a receiver, or the like, coupled to the interface.

[0626] The processor 3002 in the device 300 is configured to read the computer program stored in the memory 3001 and to execute the communication method described above, for example the communication method illustrated in FIG.

[0627] For example, the processor 3002 in the device 300 reads a computer program stored in the memory 3001 to perform the following operations: receiving an association request message from a second node via the communications interface 3004, the association request message including information about security algorithms supported by the second node and an identity of the second node; determining a signaling plane target security algorithm and a signaling plane target MAC length according to the first algorithm selection policy, the signaling plane target security algorithm belonging to a set of security algorithms indicated by the information about security algorithms supported by the second node; determining a user plane target security algorithm and a user plane target MAC length based on a second algorithm selection policy and an identity of the second node, where the user plane target security algorithm belongs to a set of security algorithms indicated by the information about security algorithms supported by the second node, and the user plane target MAC length is used to indicate a MAC length for performing integrity protection on data of the first service; and generating a first MAC by using a signaling plane target security algorithm, the length of the first MAC being a signaling plane target MAC length; is configured to run

[0628] In the embodiment of the present application, different policies may be configured in the apparatus 300 to determine different MAC lengths to improve the flexibility of the MAC length. Furthermore, the apparatus 300 may determine a user plane target security algorithm and a user plane target MAC based on the identity of the second node to meet the requirements of different types of nodes for the MAC length. For example, some nodes that handle important services may use a relatively long MAC length to improve security. As another example, some assistant nodes or normal nodes may use a relatively short MAC length to reduce resource consumption and improve communication efficiency.

[0629] In a possible implementation, the processor 3002 may: determining a target security algorithm for the signaling plane and a target MAC length for the signaling plane according to a first length selection policy and a first algorithm selection policy; It is specifically configured to do so.

[0630] In another possible implementation, the processor 3002: determining a target security algorithm for the signaling plane according to a first algorithm selection policy; and determining a signaling plane target MAC length according to a first length selection policy and a signaling plane target security algorithm; It is specifically configured to do so.

[0631] In another possible implementation, the processor 3002: Determine a target security algorithm of the signaling plane according to the first algorithm selection policy, and a MAC length corresponding to the target security algorithm of the signaling plane is a target MAC length of the signaling plane. It is specifically configured to do so.

[0632] In another possible implementation, the processor 3002: determining a target security algorithm for the user plane according to a second algorithm selection policy; and determining a second length selection policy based on the identity of the second node; and determining a target MAC length for the signaling plane based on a second length selection policy and a target security algorithm for the user plane; It is specifically configured to do so.

[0633] In another possible implementation, the processor 3002: determining a target security algorithm for the user plane according to a second algorithm selection policy; and Based on a MAC length supported by a target security algorithm of the user plane and a correspondence relationship between the identity and the MAC length of the second node, a MAC length corresponding to the identity of the second node is determined as a target MAC length of the user plane. It is specifically configured to do so.

[0634] In another possible implementation, the processor 3002 is further configured to send a security context request message to the second node through the communication interface 3004, where the security context request message includes a first MAC, information indicating a target security algorithm for the signaling plane, information indicating a target security algorithm for the user plane, a target MAC length for the signaling plane, and a target MAC length for the user plane, where the first MAC is used to check integrity of the security context request message.

[0635] In another possible implementation, the processor 3002: sending a security context request message to the second node through the communication interface 3004, the security context request message including a first MAC, information indicating a target security algorithm for the signaling plane, information indicating a target security algorithm for the user plane, a target MAC length for the signaling plane, a target MAC length for the user plane, and first identity authentication information, the first MAC is used to check the integrity of the security context request message, and the first identity authentication information is generated based on a shared key between the first node and the second node; and Receive a security context response message from a second node through the communication interface 3004, the security context response message including second identity authentication information and a second MAC, the length of the second MAC being a target MAC length of the signaling plane, the second identity authentication information being used to verify the identity of the second node, and the second MAC being used to check the integrity of the security context response message. It is further structured as follows.

[0636] In another possible implementation, the processor 3002: Checking the integrity of the security context response message based on the target security algorithm and the second MAC of the signaling plane; performing verification on the second identity credential based on the shared key; and If the check on the integrity of the security context response message is successful and the verification on the second identity authentication information is successful, send an association establishment message to the second node, the association establishment message indicating to the second node that it will establish an association with the first node. It is further structured as follows.

[0637] Please note that for the implementation of each unit, reference is made to the corresponding description in the embodiment shown in Figure 13. The device 300 is the first node in the embodiment shown in Figure 13.

[0638] 31 is a schematic diagram of a structure of a communication device 310 according to an embodiment of the present application. The device 310 may be a node or a component in a node. The device 310 may include at least one memory 3101 and at least one processor 3102. Optionally, the device may further include a bus 3103. Optionally, the device may further include a communication interface 3104. The memory 3101, the processor 3102 and the communication interface 3104 are connected through the bus 3103.

[0639] The memory 3101 is configured to provide a storage space, which may store data such as an operating system and computer programs, etc. The memory 3101 may be one or a combination of RAM, ROM, EPROM, CD-ROM, and the like.

[0640] The processor 3102 is a module that performs arithmetic and / or logical operations, and may be one or a combination of processing modules such as a CPU, GPU, MPU, ASIC, FPGA, and CPLD, among others.

[0641] The communication interface 3104 is configured to receive data transmitted from the outside and / or transmit data to the outside, and may be a wired link interface, such as an Ethernet cable, or may be a wireless link (Wi-Fi, Bluetooth, or the like) interface. Optionally, the communication interface 3104 may further include a transmitter (e.g., a radio frequency transmitter or antenna), a receiver, or the like coupled to the interface.

[0642] The processor 3102 in the device 310 is configured to read the computer program stored in the memory 3101 and to execute the communication method described above, for example the communication method illustrated in FIG.

[0643] For example, the processor 3102 in the device 310 reads a computer program stored in the memory 3101 to perform the following operations: sending an association request message to the first node via the communications interface 3104, the association request message including information about security algorithms supported by the second node and an identity of the second node; receiving a security context request message from the first node through the communication interface 3104, the security context request message including information used to indicate a target security algorithm of a signaling plane, information used to indicate a target security algorithm of a user plane, a signaling plane target MAC length, a user plane target MAC length, and a first MAC; the signaling plane target security algorithm and the signaling plane target MAC length correspond to a first algorithm selection policy, and the signaling plane target security algorithm belongs to a set of security algorithms indicated by the information about security algorithms supported by the second node; the user plane target security algorithm and the user plane target MAC length correspond to a sec...

Claims

1. 1. A communication method comprising: receiving an association request message from a second node, wherein the association request message includes information about security algorithms supported by the second node; determining a target security algorithm for a signaling plane and a target MAC length for the signaling plane according to a first algorithm selection policy, where the target security algorithm for the signaling plane belongs to a set of security algorithms indicated by the information about the security algorithms supported by the second node; and generating a first MAC by using the target security algorithm of the signaling plane, where a length of the first MAC is the target MAC length of the signaling plane. A method comprising:

2. determining a target security algorithm for a signaling plane and a target MAC length for the signaling plane according to a first algorithm selection policy, determining the target security algorithm for the signaling plane and the target MAC length for the signaling plane according to a first length selection policy and the first algorithm selection policy; The method of claim 1 , comprising:

3. determining a target security algorithm for a signaling plane and a target MAC length for the signaling plane according to a first algorithm selection policy, determining the target security algorithm of the signaling plane according to the first algorithm selection policy, where a MAC length corresponding to the target security algorithm of the signaling plane is the target MAC length of the signaling plane. The method of claim 1 , comprising:

4. determining a target security algorithm for a signaling plane and a target MAC length for the signaling plane according to a first algorithm selection policy, determining the target security algorithm for the signaling plane according to the first algorithm selection policy; and determining the target MAC length for the signaling plane according to a first length selection policy and the target security algorithm for the signaling plane; The method of claim 1 , comprising:

5. The method comprises: sending a security context request message to the second node, where the security context request message includes the first MAC, information indicating the target security algorithm of the signaling plane, and the target MAC length of the signaling plane, the first MAC being used to check the integrity of the security context request message. The method of claim 1 , further comprising:

6. The security context request message further includes a target security algorithm for a user plane, and the method further comprises: determining the target security algorithm for the user plane according to a second algorithm selection policy, where the target security algorithm for the user plane belongs to the set of security algorithms indicated by the information about the security algorithms supported by the second node. The method of claim 5 further comprising:

7. The method comprises: obtaining an identifier of a first service and / or a data packet size of said first service; determining a target MAC length for the user plane based on at least one of a MAC length supported by the target security algorithm of the user plane and the identifier of the first service and the data packet size of the first service, where the target MAC length for the user plane is used to indicate a MAC length for performing integrity protection on data of the first service; and transmitting a resource scheduling message to the second node, where the resource scheduling message includes the target MAC length for the user plane. The method of claim 6 further comprising:

8. 1. A communication method comprising: sending an association request message to the first node, where the association request message includes information about security algorithms supported by the second node; and receiving a security context request message from the first node, where the security context request message includes information used to indicate a target security algorithm of a signaling plane and information used to indicate a target MAC length of the signaling plane, the target security algorithm of the signaling plane and the target MAC length of the signaling plane correspond to a first algorithm selection policy, and the target security algorithm of the signaling plane belongs to a set of security algorithms indicated by the information about the security algorithms supported by the second node. A method comprising:

9. 9. The method of claim 8, wherein the security context request message includes a first MAC, a length of the first MAC being the target MAC length of the signaling plane; and the communication method further comprises: checking integrity of the security context request message based on the first MAC by using the target security algorithm of the signaling plane.

10. the security context request message further comprises information indicating a target security algorithm of a user plane, the target security algorithm of the user plane corresponding to a second algorithm selection policy, the target security algorithm of the user plane belonging to the set of security algorithms indicated by the information about the security algorithms supported by the second node; the method further comprises: receiving a resource scheduling message from the first node, where the resource scheduling message includes a target MAC length of the user plane, the target MAC length of the user plane corresponds to at least one of the target security algorithm of the user plane and an identifier of a first service and a data packet size of the first service, and the target MAC length of the user plane is used to indicate a MAC length for performing integrity protection on data of the first service. The method of claim 8 or 9, further comprising:

11. 1. A communication method comprising: receiving a service attribute report response message from a second node, where the service attribute report response message includes an identifier of a first service and / or a data packet size of the first service; and determining a target MAC length for the user plane based on at least one of a MAC length supported by a target security algorithm of a user plane and the identifier of the first service and the data packet size of the first service, where the target MAC length for the user plane is used to indicate a MAC length for performing integrity protection on data of the first service. A method comprising:

12. determining a target MAC length for the user plane based on at least one of a MAC length supported by a target security algorithm for a user plane and the identifier of the first service and the data packet size of the first service, determining the MAC length corresponding to the identifier of the first service as the target MAC length of the user plane based on a correspondence relationship between the MAC length supported by the target security algorithm of the user plane and the identifier and MAC length of the first service; or determining the MAC length corresponding to the data packet size of the first service as the target MAC length of the user plane based on a correspondence relationship between the MAC length supported by the target security algorithm of the user plane and the data packet size and MAC length of the first service; The method of claim 11 , comprising:

13. determining a target MAC length for the user plane based on at least one of a target security algorithm for a user plane and the identifier of the first service and the data packet size of the first service, determining a second length selection policy based on the identifier of the first service and / or the data packet size of the first service; and determining the target MAC length for the user plane based on the second length selection policy and the MAC length supported by the target security algorithm for the user plane. The method of claim 11 , comprising:

14. 14. The method according to claim 11, wherein the identifier of the first service corresponds to a first service type and integrity protection needs to be performed on data of a service whose type is the first service type.

15. The method comprises: transmitting a resource scheduling message to the second node, where the resource scheduling message includes information used to indicate the target MAC length of the user plane.

15. The method of claim 11, further comprising:

16. The method comprises: generating a third MAC by using the target security algorithm of the user plane, where a length of the third MAC is the target MAC length of the user plane, and the third MAC is used to perform integrity protection on the data of the first service.

16. The method of claim 11, further comprising:

17. The method comprises: obtaining information about security algorithms supported by the second node; determining a target security algorithm for a signaling plane and a target MAC length for the signaling plane according to a first algorithm selection policy, where the target security algorithm for the signaling plane belongs to a set of security algorithms indicated by the information about the security algorithms supported by the second node; generating a fourth MAC by using the target security algorithm of the signaling plane, where a length of the fourth MAC is the target MAC length of the signaling plane; and transmitting a resource scheduling message to the second node, where the resource scheduling message includes the fourth MAC and the target MAC length of the user plane, the fourth MAC being used to perform integrity protection for the resource scheduling message. The method of claim 11 further comprising:

18. The method comprises: determining the target security algorithm for the user plane according to a second algorithm selection policy, where the target security algorithm for the user plane belongs to the set of security algorithms indicated by the information about the security algorithms supported by the second node.

20. The method of claim 17, further comprising:

19. 1. A communication method comprising: sending a service attribute report response message to the first node, where the service attribute report response message includes an identifier of a first service and / or a data packet size of the first service; and receiving a resource scheduling message from the first node, where the resource scheduling message includes a target MAC length for a user plane; the target MAC length for the user plane is a MAC length supported by a target security algorithm for the user plane, and the target MAC length for the user plane corresponds to at least one of the identifier of the first service and the data packet size of the first service; and the target MAC length for the user plane is used to indicate a MAC length for performing integrity protection on data of the first service. A method comprising:

20. 20. The method of claim 19, wherein the identifier of the first service corresponds to a first service type, and integrity protection must be performed on data of a service whose type is the first service type.

21. 21. The method of claim 19 or 20, wherein the target security algorithm of the user plane corresponds to a second algorithm selection policy, and the target security algorithm of the user plane belongs to a set of security algorithms indicated by information about security algorithms supported by a second node.

22. The resource scheduling message further includes a fourth MAC, and the method further comprises: checking message integrity of the resource scheduling message based on the fourth MAC by using the target security algorithm of the user plane.

22. The method of claim 21 further comprising:

23. 1. A communication method comprising: sending a service attribute report response message to the first node, where the service attribute report response message includes an identifier of a first service and / or a data packet size of the first service; and determining a target MAC length for the user plane based on at least one of a MAC length supported by a target security algorithm of a user plane and the identifier of the first service and the data packet size of the first service, where the target MAC length for the user plane is used to indicate a MAC length for performing integrity protection on data of the first service. A method comprising:

24. determining a target MAC length for the user plane based on at least one of a MAC length supported by a target security algorithm for a user plane and the identifier of the first service and the data packet size of the first service, determining the MAC length corresponding to the identifier of the first service as the target MAC length of the user plane based on a correspondence relationship between the MAC length supported by the target security algorithm of the user plane and the identifier and MAC length of the first service; or determining the MAC length corresponding to the data packet size of the first service as the target MAC length of the user plane based on a correspondence relationship between the MAC length supported by the target security algorithm of the user plane and the data packet size and MAC length of the first service; 24. The method of claim 23, comprising:

25. determining a target MAC length for the user plane based on at least one of a target security algorithm for a user plane and the identifier of the first service and the data packet size of the first service, determining a second length selection policy based on the identifier of the first service and / or the data packet size of the first service; and determining the target MAC length for the user plane based on the second length selection policy and the MAC length supported by the target security algorithm for the user plane.

24. The method of claim 23, comprising:

26. 26. The method according to any one of claims 23 to 25, wherein the identifier of the first service corresponds to a first service type and integrity protection needs to be performed on data of a service whose type is the first service type.

27. 26. The method of claim 23, wherein the target security algorithm of the user plane corresponds to a second algorithm selection policy, and wherein the target security algorithm of the user plane belongs to a set of security algorithms indicated by information about security algorithms supported by a second node.

28. 1. A communication method comprising: receiving a Service Attribute Report Response message from a second node, where the Service Attribute Report Response message includes at least one service identifier, the at least one service identifier includes an identifier of at least one second service, the identifier of the at least one second service corresponds to a second service type, and no integrity protection needs to be performed on data of a service whose type is the second service type; and transmitting a resource scheduling message to the second node, where the resource scheduling message is used to indicate that integrity protection is not enabled for the service corresponding to the identifier of the at least one second service. A method comprising:

29. 30. The method of claim 28, wherein the at least one service identifier comprises an identifier of at least one first service, the identifier of the at least one first service corresponding to a first service type, and integrity protection needs to be performed on data of a service whose type is the first service type.

30. 30. The method of claim 28, wherein the resource scheduling message is further used to indicate a target MAC length of a user plane to be used for the at least one first service.

31. 1. A communication method comprising: sending a service attribute report response message to the first node, where the service attribute report response message includes at least one service identifier, the at least one service identifier includes an identifier of at least one second service, the identifier of the at least one second service corresponds to a second service type, and no integrity protection needs to be performed on data of a service whose type is the second service type; receiving a resource scheduling message from the first node; and determining, based on the resource scheduling message, that integrity protection is not enabled for the service corresponding to the identifier of the at least one second service; A method comprising:

32. The at least one service identifier comprises an identifier of at least one first service, the identifier of the at least one first service corresponds to a first service type, and integrity protection needs to be performed on data of a service whose type is the first service type; the method further comprises: determining, based on the resource scheduling message, that integrity protection is enabled for the service corresponding to the identifier of the at least one first service; 32. The method of claim 31 further comprising:

33. The method of claim 32, wherein the resource scheduling message is further used to indicate a length of a MAC for performing integrity protection on data of the at least one first service.

34. 1. A communication device, comprising: a receiving unit configured to receive an association request message from a second node, where the association request message includes information about security algorithms supported by the second node; and a processing unit configured to determine a target security algorithm for a signaling plane and a target MAC length for the signaling plane according to a first algorithm selection policy, where the target security algorithm for the signaling plane belongs to a set of security algorithms indicated by the information about the security algorithms supported by the second node; Equipped with The processing unit is further configured to generate a first MAC by using the target security algorithm of the signaling plane, and a length of the first MAC is the target MAC length of the signaling plane.

35. The processing unit includes: determining the target security algorithm for the signaling plane and the target MAC length for the signaling plane according to a first length selection policy and the first algorithm selection policy; 35. Apparatus according to claim 34, specifically adapted to:

36. The processing unit includes: Determine the target security algorithm of the signaling plane according to the first algorithm selection policy, where a MAC length corresponding to the target security algorithm of the signaling plane is the target MAC length of the signaling plane.

35. The device according to claim 34, specifically adapted to:

37. The processing unit includes: determining the target security algorithm for the signaling plane according to the first algorithm selection policy; and determining the target MAC length for the signaling plane according to the first length selection policy and the target security algorithm for the signaling plane; 36. Apparatus according to claim 35, specifically adapted to:

38. The apparatus comprises: a transmitting unit configured to transmit a security context request message to the second node, where the security context request message includes the first MAC, information indicating the target security algorithm of the signaling plane, and the target MAC length of the signaling plane, and the first MAC is used to check the integrity of the security context request message.

38. The apparatus of any one of claims 34 to 37, further comprising:

39. The security context request message further includes a target security algorithm for a user plane, and the processing unit: determining the target security algorithm for the user plane according to a second algorithm selection policy, where the target security algorithm for the user plane belongs to the set of security algorithms indicated by the information about the security algorithms supported by the second node; 39. The apparatus of claim 38, specifically adapted to:

40. The receiving unit is further configured to obtain an identifier of a first service and / or a data packet size of the first service; The processing unit is further configured to determine a target MAC length for the user plane based on at least one of a MAC length supported by the target security algorithm of the user plane and the identifier of the first service and the data packet size of the first service, where the target MAC length for the user plane is used to indicate a MAC length for performing integrity protection on data of the first service; and 40. The apparatus of claim 39, wherein the transmitting unit is further configured to transmit a resource scheduling message to the second node, the resource scheduling message including the target MAC length for the user plane.

41. 1. A communication device, comprising: a sending unit configured to send an association request message to a first node, where the association request message includes information about security algorithms supported by a second node; and a receiving unit configured to receive a security context request message from the first node, where the security context request message includes information used to indicate a target security algorithm of a signaling plane and information used to indicate a target MAC length of the signaling plane, the target security algorithm of the signaling plane and the target MAC length of the signaling plane correspond to a first algorithm selection policy, and the target security algorithm of the signaling plane belongs to a set of security algorithms indicated by the information about the security algorithms supported by the second node. An apparatus comprising:

42. the security context request message includes a first MAC, and a length of the first MAC is the target MAC length of the signaling plane; a processing unit configured to check the integrity of the security context request message based on the first MAC by using the target security algorithm of the signaling plane; 42. The apparatus of claim 41, further comprising:

43. the security context request message further includes information indicating a target security algorithm of a user plane, the target security algorithm of the user plane corresponding to a second algorithm selection policy, the target security algorithm of the user plane belonging to the set of security algorithms indicated by the information about the security algorithms supported by the second node; 43. The apparatus of claim 41 or 42, wherein the receiving unit is further configured to receive a resource scheduling message from the first node, the resource scheduling message including a target MAC length for the user plane, the target MAC length for the user plane corresponding to at least one of the target security algorithm of the user plane and an identifier of a first service and a data packet size of the first service, and the target MAC length for the user plane is used to indicate a MAC length for performing integrity protection on data of the first service.

44. 1. A communication device, comprising: a receiving unit configured to receive a service attribute report response message from a second node, where the service attribute report response message includes an identifier of a first service and / or a data packet size of the first service; and a processing unit configured to determine a target MAC length for the user plane based on at least one of a MAC length supported by a target security algorithm of a user plane and the identifier of the first service and the data packet size of the first service, where the target MAC length for the user plane is used to indicate a MAC length for performing integrity protection on data of the first service. An apparatus comprising:

45. The processing unit includes: Determine the MAC length corresponding to the identifier of the first service as the target MAC length of the user plane based on a correspondence relationship between a MAC length supported by the target security algorithm of the user plane and the identifier and a MAC length of the first service; or Based on a correspondence relationship between the MAC length supported by the target security algorithm of the user plane and the data packet size and MAC length of the first service, determine the MAC length corresponding to the data packet size of the first service as the target MAC length of the user plane.

45. Apparatus according to claim 44, specifically adapted to:

46. The processing unit includes: determining a second length selection policy based on the identifier of the first service and / or the data packet size of the first service; and determining the target MAC length for the user plane based on the second length selection policy and the MAC length supported by the target security algorithm for the user plane; 45. Apparatus according to claim 44, specifically adapted to:

47. 47. The apparatus of claim 44, wherein the identifier of the first service corresponds to a first service type and integrity protection needs to be performed on data of a service whose type is the first service type.

48. 48. The apparatus of claim 44, further comprising a transmitting unit, the transmitting unit further configured to transmit a resource scheduling message to the second node, the resource scheduling message including the target MAC length for the user plane.

49. The processing unit includes: Generate a third MAC by using the target security algorithm of the user plane, where a length of the third MAC is the target MAC length of the user plane, and the third MAC is used to perform integrity protection on the data of the first service.

49. The apparatus of any one of claims 44 to 48, further configured to:

50. The receiving unit is further configured to obtain information about security algorithms supported by the second node; The processing unit is further configured to determine a target security algorithm for a signaling plane and a target MAC length for the signaling plane according to a first algorithm selection policy, the target security algorithm for the signaling plane belonging to a set of security algorithms indicated by the information about the security algorithms supported by the second node; The processing unit is further configured to generate a fourth MAC by using the target security algorithm of the signaling plane, and a length of the fourth MAC is the target MAC length of the signaling plane; 45. The apparatus of claim 44, wherein a transmitting unit included in the apparatus is configured to transmit a resource scheduling message to the second node, the resource scheduling message including the fourth MAC and the target MAC length for the user plane, the fourth MAC being used to perform integrity protection for the resource scheduling message.

51. The processing unit includes: determining the target security algorithm for the user plane according to a second algorithm selection policy, where the target security algorithm for the user plane belongs to the set of security algorithms indicated by the information about the security algorithms supported by the second node; 51. The apparatus of claim 50, further configured to:

52. 1. A communication device, comprising: a sending unit configured to send a service attribute report response message to a first node, where the service attribute report response message includes an identifier of a first service and / or a data packet size of the first service; and a receiving unit configured to receive a resource scheduling message from the first node, where the resource scheduling message includes a target MAC length for a user plane; the target MAC length for the user plane is a MAC length supported by a target security algorithm for the user plane, and the target MAC length for the user plane corresponds to at least one of the identifier of the first service and the data packet size of the first service; and the target MAC length for the user plane is used to indicate a MAC length for performing integrity protection on data of the first service. An apparatus comprising:

53. 53. The apparatus of claim 52, wherein the identifier of the first service corresponds to a first service type, and integrity protection must be performed on data of a service whose type is the first service type.

54. 54. The apparatus of claim 52 or 53, wherein the target security algorithm of the user plane corresponds to a second algorithm selection policy, and the target security algorithm of the user plane belongs to a set of security algorithms indicated by information about security algorithms supported by a second node.

55. The resource scheduling message further comprises a fourth MAC, and the processing unit: Checking message integrity of the resource scheduling message based on the fourth MAC by using the target security algorithm of the user plane.

53. The apparatus of claim 52, configured as follows:

56. 1. A communication device, comprising: a sending unit configured to send a service attribute report response message to a first node, where the service attribute report response message includes an identifier of a first service and / or a data packet size of the first service; and a processing unit configured to determine a target MAC length for the user plane based on at least one of a MAC length supported by a target security algorithm of a user plane and the identifier of the first service and the data packet size of the first service, where the target MAC length for the user plane is used to indicate a MAC length for performing integrity protection on data of the first service. An apparatus comprising:

57. The processing unit includes: Determine the MAC length corresponding to the identifier of the first service as the target MAC length of the user plane based on a correspondence relationship between a MAC length supported by the target security algorithm of the user plane and the identifier and a MAC length of the first service; or Based on a correspondence relationship between the MAC length supported by the target security algorithm of the user plane and the data packet size and MAC length of the first service, determine the MAC length corresponding to the data packet size of the first service as the target MAC length of the user plane.

57. Apparatus according to claim 56, specifically adapted to:

58. The processing unit includes: determining a second length selection policy based on the identifier of the first service and / or the data packet size of the first service; and determining the target MAC length for the user plane based on the second length selection policy and the MAC length supported by the target security algorithm for the user plane; 57. Apparatus according to claim 56, specifically adapted to:

59. 59. The apparatus of claim 56, wherein the identifier of the first service corresponds to a first service type and integrity protection needs to be performed on data of a service whose type is the first service type.

60. 60. The apparatus of claim 56, wherein the target security algorithm of the user plane corresponds to a second algorithm selection policy, and wherein the target security algorithm of the user plane belongs to a set of security algorithms indicated by information about security algorithms supported by a second node.

61. 1. A communication device, comprising: a receiving unit configured to receive a service attribute report response message from a second node, where the service attribute report response message includes at least one service identifier, where the at least one service identifier includes an identifier of at least one second service, where the identifier of the at least one second service corresponds to a second service type, and where no integrity protection needs to be performed on data of a service whose type is the second service type; and a transmitting unit configured to transmit a resource scheduling message to the second node, where the resource scheduling message is used to indicate that integrity protection is not enabled for the service corresponding to the identifier of the at least one second service; An apparatus comprising:

62. 62. The apparatus of claim 61, wherein the at least one service identifier comprises an identifier of at least one first service, the identifier of the at least one first service corresponding to a first service type, and integrity protection needs to be performed on data of a service whose type is the first service type.

63. 63. The apparatus of claim 62, wherein the resource scheduling message is further used to indicate a target MAC length of a user plane to be used for the at least one first service.

64. 1. A communication device, comprising: a sending unit configured to send a service attribute report response message to a first node, where the service attribute report response message includes at least one service identifier, the at least one service identifier includes an identifier of at least one second service, the identifier of the at least one second service corresponds to a second service type, and no integrity protection needs to be performed on data of a service whose type is the second service type; a receiving unit configured to receive a resource scheduling message from the first node; and a processing unit configured to determine, based on the resource scheduling message, that integrity protection is not enabled for the service corresponding to the identifier of the at least one second service; An apparatus comprising:

65. the at least one service identifier comprises an identifier of at least one first service, the identifier of the at least one first service corresponds to a first service type, and integrity protection should be performed on data of a service whose type is the first service type; 65. The apparatus of claim 64, wherein the processing unit is further configured to determine, based on the resource scheduling message, that integrity protection is enabled for the service corresponding to the identifier of the at least one first service.

66. 66. The apparatus of claim 65, wherein the resource scheduling message is further used to indicate a length of a MAC for performing integrity protection on data of the at least one first service.

67. A chip system comprising at least one processor and a communication interface, the at least one processor being configured to call a computer program stored in at least one memory, whereby an apparatus in which the chip system is disposed performs a method according to any one of claims 1 to 7, a method according to any one of claims 11 to 18, or a method according to any one of claims 28 to 30.

68. A chip system comprising at least one processor and a communication interface, the at least one processor being configured to call a computer program stored in at least one memory, whereby an apparatus in which the chip system is disposed performs a method according to any one of claims 8 to 10, a method according to any one of claims 19 to 22, a method according to any one of claims 23 to 27, or a method according to any one of claims 31 to 33.

69. A communication system comprising a first node and a second node, The first node comprises an apparatus according to any one of claims 34 to 40; the second node comprises an apparatus according to any one of claims 41 to 43; or The first node comprises an apparatus according to any one of claims 44 to 51; the second node comprises an apparatus according to any one of claims 52 to 55; or The first node comprises an apparatus according to any one of claims 44 to 51; the second node comprises an apparatus according to any one of claims 56 to 60; or 67. A communication system, wherein the first node comprises an apparatus as claimed in any one of claims 61 to 63; and the second node comprises an apparatus as claimed in any one of claims 64 to 66.

70. 13. A computer readable storage medium storing a computer program which, when executed on one or more processors, causes a method according to any one of claims 1 to 7 to be performed, or a method according to any one of claims 11 to 18 to be performed, or a method according to any one of claims 28 to 30 to be performed.

71. 13. A computer readable storage medium storing a computer program which, when executed on one or more processors, causes a method according to any one of claims 8 to 10 to be performed, or a method according to any one of claims 19 to 22 or a method according to any one of claims 23 to 27, or a method according to any one of claims 31 to 33.

72. A program causing a computer to carry out the method according to any one of claims 1 to 7, or the method according to any one of claims 11 to 18, or the method according to any one of claims 28 to 30.

73. A program causing a computer to carry out the method according to any one of claims 8 to 10, or the method according to any one of claims 19 to 22, or the method according to any one of claims 23 to 27, or the method according to any one of claims 31 to 33.

Images