Secure transmission method and device

Abstract

An embodiment of this application provides a secure transmission method and apparatus. The method includes: a first device encrypts a packet header of a packet to be transmitted according to a transport layer security protocol to obtain an encrypted packet header. The packet to be transmitted includes first data. The first data is encrypted by an application layer security protocol but not by a transport layer security protocol. The first device transmits the first encrypted packet to a second device. The first encrypted packet includes an encrypted packet header and the first data. According to this application, if the packet to be transmitted includes the first data encrypted by an application layer security protocol, when encrypting the packet to be transmitted according to the transport layer security protocol, the first device encrypts the packet header of the packet to be transmitted but does not encrypt the first data. Therefore, after receiving the encrypted packet, the second device does not need to decrypt the first data according to the transport layer security protocol. Thus, the processing load of the first device and the second device can be reduced, and the packet transmission efficiency can be improved.

Description

[Technical field]

[0001] This application claims priority to Chinese Patent Application No. 202111670362.8, entitled "SECURE TRANSMISSION METHOD AND APPARATUS," filed with the China National Intellectual Property Office on December 31, 2021, and is hereby incorporated by reference in its entirety.

[0002] TECHNICAL FIELD Embodiments of this application relate to the field of secure communications, and more particularly, to a secure transmission method and apparatus. [Background technology]

[0003] Before sending a packet to the second device, the first device encrypts the packet to be sent according to a transport layer security protocol to obtain the encrypted packet, and adds a cyclic redundancy check (CRC) sequence to the encrypted packet. Correspondingly, after receiving the encrypted packet, the second device performs a CRC check on the encrypted packet and decrypts the encrypted packet according to the transport layer security protocol. If an error occurs during the transmission of the encrypted packet, the second device first corrects the encrypted packet. For example, in Ethernet, during enhanced common public radio interface (eCPRI)-based packet transmission, the second device may use base forward error correction (FEC) or Reed-Solomon (RS) FEC to correct the encrypted packet. After correcting the encrypted packet, the second device performs a CRC check on the encrypted packet and decrypts the encrypted packet according to the transport layer security protocol.

[0004] During each packet transmission, the first device and the second device encrypt and decrypt the transmitted packet respectively according to a transport layer security protocol, which imposes relatively high requirements on the hardware processing capabilities of the first device and the second device, and the packet transmission efficiency is low. Summary of the Invention

[0005] The embodiments of this application provide a secure transmission method to reduce the processing load of a device and improve packet transmission efficiency.

[0006] According to a first aspect, a method of secure transmission is provided. The method includes: a first device encrypting a packet header of a packet to be transmitted according to a transport layer security protocol to obtain an encrypted packet header. The packet to be transmitted includes first data. The first data is encrypted by an application layer security protocol but not by a transport layer security protocol. The first device transmits the first encrypted packet to a second device. The first encrypted packet includes an encrypted packet header and the first data.

[0007] According to the above technical solution, if a packet to be transmitted includes first data encrypted by an application layer security protocol, when encrypting the packet to be transmitted according to the transport layer security protocol, the first device encrypts the packet header of the packet to be transmitted, but does not encrypt the first data. Correspondingly, after receiving the encrypted packet, the second device does not need to decrypt the first data according to the transport layer security protocol. Therefore, the processing load of the first device and the second device can be reduced, and the packet transmission efficiency can be improved.

[0008] In addition, since the packet header occupies a small proportion of the whole packet to be transmitted, the encrypted packet header occupies a small proportion of the first encrypted packet. Furthermore, since the encrypted packet header has a short length, the encrypted packet header is less prone to errors during transmission, and the second device is less likely to fail to decrypt the encrypted packet header according to the transport layer security protocol. Therefore, the probability that the second device discards the first data due to the failure of decryption is reduced. Therefore, the above technical solution can improve the error resilience capability of the link between the first device and the second device, which can be improved based on the secure transmission. If the first data is air interface data, the spectrum utilization of the air interface can be improved when the probability of discarding the first data is reduced.

[0009] For example, application layer security protocols include packet data convergence protocol (PDCP) layer protocols.

[0010] For example, transport layer security protocols include the media access control security (MACSec) protocol and the internet protocol security (IPSec) protocol.

[0011] For example, the first data is air interface data. For example, the first data is data received by the first device from a terminal device. In another example, the first data is data received by the first device from a third device, and the first data is data transmitted to the terminal device. The third device is configured to generate the first data or configured to forward the first data. For example, the third device is a source device that transmits data, or a routing device that connects a destination device and a source device in an Ethernet. In another example, the third device is a core network device.

[0012] For example, the first device is a source device for packet transmission or a routing device connecting the source device and the destination device in an Ethernet, the destination device is a destination device for packet transmission in the Ethernet, and the second device is the destination device or a routing device connecting the source device and the destination device.

[0013] In relation to the first aspect, in some implementations of the first aspect, the method further includes the first device transmitting, to the second device, length information of a packet header of the packet to be transmitted.

[0014] According to the above technical solution, the first device sends the length information of the packet header to the second device, so that the second device can correctly decrypt the encrypted packet header based on the length information. For example, when the length of the packet header of the packet to be transmitted is not fixed, the first device sends the length information of the packet header to the second device, so that the second device can correctly decrypt the encrypted packet header based on the length information.

[0015] Related to the first aspect, in some implementations of the first aspect, the packet to be transmitted further includes second data that is not encrypted by an application layer security protocol, the first encrypted packet further includes encrypted data, and the method further includes the first device encrypting the second data in accordance with a transport layer security protocol to obtain the encrypted data.

[0016] According to the above technical solution, when the packet to be transmitted includes second data that is not encrypted by an application layer security protocol, the first device can encrypt the second data according to a transport layer security protocol, thereby ensuring secure transmission of the second data between the first device and the second device.

[0017] For example, the second data includes control data, management plane data, or synchronized clock data transmitted over the fronthaul interface.

[0018] With respect to the first aspect, in some implementations of the first aspect, the second data is placed before the first data.

[0019] According to the above technical solution, when a packet to be transmitted includes a packet header, second data, and first data, the packet header is placed at the front end of the packet to be transmitted, and the second data is placed before the first data, so that the first device can encrypt both the packet header and the second data according to the transport layer security protocol. Thus, the procedure of the first device encrypting the packet to be transmitted can be simplified.

[0020] In relation to the first aspect, in some implementations of the first aspect, the method further includes the first device transmitting length information of the second data to the second device.

[0021] According to the above technical solution, the first device sends the length information of the second data to the second device, so that the second device can correctly decrypt the encrypted data according to the length information. For example, when the length of the second data is not fixed, the first device sends the length information of the second data to the second device, so that the second device can correctly decrypt the encrypted data according to the length information.

[0022] Related to the first aspect, in some implementations of the first aspect, before the first encrypted packet is generated, the method further includes the first device receiving a second encrypted packet from the second device, and the first device performing an integrity check on the second encrypted packet in accordance with a Transport Layer Security Protocol, where the check fails.

[0023] For example, a failure of an integrity check performed by the first device on the second encrypted packet is a first failure of an integrity check performed on a packet received from the second device.

[0024] In another example, the failure of an integrity check performed by the first device on the second encrypted packet is the Nth failure of an integrity check performed on a packet received from the second device, where N is a positive integer and N is a preset threshold.

[0025] Related to the first aspect, in some implementations of the first aspect, before the first encrypted packet is generated, the method further includes: the first device sending a third encrypted packet to the second device, where the third encrypted packet is generated by encrypting the packet to be sent in accordance with a Transport Layer Security Protocol; and the first device receiving indication information from the second device, where the indication information indicates that an integrity check on the third encrypted packet fails.

[0026] For example, the first device receives the indication information from the second device for the first time.

[0027] In another example, the first device receives the indication information from the second device an Nth time, where N is a positive integer, and N is a preset threshold value.

[0028] According to a second aspect, a secure transmission method is provided, the method including: a second device receiving an encrypted packet from a first device, the encrypted packet including an encrypted packet header and first data, the first data being encrypted by an application layer security protocol but not by a transport layer security protocol; and the second device decrypting the encrypted packet header in accordance with the transport layer security protocol.

[0029] According to the above technical solution, when the first data included in the encrypted packet received by the second device is encrypted by the application security protocol and not decrypted by the transport layer security protocol, the second device does not need to decrypt the first data according to the transport layer security protocol, thereby reducing the processing load of the second device. In addition, the packet transmission efficiency is improved.

[0030] For example, the application layer security protocol includes the PDCP layer protocol.

[0031] For example, transport layer security protocols include the MACSec protocol and the IPsec protocol.

[0032] For example, the first data is air interface data. For example, the first data is data received by the first device from a terminal device. In another example, the first data is data received by the first device from a third device, and the first data is data to be transmitted to the terminal device. The third device is configured to generate the first data or to forward the first data. For example, the third device is a source device that transmits data, or a routing device that connects a destination device and a source device in an Ethernet. In another example, the third device is a core network device.

[0033] For example, the first device is a source device for packet transmission or a routing device connecting the source device and the destination device in an Ethernet, the destination device is a destination device for packet transmission in the Ethernet, and the second device is the destination device or a routing device connecting the source device and the destination device.

[0034] Alternatively, if the second device successfully decrypts the encrypted packet header, the second device sends the first data to the third device. The fourth device is a destination device that transmits the data, or a routing device that connects the destination device and the source device in an Ethernet. Alternatively, the fourth device is a terminal device or a core network device. For example, the second device is a radio frequency device and the fourth device is a terminal device. Alternatively, the second device is a control device and the fourth device is a core network device.

[0035] Related to the second aspect, in some implementations of the second aspect, the method further includes the second device receiving first length information from the first device, and the second device determining a length of the encrypted packet header before encryption based on the first length information.

[0036] According to the above technical solution, the second device determines the length of the encrypted packet header before encryption based on the first length information, so that the second device can correctly decrypt the encrypted packet header based on the first length information. For example, when the length of the packet header is not fixed, the first device sends the first length information to the second device, so that the second device can correctly decrypt the encrypted packet header based on the first length information.

[0037] Related to the second aspect, in some implementations of the second aspect, the encrypted packet further includes encrypted data, and the method further includes the second device decrypting the encrypted data in accordance with a Transport Layer Security protocol to obtain the second data.

[0038] For example, the second data includes control data, management plane data, or synchronized clock data transmitted over the fronthaul interface.

[0039] Related to the second aspect, in some implementations of the second aspect, the method further includes the second device receiving second length information from the first device, and the second device determining a length of the second data based on the second length information.

[0040] According to the above technical solution, the second device determines the length of the second data based on the second length information, so that the second device can correctly decrypt the encrypted data based on the second length information to obtain the second data. For example, if the length of the second data is not fixed, the first device sends the second length information to the second device, so that the second device can correctly decrypt the encrypted data based on the second length information.

[0041] According to a third aspect, an apparatus is provided. The apparatus includes a transceiver unit and a processing unit. The processing unit is configured to encrypt a packet header of a packet to be transmitted according to a transport layer security protocol to obtain an encrypted packet header. The packet to be transmitted includes first data. The first data is encrypted by the application layer security protocol but not by the transport layer security protocol. The transceiver unit is configured to transmit the first encrypted packet, the first encrypted packet including the encrypted packet header and the first data.

[0042] For example, the application layer security protocol includes the PDCP layer protocol.

[0043] For example, transport layer security protocols include the MACSec protocol and the IPsec protocol.

[0044] For example, the first data is air interface data. For example, the first data is data received by the apparatus from a terminal device. In another example, the first data is data received by the apparatus from a third device, and the first data is data to be transmitted to the terminal device. The third device is configured to generate the first data or to forward the first data. For example, the third device is a source device that transmits data, or a routing device that connects a destination device and a source device in an Ethernet. In another example, the third device is a core network device.

[0045] For example, the apparatus is a source device for packet transmission or a routing device connecting a source device and a destination device in an Ethernet, the destination device is a destination device for packet transmission in the Ethernet, and the second device is the destination device or a routing device connecting the source device and the destination device.

[0046] In relation to the third aspect, in some implementations of the third aspect, the transceiver unit is further configured to transmit length information of a packet header of the packet to be transmitted to the second device.

[0047] Related to the third aspect, in some implementations of the third aspect, the packet to be transmitted further includes second data that is not encrypted by an application layer security protocol, the first encrypted packet further includes encrypted data, and the processing unit is further configured to encrypt the second data in accordance with a transport layer security protocol to obtain the encrypted data.

[0048] For example, the second data includes control data, management plane data, or synchronized clock data transmitted over the fronthaul interface.

[0049] With respect to the third aspect, in some implementations of the third aspect, the second data is placed before the first data.

[0050] In relation to the third aspect, in some implementations of the third aspect, the transceiver unit is further configured to transmit length information of the second data to the second device.

[0051] Related to the third aspect, in some implementations of the third aspect, the transceiver unit is further configured to receive a second encrypted packet from the second device, and the processing unit is further configured to perform an integrity check on the second encrypted packet according to a transport layer security protocol, where the check fails.

[0052] Related to the third aspect, in some implementations of the third aspect, the transceiver unit is further configured to transmit a third encrypted packet to the second device. The third encrypted packet is generated by encrypting the to-be-transmitted packet according to a transport layer security protocol. The transceiver unit is further configured to receive indication information from the second device, the indication information indicating that an integrity check on the third encrypted packet fails.

[0053] According to a fourth aspect, an apparatus is provided. The apparatus includes a transceiver unit and a processing unit. The transceiver unit is configured to receive an encrypted packet from a first device, the encrypted packet including an encrypted packet header and first data, the first data being encrypted by an application layer security protocol but not by a transport layer security protocol. The processing unit is configured to decrypt the encrypted packet header in accordance with the transport layer security protocol.

[0054] For example, the application layer security protocol includes the PDCP layer protocol.

[0055] For example, transport layer security protocols include the MACSec protocol and the IPsec protocol.

[0056] For example, the first data is air interface data. For example, the first data is data received by the first device from a terminal device. In another example, the first data is data received by the first device from a third device, and the first data is data to be transmitted to the terminal device. The third device is configured to generate the first data or to forward the first data. For example, the third device is a source device that transmits data, or a routing device that connects a destination device and a source device in an Ethernet. In another example, the third device is a core network device.

[0057] For example, the first device is a source device for packet transmission or a routing device connecting the source device and the destination device in an Ethernet, the destination device is a destination device for packet transmission in the Ethernet, and the apparatus is the destination device or a routing device connecting the source device and the destination device.

[0058] In some implementations of the fourth aspect, the transceiver unit is further configured to receive first length information from the first device, and the processing unit is further configured to determine a length of the encrypted packet header before encryption based on the first length information.

[0059] Related to the fourth aspect, in some implementations of the fourth aspect, the encrypted packet further includes encrypted data, and the processing unit is further configured to decrypt the encrypted data in accordance with a transport layer security protocol to obtain the second data.

[0060] For example, the second data includes control data, management plane data, or synchronized clock data transmitted over the fronthaul interface.

[0061] In some implementations of the fourth aspect, the transceiver unit is further configured to receive second length information from the first device, and the processing unit is further configured to determine a length of the second data based on the second length information.

[0062] According to a fifth aspect, the application provides an apparatus including a processor. The processor is coupled to a memory and is configured to execute instructions in the memory to perform a method according to the first aspect and any one of the possible implementations of the first aspect. The apparatus further includes the memory. The apparatus further includes a communication interface, the processor being coupled to the communication interface.

[0063] In some implementations, the apparatus is a first device. When the apparatus is a first device, the communication interface may be a transceiver or an input / output interface.

[0064] In other implementations, the apparatus is a chip or a chip system configured in the first device. When the apparatus is a chip or a chip system configured in the first device, the communication interface may be an input / output interface.

[0065] The transceiver may be a transceiver circuit. The input / output interface may be an input / output circuit.

[0066] According to a sixth aspect, the application provides an apparatus including a processor. The processor is coupled to a memory and is configured to execute instructions in the memory to perform a method according to the second aspect and any one of the possible implementations of the second aspect. The apparatus further includes the memory. The apparatus further includes a communication interface, the processor being coupled to the communication interface.

[0067] In some implementations, the apparatus is a second device. When the apparatus is a second device, the communication interface may be a transceiver or an input / output interface.

[0068] In other implementations, the apparatus is a chip or a chip system configured in a second device. When the apparatus is a chip or a chip system configured in a second device, the communication interface may be an input / output interface.

[0069] The transceiver may be a transceiver circuit. The input / output interface may be an input / output circuit.

[0070] According to a seventh aspect, the application provides a processor including an input circuit, an output circuit, and a processing circuit configured to receive a signal through the input circuit and transmit a signal through the output circuit, whereby the processor performs a method according to the above aspect.

[0071] In a specific implementation process, the processor may be a chip, the input circuit may be an input pin, the output circuit may be an output pin, and the processing circuit may be a transistor, a gate circuit, a flip-flop, or various logic circuits, etc. The input signal received by the input circuit may be, for example, but not limited to, received by a receiver and input by it. The signal output by the output circuit may be, for example, but not limited to, output to a transmitter and transmitted by it. In addition, the input circuit and the output circuit may be the same circuit. A circuit is used as an input circuit or an output circuit at different times. The specific implementation of the processor and various circuits is not limited in the embodiments of this application.

[0072] According to an eighth aspect, the application provides a processing device including a communication interface and a processor. The communication interface is coupled to the processor. The communication interface is configured to input and / or output information. The information includes at least one of instructions or data. The processor is configured to execute a computer program, whereby the processing device performs a method according to the above aspect.

[0073] According to a ninth aspect, the application provides a processing device including a processor and a memory, the processor configured to read instructions stored in the memory, receive signals through the receiver, and transmit signals through the transmitter, such that the processing device performs a method according to the above aspect.

[0074] Alternatively, there are one or more processors. Where a memory is present, there may be one or more memories.

[0075] Alternatively, the memory may be integrated with the processor, or the memory and the processor may be located separately.

[0076] In a specific implementation process, the memory may be a non-transitory memory, such as a read-only memory (ROM). The memory and the processor may be integrated on the same chip, or may be separately arranged on different chips. The type of memory and the manner of arranging the memory and the processor are not limited in the embodiments of this application.

[0077] It should be understood that in the related information exchange process, for example, sending the indication information may be a process of outputting the indication information from a processor, and receiving the indication information may be a process of inputting the received indication information to a processor. Specifically, the information output by the processor may be output to a transmitter, and the input information received by the processor may be from a receiver. The transmitter and receiver may be collectively referred to as a transceiver.

[0078] The apparatus according to the eighth and ninth aspects may be a chip, and the processor may be implemented through hardware or software. When implemented through hardware, the processor may be a logic circuit or an integrated circuit, etc. When implemented through software, the processor may be a general-purpose processor, and is implemented by reading software code stored in a memory. The memory may be integrated into the processor, or may exist independently outside the processor.

[0079] According to a tenth aspect, the present application provides a computer program product. The computer program product includes a computer program (which may also be referred to as code or instructions). When executed, the computer program enables a computer to perform a method according to the above aspect.

[0080] According to an eleventh aspect, the present application provides a computer readable storage medium. The computer readable storage medium stores a computer program (which may also be referred to as code or instructions). When the computer program is executed on a computer, the computer is enabled to perform a method according to the above aspect.

[0081] According to a twelfth aspect, the application provides a system including the first device and the second device described above. [Brief description of the drawings]

[0082] [Figure 1] FIG. 1 is a schematic diagram of a system applicable to a method according to an embodiment of the present application. [Diagram 2] 1 is a schematic flow chart of a method according to an embodiment of the present application. [Diagram 3] FIG. 2 is a schematic diagram of generating a packet to be sent by a first device. [Figure 4] FIG. 2 is a schematic diagram showing the format of a packet to be transmitted. [Diagram 5] FIG. 1 is a schematic block diagram of an apparatus according to an embodiment of the present application. [Figure 6] FIG. 1 is a schematic diagram of the structure of an apparatus according to an embodiment of the present application. [Figure 7] FIG. 1 is a schematic diagram of a chip system according to an embodiment of the present application. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0083] The following describes the technical solutions in the embodiments of this application with reference to the accompanying drawings.

[0084] The technical solutions in the embodiments of this application are applicable to various communication systems, such as long term evolution (LTE) systems, frequency division duplex (FDD) systems, time division duplex (TDD) systems, worldwide interoperability for microwave access (WiMAX) communication systems, fifth generation (5G) systems, and the like. th generation, 5G) system, new radio, NR, sixth generation th The present invention may be applied to a 5G (6G) (first generation) system, a 5G (sixth generation) system, or a future communication system. The 5G mobile communication system in this application includes a non-standalone (NSA) 5G mobile communication system or a standalone (SA) 5G mobile communication system. The communication system may be a public land mobile network (PLMN), a device-to-device (D2D) communication system, a machine to machine (M2M) communication system, an internet of things (IoT) communication system, a vehicle to everything (V2X) communication system, an unmanned aerial vehicle (UAV) communication system, or other communication system.

[0085] In the description of this application, unless otherwise specified, " / " indicates that related objects are in an "or" relationship. For example, A / B may represent A or B. In this application, "and / or" is merely an association relationship to describe related objects, and indicates that three relationships may exist. For example, A and / or B may indicate that only A exists, that both A and B exist, and that only B exists. A and B may be singular or plural. In addition, in the description of this application, unless otherwise specified, "plurality" means two or more. "At least one of the following items (portions)" or similar expressions indicates any combination of these items, including any combination of singular items (portions) or multiple items (portions). For example, at least one of a, b, or c may represent a, b, c, ab, ac, bc, or abc, and a, b, and c may be one or more.

[0086] In addition, in order to clearly describe the technical solutions in the embodiments of this application, terms such as "first" and "second" are used in the embodiments of this application to distinguish between the same or similar objects whose functions and purposes are basically the same. Those skilled in the art may understand that terms such as "first" and "second" do not limit the quantity or execution order, and terms such as "first" and "second" do not indicate absolute differences. In addition, in the embodiments of this application, words such as "example" or "for example" are used to represent examples or explanations. In the embodiments of this application, any embodiment or design solution described as "for example" should not be construed as being more preferred or advantageous than other embodiments or design solutions. In particular, the use of words such as "for example" is intended to show correlation probabilities in a concrete manner for ease of understanding.

[0087] In addition, the network architecture and service scenarios described in the embodiments of this application are intended to more clearly explain the technical solutions in the embodiments of this application, but do not constitute limitations on the technical solutions provided in the embodiments of this application. Those skilled in the art may understand that the technical solutions provided in the embodiments of this application can also be applied to similar technical problems when network architectures evolve and new service scenarios emerge.

[0088] In order to facilitate understanding of the embodiments of this application, an application scenario of the embodiments of this application will first be described in detail with reference to FIG.

[0089] FIG. 1 is an architecture of a system applicable to the method according to an embodiment of this application. As shown in FIG. 1, the system includes a first device and a second device. The first device and the second device are devices that can transmit packets in an Ethernet. For example, the first device may be a source device for packet transmission or a routing device that connects a source device and a destination device in an Ethernet, and the second device may be a destination device for packet transmission or a routing device that connects a source device and a destination device in an Ethernet. For example, the first device is a source device and the second device is a destination device. Alternatively, the first device is a source device and the second device is a routing device. Alternatively, the first device is a routing device and the second device is a destination device. Alternatively, both the first device and the second device are routing devices.

[0090] For example, the source device may be a control device for packet transmission based on an enhanced common public radio interface (eCPRI) protocol in Ethernet, the destination device may be a radio frequency device for packet transmission based on the eCPRI protocol in Ethernet, and the routing device may be an extension device for packet transmission based on the eCPRI protocol in Ethernet. Alternatively, the source device may be a radio frequency device for packet transmission based on the eCPRI protocol in Ethernet, and the destination device may be a control device for packet transmission based on the eCPRI protocol in Ethernet. For example, the eCPRI protocol is a protocol defined in the eCPRI specification V2.0.

[0091] The control device may function as a main device of the base station, process digital baseband signals, and provide control and management of the functions of the devices of the base station. The radio frequency device may function as a radio frequency module of the base station, and may be configured to process intermediate frequency signals and / or radio frequency signals, or to receive and transmit radio signals. Alternatively, the radio frequency device may be configured to process baseband digital signals, for example, to perform a fast Fourier transform (FFT) on the baseband digital signals. The extension device is configured to provide a function of data aggregation and distribution for communication between the control device and the radio frequency devices. For example, in the uplink direction, the extension device receives uplink signals from the radio frequency device, performs radio frequency combination on the received uplink signals, and transmits the received uplink signals to the control device. In another example, in the downlink direction, the extension device receives downlink signals transmitted by the control device, and transmits the downlink signals to all connected radio frequency devices.

[0092] It should be noted that the specific types of the control device, the extension device, and the radio frequency device are not limited in the embodiments of this application. For example, the control device may be any one of the following: a baseband unit (BBU or BU), a distributed unit (DU), or a central unit (CU). The extension device may be any one of the following: a switch, a router, a LAN switch (LSW), or a radio remote unit hub (rHUB). The radio frequency device may be any one of the following: a radio remote unit (RRU), a radio unit (RU), an active antenna unit (AAU), and a pico radio remote unit (pRRU).

[0093] In some deployments, the control device may include a central unit (CU) and a DU. The DU is connected to the extension device through optical fiber. Furthermore, the CU may utilize a separate control plane (CP) and user plane (UP) architecture. In other words, the CU may include a CU-CP entity and a CU-UP entity.

[0094] In another example, the source device may be a DU that transmits packets based on an enhanced common public radio interface (eCPRI) protocol in Ethernet, and the destination device may be a CU that transmits packets based on the eCPRI protocol in Ethernet. Alternatively, the source device may be a CU that transmits packets based on the eCPRI protocol in Ethernet, and the destination device may be a DU that transmits packets based on the eCPRI protocol in Ethernet. The CU realizes some functions of a base station, and the DU realizes some functions of a base station. For example, the CU is responsible for processing non-real-time protocols and services, and realizes functions of a radio resource control (RRC) layer and a packet data convergence protocol (PDCP) layer. The DU is responsible for processing physical layer protocols and real-time services, and realizes functions of a radio link control (RLC) layer, a medium access control (MAC) layer, and a physical (PHY) layer.

[0095] In another example, the source device may be an integrated access and backhaul (IAB) node transmitting data in an Ethernet. The destination device may be an IAB donor transmitting packets in an Ethernet. The routing device may be an IAB node transmitting packets in an Ethernet. Alternatively, the source device may be an IAB donor transmitting packets in an Ethernet and the destination device may be an IAB node transmitting packets in an Ethernet.

[0096] Before sending a packet to the second device, the first device encrypts the packet to be sent according to a transport layer security protocol to obtain the encrypted packet, and adds a cyclic redundancy check (CRC) sequence to the encrypted packet. Correspondingly, after receiving the encrypted packet, the second device performs a CRC check on the encrypted packet and decrypts the encrypted packet according to the transport layer security protocol. If an error occurs in the transmission process of the encrypted packet, the second device first corrects the encrypted packet. For example, in a packet transmission process based on the eCPRI protocol in Ethernet, the second device may correct the encrypted packet through base forward error correction (FEC) or Reed-Solomon (RS) FEC. After correcting the encrypted packet, the second device performs a CRC check on the encrypted packet and decrypts the encrypted packet according to the transport layer security protocol.

[0097] In each packet transmission process, the first device and the second device encrypt and decrypt the transmitted packets according to a transport layer security protocol, which imposes a relatively high requirement on the hardware processing capability of the first device and the second device, resulting in low packet transmission efficiency.

[0098] In this respect, an embodiment of the present application provides a secure transmission method for reducing the processing load of a first device and a second device and improving packet transmission efficiency.

[0099] 2 is a schematic flowchart of a secure transmission method according to an embodiment of this application. As shown in FIG. 2, a method 200 may include S210 to S230.

[0100] S210. The first device encrypts a packet header of a packet to be sent according to a transport layer security protocol to obtain an encrypted packet header.

[0101] For details of the first device, see FIG.

[0102] The packet to be transmitted includes a packet header and first data. The first data is encrypted by an application layer security protocol but not encrypted by a transport layer security protocol. For example, the first data is data generated by the first device, and the first data is data transmitted to the terminal device. In another example, the first data is data received by the first device from the terminal device. In another example, the first data is data received by the first device from a third device, and the first data is data transmitted to the terminal device. The third device is configured to generate the first data or to forward the first data. For example, the third device is a source device that transmits data, or a routing device that connects a destination device and a source device in an Ethernet. In another example, the third device is a core network device.

[0103] For example, transport layer security protocols include media access control security (MACSec) protocol, internet protocol security (IPsec) protocol, transport layer security (TLS) protocol, and secure socket layer (SSL) protocol, and application layer security protocols include packet data convergence protocol (PDCP) layer protocol.

[0104] With reference to FIG. 3, the following describes a process of the first device generating a packet to be sent in an example where the first data is data received by the first device from a terminal device.

[0105] As shown in Figure 3, after receiving an IP data packet from an internet protocol (IP) layer, a service data adaptation protocol (SDAP) entity of the terminal device uses the IP data packet as an SDAP service data unit (SDU). Furthermore, the SDAP entity of the terminal device adds an SDAP header to the SDAP SDU according to the SDAP layer protocol, and then obtains an SDAP protocol data unit (PDU). Furthermore, the SDAP entity of the terminal device sends the SDAP PDU to a PDCP entity of the terminal device.

[0106] After receiving the SDAP PDU, the PDCP entity of the terminal device uses the SDAP PDU as a PDCP SDU, and performs integrity protection on the part of the PDCP SDU other than the SDAP header according to the PDCP layer protocol. The manner in which the PDCP entity of the terminal device performs integrity protection on the PDCP SDU according to the PDCP layer protocol is as follows: That is, the PDCP entity calculates a message authentication code for integrity (MAC-I) based on a first integrity protection algorithm and a first integrity protection key configured by an upper layer (e.g., a radio resource control (RRC) layer), and concatenates the MAC-I to the end of the PDCP SDU. Furthermore, the PDCP entity performs confidentiality encryption on the part of the PDCP SDU other than the SDAP header according to the PDCP layer protocol. The manner in which the PDCP entity of the terminal device performs confidentiality encryption on the PDCP SDU according to the PDCP layer protocol is as follows: That is, the PDCP entity performs confidentiality encryption on the PDCP SDU based on a first confidentiality protection algorithm and a first confidentiality protection key configured by an upper layer (e.g., an RRC layer), and then the PDCP entity of the terminal device adds a PDCP header to the encrypted packet to obtain a PDCP PDU, and sends the PDCP PDU to a radio link control (RLC) entity of the terminal device.

[0107] Alternatively, the PDCP entity of the terminal device may further perform network coding on the PDCP PDU, for example, may perform network coding on the PDCP PDU based on a low density parity check code (LDPC).

[0108] After receiving the PDCP PDU, the RLC entity of the terminal device uses the PDCP PDU as an RLC SDU and adds an RLC header to the RLC SDU according to an RLC layer protocol to obtain an RLC PDU. Furthermore, the RLC entity of the terminal device sends the RLC PDU to a media access control (MAC) entity of the terminal device. After receiving the RLC PDU, the MAC entity of the terminal device uses the RLC PDU as a MAC SDU and adds an MAC header to the MAC SDU according to a MAC layer protocol to obtain a MAC PDU. Furthermore, after adding an L1 header to the MAC PDU according to a layer 1 (L1) protocol, the terminal device obtains first data that can be transmitted over the air interface, and sends the first data to the AAU over the air interface.

[0109] It should be noted that in Fig. 3, only the example in which the PDCP entity performs integrity protection and confidentiality encryption on parts of the PDCP SDU other than the SDAP header is used for explanation. For example, the PDCP entity of the terminal device may perform integrity protection and confidentiality encryption on all parts included in the PDCP SDU. In other examples, the PDCP entity of the terminal device may perform integrity protection or confidentiality encryption on the PDCP SDU.

[0110] Also, it should be noted that in Fig. 3, the transport layer security protocol is used as an example as a PDCP layer protocol. In future communication systems, the transport layer security protocol may be an SDAP layer protocol, an RLC layer protocol, etc., which is not limited in the embodiment of this application.

[0111] Further, as shown in FIG. 3, after receiving the first data from the terminal device, the AAU encapsulates the first data according to the eCPRI protocol to obtain a packet to be transmitted.

[0112] After generating the packet to be transmitted, the first device encrypts a packet header of the packet to be transmitted in accordance with a transport layer security protocol. The first device encrypting the packet header of the packet to be transmitted in accordance with the transport layer security protocol includes the first device performing confidentiality encryption on the packet header of the packet to be transmitted in accordance with the transport layer security protocol and / or the first device performing integrity protection on the packet to be transmitted in accordance with the transport layer security protocol.

[0113] The first device performing integrity protection on a packet header of the packet to be transmitted according to the transport layer security protocol includes the first device performing integrity protection on the packet header of the packet to be transmitted based on a second integrity protection algorithm and a second integrity protection key. The second integrity protection algorithm is an integrity protection algorithm defined by the transport layer security protocol. When the transport layer security protocol defines a plurality of integrity protection algorithms, the first device and the second device may negotiate the second integrity protection algorithm to be used. For example, the first device and the second device negotiate the second integrity protection algorithm to be used according to the following steps: Step 1: The first device transmits at least one integrity protection algorithm supported by the first device to the second device. Step 2: The second device selects an integrity protection algorithm supported by the second device from the at least one integrity protection algorithm supported by the first device, and uses the selected integrity protection algorithm as the second integrity protection algorithm. Step 3: The second device sends a second integrity protection algorithm to the first device. The second integrity protection key is an integrity protection key defined by a transport layer security protocol. The second integrity protection key is a pre-configured key or a key generated by the first device and the second device through negotiation. For example, if the first device encrypts a packet header of a packet to be transmitted according to a MACSec protocol, the first device and the second device may negotiate the second integrity protection key according to a MACSec key agreement (MKA) protocol.Specifically, the first device and the second device discover, according to the MKA protocol, that both the first device and the second device have the same connectivity association key (CAK). The first device and the second device then generate an integrity check value key (ICK) based on the same key algorithm, the same CAK, and the same random number. The ICK is a second integrity protection key.

[0114] For example, the first device performing integrity protection on a packet header of the packet to be transmitted based on a second integrity protection algorithm and a second integrity protection key includes the first device obtaining a first integrity check value (ICV) through a calculation based on the second integrity protection algorithm, the second integrity protection key, and the packet header of the packet to be transmitted, and placing the first ICV at an end of the packet header.

[0115] The first device performing confidentiality encryption on a packet header of the packet to be transmitted according to the transport layer security protocol includes the first device encrypting the packet header of the packet to be transmitted based on a second confidentiality protection algorithm and a second confidentiality protection key. The second confidentiality protection algorithm is a confidentiality protection algorithm defined by the transport layer security protocol. When the transport layer security protocol defines a plurality of confidentiality protection algorithms, the first device and the second device may negotiate the second confidentiality protection algorithm to be used. For example, the first device and the second device negotiate the second confidentiality protection algorithm to be used according to the following steps: Step 1: The first device transmits at least one confidentiality protection algorithm supported by the first device to the second device. Step 2: The second device selects a confidentiality protection algorithm supported by the second device from the at least one confidentiality protection algorithm supported by the first device, and uses the selected confidentiality protection algorithm as the second confidentiality protection algorithm. Step 3: The second device sends a second confidentiality protection algorithm to the first device. The second confidentiality protection key is a confidentiality protection key defined by a transport layer security protocol. The second confidentiality protection key is a pre-configured key or a key generated by the first device and the second device through negotiation. For example, when the first device encrypts a packet header of a packet to be transmitted according to a MACSec protocol, the first device and the second device may negotiate a second confidentiality protection key according to an MKA protocol. Specifically, the first device and the second device discover that both the first device and the second device have the same CAK according to the MKA protocol. Then, the first device and the second device generate a security association key (SAK) based on the same key algorithm, the same CAK, and the same random number.The SAK is a second privacy protection key.

[0116] Alternatively, when performing confidentiality encryption on a packet header in accordance with the transport layer security protocol, the first device may perform confidentiality encryption on the packet header or may perform confidentiality encryption on a portion of the packet header other than the first ICV.

[0117] Alternatively, the to-be-transmitted packet further includes second data. For example, the second data includes control data, management plane data, or synchronized clock data transmitted on a fronthaul interface. Alternatively, the second data includes control data, management plane data, or synchronized clock data transmitted on a midhaul interface. Alternatively, the second data includes control data, management plane data, or synchronized clock data transmitted on a backhaul interface. For example, the second data includes one or more of the following: operation administration and maintenance (OAM) data transmitted by the control device to the radio frequency device, synchronized clock data transmitted by the control device to the radio frequency device, and control and management (C&M) data transmitted by the control device to the radio frequency device.

[0118] Moreover, if the packet to be transmitted further includes second data, the method 200 further includes the first device encrypting the second data according to a transport layer security protocol to obtain encrypted data.

[0119] Similar to the manner in which the first device encrypts a packet header of a packet to be transmitted, the first device encrypting the second data includes the first device performing confidentiality encryption and / or integrity protection on the second data in accordance with a transport layer security protocol. The first device performing confidentiality encryption on the second data in accordance with the transport layer security protocol includes the first device encrypting the second data based on a second confidentiality protection algorithm and a second confidentiality protection key. The first device performing integrity protection on the second data in accordance with the transport layer security protocol includes the first device performing integrity protection on the second data based on a second integrity protection algorithm and a second integrity protection key.

[0120] Alternatively, the second data included in the to-be-sent packet is placed before the first data. For example, a packet format of a to-be-sent packet is shown in FIG.

[0121] Alternatively, if the second data is placed before the first data, in S210, the first device simultaneously encrypts the packet header and the second data of the packet to be transmitted according to a transport layer security protocol. For example, the first device simultaneously performing integrity protection on the packet header and the second data based on the second integrity protection algorithm and the second integrity protection key includes the first device calculating a second ICV based on the second integrity protection algorithm, the second integrity protection key, the packet header, and the second data, and placing the second ICV at the end of the second data.

[0122] Alternatively, if the packet to be transmitted includes the second data but not the first data, the first device encrypts the entire packet to be transmitted in accordance with the Transport Layer Security transport protocol.

[0123] Alternatively, the first device may further perform a CRC check on the packet to be transmitted. Specifically, the first device generates a CRC sequence based on the data included in the packet to be transmitted, and places the CRC sequence after the data included in the packet to be transmitted. The data included in the packet to be transmitted is the first data and / or the second data.

[0124] Alternatively, the first device does not perform a CRC check on the packets it sends.

[0125] Alternatively, before S210, the method 200 further includes S240a and S250a.

[0126] The first device receives the second encrypted packet from the second device. In response, in S240a, the second device transmits the second encrypted packet to the first device.

[0127] The second encrypted packet is a packet encrypted by a transport layer security protocol. For example, the second encrypted packet is a packet that has been confidentiality encrypted and integrity protected according to a transport layer security protocol. In another example, the second encrypted packet is a packet that has been integrity protected according to a transport layer security protocol.

[0128] S250a. The first device performs an integrity check on the second encrypted packet according to a Transport Layer Security protocol, where the check fails.

[0129] If, at S250a., the first device determines that the integrity check performed on the second encrypted packet fails, the method 200 performs S210.

[0130] For example, if the second encrypted packet is data on which confidentiality encryption and integrity protection are performed, after receiving the second encrypted packet, the first device first decrypts the second encrypted packet based on the second confidentiality protection algorithm and the second confidentiality protection key. Then, the first device obtains an ICV' through calculation based on the second integrity protection algorithm, the second integrity protection key, and the part of the decrypted packet other than the ICV. If the ICV' is inconsistent with the ICV in the decrypted packet, the first device determines that the integrity check for the second encrypted packet has failed.

[0131] In another example, if the second encrypted packet is a packet on which integrity protection is performed, after receiving the second encrypted packet, the first device calculates an ICV' based on the second integrity protection algorithm, the second integrity protection key, and the portion of the second encrypted packet other than the ICV, and if the ICV' is inconsistent with the ICV in the second encrypted packet, the first device determines that the integrity check for the second encrypted packet is unsuccessful.

[0132] For example, in S250a, the failure of the integrity check performed by the first device on the second encrypted packet means that the failure of the integrity check performed on the packet received from the second device is the first time. In other words, before the first device receives the second encrypted packet from the second device, the integrity check performed by the first device according to the transport layer security protocol on all encrypted packets received from the second device is successful. In other words, when the integrity check performed by the first device according to the transport layer security protocol on the encrypted packet received from the second device fails, the first device encrypts the packet to be sent with the packet encryption method described in S210. In other words, the first device encrypts the packet header of the packet to be sent according to the transport layer security protocol to obtain the encrypted packet header.

[0133] In another example, in S250a, the failure of the integrity check performed by the first device on the second encrypted packet is the failure of the integrity check performed on the packet received from the second device for the Nth time, where N is a positive integer and N is a preset threshold. In other words, the integrity check performed by the first device on the encrypted packet header received from the second device according to the transport layer security protocol reaches a preset threshold. Specifically, when the number of times of the integrity check performed by the first device on the encrypted packet received from the second device according to the transport layer security protocol reaches a preset threshold, the first device encrypts the packet to be transmitted with the packet encryption method described in S210. In other words, the first device encrypts the packet header of the packet to be transmitted according to the transport layer security protocol to obtain the encrypted packet header.

[0134] Alternatively, before S210, the method 200 further includes S240b and S250b.

[0135] The first device transmits the third encrypted packet to the second device. Correspondingly, in S240b, the second device receives the third encrypted packet from the first device.

[0136] The third encrypted packet is a packet encrypted by a transport layer security protocol. For example, the third encrypted packet is a packet on which confidentiality encryption and integrity protection have been performed according to a transport layer security protocol. In another example, the third encrypted packet is a packet on which integrity protection has been performed according to a transport layer security protocol.

[0137] The second device transmits the indication information to the first device. In response, in S250b, the first device receives the indication information from the second device.

[0138] The indication information indicates that an integrity check on the third encrypted packet fails.If, at S250b, the first device receives the indication information from the second device, the method 200 performs S210.

[0139] After receiving the third encrypted packet from the first device, the second device performs an integrity check on the third encrypted packet according to a transport layer security protocol, and if the integrity check performed by the second device on the third encrypted packet according to the transport layer security protocol fails, the second device sends an indication information to the first device.

[0140] For example, if the third encrypted packet is data on which confidentiality encryption and integrity protection are performed, after receiving the third encrypted packet, the second device first decrypts the third encrypted packet based on the second confidentiality protection algorithm and the second confidentiality protection key. Then, the second device obtains an ICV' through calculation based on the second integrity protection algorithm, the second integrity protection key, and the part of the decrypted packet other than the ICV. If the ICV' is inconsistent with the ICV in the decrypted packet, the second device determines that the integrity check on the third encrypted packet has failed.

[0141] In another example, if the third encrypted packet is a packet on which integrity protection is performed, after receiving the third encrypted packet, the second device calculates an ICV' based on the second integrity protection algorithm, the second integrity protection key, and the portion of the third encrypted packet other than the ICV, and if the ICV' is inconsistent with the ICV in the third encrypted packet, the second device determines that the integrity check on the third encrypted packet has failed.

[0142] For example, in S250a, the first device receives the indication information from the second device for the first time. In other words, when the first device receives the indication information from the second device, the first device encrypts the packet to be sent by the packet encryption method described in S210, in other words, the first device encrypts the packet header of the packet to be sent according to the transport layer security protocol to obtain the encrypted packet header.

[0143] In another example, in S250a, the first device receives the indication information from the second device for the Nth time, where N is a positive integer and N is a preset threshold. In other words, when the number of times the first device receives the indication information from the second device reaches the preset threshold, the first device encrypts the packet to be transmitted by the packet encryption method described in S210, in other words, the first device encrypts the packet header of the packet to be transmitted according to the transport layer security protocol to obtain the encrypted packet header.

[0144] S220. The first device transmits the first encrypted packet to the second device. Correspondingly, in S220, the second device receives the first encrypted packet from the first device.

[0145] The first encrypted packet includes an encrypted packet header and first data. In other words, after generating the packet to be sent, the first device obtains the first encrypted packet after encrypting a packet header of the packet to be sent according to a transport layer security protocol, and sends the first encrypted packet to the second device.

[0146] Alternatively, the method 200 further includes the first device transmitting to the second device length information of the packet header of the packet to be transmitted (i.e., the first length information), the length information of the packet header being utilized to determine the length of the packet header.

[0147] Alternatively, before the first device transmits the first encrypted packet to the second device, the first device transmits the first length information to the second device.

[0148] As described above, in the process of generating a packet to be transmitted, the first device may add a service type field before the first data based on the service type of the first data. It should be understood that different service types may have different lengths of the service type field. As a result, the length of the packet header may be different. Therefore, in order to enable the second device to correctly decrypt the first encrypted packet, the first device may send the length information of the packet header to the second device.

[0149] Alternatively, the method 200 further includes the first device transmitting service type information to the second device, the service type information indicating a service type of the first data, the service type of the first data being utilized to determine a length of a packet header of the packet to be transmitted.

[0150] Alternatively, when the packet to be sent includes the second data, the first encrypted packet includes an encrypted packet header, the encrypted data, and the first data. In other words, after generating the packet to be sent, the first device obtains the first encrypted packet after encrypting the packet header and the second data of the packet to be sent according to a transport layer security protocol, and sends the first encrypted packet to the second device.

[0151] Alternatively, when the to-be-transmitted packet includes second data, the method 200 further includes the first device transmitting length information of the second data (i.e., second length information) to the second device, where the length information of the second data is utilized to determine the length of the second data.

[0152] Alternatively, before the first device sends the first encrypted packet to the second device, the first device sends the second length information to the second device.

[0153] Alternatively, if the first device performs a CRC check on the packet to be sent, the first encrypted packet further includes a CRC sequence.

[0154] S230. The second device decrypts the encrypted packet header included in the first encrypted packet according to a transport layer security protocol.

[0155] For example, in S210, if the first device performs confidentiality encryption and integrity protection on the packet header of the packet to be transmitted according to a transport layer security protocol, in S230, the second device first decrypts the encrypted packet header based on a second confidentiality protection algorithm and a second confidentiality protection key to obtain the packet header. Then, the second device obtains a first ICV' through a calculation based on the second integrity protection algorithm, the second integrity protection key, and the part of the packet header other than the first ICV. If the first ICV' is consistent with the first ICV, the second device determines that the integrity check on the encrypted packet header is successful.

[0156] In another example, in S210, if the first device performs confidentiality encryption on the packet header of the packet to be sent according to a transport layer security protocol, in S230, the second device decrypts the encrypted packet header based on a second confidentiality protection algorithm and a second confidentiality protection key to obtain the packet header.

[0157] In another example, in S210, if the first device performs integrity protection on the packet header of the packet to be transmitted according to a transport layer security protocol, in S230, the second device obtains a first ICV' through a calculation based on a second integrity protection algorithm, a second integrity protection key, and the part of the encrypted packet header other than the first ICV. If the first ICV' is consistent with the first ICV, the second device determines that the integrity check on the encrypted packet header is successful.

[0158] Alternatively, when the second device receives the first length information from the first device, the second device first determines the length of the encrypted packet header before encryption based on the first length information. Then, the second device decrypts the encrypted packet header based on the length of the encrypted packet header before encryption. For example, the second device calculates the length of the encrypted packet header based on the second confidentiality protection algorithm, the second confidentiality protection key, and the first length information. Furthermore, the second device places the encrypted packet header within the first encrypted packet based on the calculated length of the encrypted packet header. Furthermore, the second device decrypts the encrypted packet header.

[0159] Alternatively, if the first encrypted packet further includes encrypted data, in S230, the second device further decrypts the encrypted data according to a transport layer security protocol to obtain the second data. The manner in which the second device decrypts the encrypted data is the same as the manner in which the second device decrypts the encrypted packet header. For the sake of brevity, the details are not described again here.

[0160] Alternatively, when the second device receives the second length information from the first device, the second device first determines the length of the encrypted data before encryption based on the second length information. Then, the second device decrypts the encrypted data based on the length of the encrypted data before encryption. For example, the second device calculates the length of the encrypted data based on the second confidentiality protection algorithm, the second confidentiality protection key, and the second length information. Furthermore, the second device places the encrypted data in a first encrypted packet based on the calculated length of the encrypted data. Furthermore, the second device decrypts the encrypted packet.

[0161] Alternatively, if the first encrypted packet further includes a CRC check code, the second device further performs a CRC check on the first encrypted packet based on the CRC check code, and if the first encrypted packet does not include a CRC check code, the second device does not perform a CRC check on the first encrypted packet.

[0162] Alternatively, if the second device successfully decrypts the encrypted packet header, the second device sends the first data to a fourth device. The fourth device is a destination device that transmits the data, or a routing device that connects the destination device and the source device in an Ethernet. Alternatively, the fourth device is a terminal device or a core network device. For example, the second device is a radio frequency device and the fourth device is a terminal device. Alternatively, the second device is a control device and the fourth device is a core network device.

[0163] Alternatively, when the first data is data to be transmitted to a terminal device, if an error occurs on the first data in the process of transmitting the first data from the first device to the second device, the terminal device corrects the first data after receiving the first data. For example, the terminal device corrects the first data based on a turbo code, a polar code, or an LDPC code.

[0164] Alternatively, when the first data is data sent by a terminal device to a control device or a core network device, if an error occurs on the first data in the process of transmitting the first data from the first device to the second device, the control device or the core network device corrects the first data after receiving the first data, for example, the control device or the core network device corrects the first data based on a turbo code, a polar code, or an LDPC code.

[0165] In an embodiment of this application, if a packet to be transmitted includes first data encrypted by an application layer security protocol, when encrypting the packet to be transmitted according to a transport layer security protocol, the first device encrypts a packet header of the packet to be transmitted, but does not encrypt the first data. Correspondingly, after receiving the encrypted packet, the second device decrypts the encrypted packet header included in the encrypted packet, but does not decrypt the first data. Therefore, the processing load of the first device and the second device can be reduced, the chip cost and power consumption of the first device and the second device can be reduced, and the packet transmission efficiency can be improved.

[0166] Since the first data is data encrypted by an application layer security protocol, secure transmission of the first data between the first device and the second device can be guaranteed even if the first device does not encrypt the first data. In addition, since a packet header of a packet to be transmitted is not encrypted, secure transmission of the packet header between the first device and the second device can be guaranteed after the first device encrypts the packet header according to the transport layer security protocol.

[0167] In addition, since the packet header occupies a small proportion of the whole packet to be transmitted, the encrypted packet header occupies a small proportion in the first encrypted packet. Furthermore, since the encrypted packet header has a short length, the encrypted packet header is less prone to errors during transmission, and the second device is less likely to fail to decrypt the encrypted packet header according to the transport layer security protocol. Therefore, the probability that the second device discards the first data due to failure to decrypt or perform an integrity check on the packet header is also reduced. Therefore, according to the above technical solution, when secure transmission is guaranteed, the error resilience capability of the link between the first device and the second device can be improved. If the first data is air interface data, the spectrum utilization of the air interface can be improved when the probability of discarding the first data is reduced.

[0168] In addition, when the first device determines that the integrity check on the second encrypted packet fails or receives the indication information, the secure transmission method provided in the embodiment of this application is utilized, thereby improving the error tolerance capability of the link between the first device and the second device without the need to replace the hardware of the first device and / or the second device. For example, when the first device and the second device are connected by an optical fiber link, if the integrity check on the encrypted packet transmitted between the first device and the second device fails, the following problems may occur: the power of the optical module disposed on the first device and / or the second device is degraded, the optical signal is attenuated due to the remote optical fiber between the first device and the second device, and the optical fiber splice causes insertion loss. In this case, the secure transmission method provided in the embodiment of this application can be utilized to improve the error tolerance capability of the link between the first device and the second device without replacing the optical module of the first device and the optical module or optical fiber of the second device.

[0169] The method provided in the embodiment of this application is described in detail above with reference to Figures 2 to 4. The apparatus provided in the embodiment of this application is described in detail below with reference to Figures 5 to 7. It should be understood that the description of the apparatus embodiment corresponds to the description of the method embodiment. Therefore, for the contents that are not described in detail, please refer to the above method embodiment. For the sake of brevity, the details will not be described again here.

[0170] 5 is a schematic block diagram of an apparatus 1000 according to an embodiment of the present application. As shown in the figure, the apparatus 1000 may include a transceiver unit 1010 and a processing unit 1020.

[0171] In a possible design, the apparatus 1000 may be the first device in the above method embodiments, or may be a chip configured to realize the functions of the first device in the above method embodiments.

[0172] It should be understood that the apparatus 1000 may correspond to the first device in the method 200 according to the embodiment of this application, and the apparatus 1000 may include units configured to execute the method executed by the first device included in the method 200 of Fig. 2. In addition, the units in the apparatus 1000 and other operations and / or functions described above are separately utilized to implement the corresponding procedures of the method 200 of Fig. 2. It should be further understood that the specific processes by which the units execute the corresponding steps described above have been described in detail in the method embodiments above, and will not be described in detail here for the sake of brevity.

[0173] In another possible design, the apparatus 1000 may be the second device in the above method embodiments, or may be a chip configured to realize the functions of the second device in the above method embodiments.

[0174] It should be understood that the apparatus 1000 may correspond to the second device in the method 200 according to the embodiment of this application, and the apparatus 1000 may include a unit configured to execute the method executed by the second device included in the method 200 of Fig. 2. In addition, the units in the apparatus 1000 and other operations and / or functions described above are separately utilized to implement the corresponding procedures of the method 200 of Fig. 2. It should be further understood that the specific processes by which the units execute the corresponding steps described above have been described in detail in the method embodiments above, and will not be described in detail here for the sake of brevity.

[0175] It should further be understood that the transceiver unit 1010 in the apparatus 1000 may correspond to the transceiver 2020 in the apparatus 2000 shown in FIG. 6, and the processing unit 1020 in the apparatus 1000 may correspond to the processor 2010 in the apparatus 2000 shown in FIG. 6.

[0176] When the device 1000 is a chip, it should be further understood that the chip includes a transceiver unit and a processing unit. The transceiver unit may be an input / output circuit or a communication interface. The processing unit may be a processor, a microprocessor, or an integrated circuit integrated on the chip.

[0177] The transceiver unit 1010 is configured to perform signal reception and transmission operations of the apparatus 1000 , and the processing unit 1020 is configured to perform signal processing operations of the apparatus 1000 .

[0178] Alternatively, the apparatus 1000 further includes a storage unit 1030. The storage unit 1030 is configured to store instructions.

[0179] Fig. 6 is a schematic block diagram of an apparatus 2000 according to an embodiment of the present application. As shown in Fig. 6, the apparatus 2000 includes at least one processor 2010 and a transceiver 2020. The processor 2010 is coupled to a memory and configured to execute instructions stored in the memory and control the transceiver 2020 to transmit and / or receive signals. Alternatively, the apparatus 2000 further includes a memory 2030 configured to store instructions.

[0180] It should be understood that the processor 2010 and the memory 2030 may be combined into one processing unit, and the processor 2010 is configured to execute program codes stored in the memory 2030 to achieve the above-described functions. In a specific implementation, the memory 2030 may be integrated into the processor 2010 or may be separate from the processor 2010.

[0181] It should be further understood that the transceiver 2020 may include a receiver (or referred to as a receiver) and a transmitter (or referred to as a transmitter). The transceiver 2020 may further include one or more antennas. The transceiver 2020 may further be a communication interface or interface circuit.

[0182] When the device 2000 is a chip, the chip includes a transceiver unit and a processing unit. The transceiver unit may be an input / output circuit or a communication interface. The processing unit may be a processor, a microprocessor, or an integrated circuit integrated on the chip.

[0183] 7 is a schematic diagram of a chip system according to an embodiment of the present application. Here, the chip system may be a system configured with circuits. The chip system 3000 shown in FIG. 7 includes a logic circuit 3010 and an input / output interface 3020, the logic circuit is coupled to the input interface and configured to transmit data (e.g., first indication information) using the input / output interface to perform the method shown in FIG. 2.

[0184] An embodiment of the present application further provides a processing device, including a processor and an interface. The processor may be configured to perform the method in the above method embodiments.

[0185] It should be understood that the above processing device may be a chip, for example, the processing device may be a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), a system on chip (SoC), a central processing unit (CPU), a network processor (NP), a digital signal processor (DSP) circuit, a micro controller unit (MCU), a programmable logic device (PLD), or other integrated chip.

[0186] In the implementation process, the steps in the above method may be completed by an integrated logic circuit of hardware in a processor, or by an instruction in the form of software. The steps of the method disclosed in relation to the embodiments of this application may be directly executed and completed by a hardware processor, or may be executed and completed by a combination of hardware and software modules in a processor. The software modules may be arranged in a mature storage medium in the art, such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, an electrically erasable programmable memory, or a register. The storage medium is arranged in the memory, and the processor reads the information in the memory and completes the steps in the above method in combination with the hardware of the processor. To avoid repetition, the details will not be described again here.

[0187] It should be noted that the processor in the embodiments of this application may be an integrated circuit chip and has signal processing capabilities. In the implementation process, the steps in the above method embodiments may be completed by an integrated logic circuit of hardware in the processor, or instructions in the form of software. The processor may be a general-purpose processor, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic device, a discrete gate or transistor logic device, or a discrete hardware component. It may realize or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor may be a microprocessor, or the processor may be any conventional processor, etc.

[0188] It should be understood that the memory in the embodiments of this application may be volatile memory, non-volatile memory, or may include volatile memory and non-volatile memory. The non-volatile memory may be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. The volatile memory may be random access memory (RAM) used as an external cache.

[0189] According to the method provided in the embodiment of this application, this application further provides a computer program product, which includes computer program code, which, when executed on a computer, causes the computer to perform the method in the embodiment shown in FIG.

[0190] According to the method provided in the embodiment of this application, this application further provides a computer-readable medium. The computer-readable medium stores a program code. When the program code is executed on a computer, the computer is enabled to execute the method in the embodiment shown in FIG.

[0191] According to a method provided in an embodiment of this application, this application further provides a system including the above first device and a second device.

[0192] All or part of the above embodiments may be realized by software, hardware, firmware, or any combination thereof. When software is used to realize the embodiments, all or part of the embodiments may be realized in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the procedures or functions according to the embodiments of this application are generated in whole or in part. The computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. The computer-readable storage medium may be any available medium accessible by a computer, or a data storage device such as a server or a data center that integrates one or more available media. The available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, or a magnetic tape), an optical medium (e.g., a high-density digital video disc (DVD)), or a semiconductor medium (e.g., a solid-state drive (SSD)), etc.

[0193] In some embodiments provided in this application, it should be understood that the disclosed system, device, and method may be realized in other ways. For example, the described device embodiment is merely an example. For example, the division into units is merely a logical functional division, and may be divided in other ways in actual implementation. For example, multiple units or components may be combined or integrated into other systems, and some features may be omitted or not implemented. In addition, the shown or discussed mutual couplings or direct couplings or communication connections may be realized using some interfaces. Indirect couplings or communication connections between devices or units may be realized in electronic, mechanical, or other forms.

[0194] The above description is merely a specific implementation of this application, and is not intended to limit the scope of protection of this application. Any variations or replacements that are immediately understood by those skilled in the art within the technical scope disclosed in this application should fall within the scope of protection of this application. Therefore, the scope of protection of this application should be subject to the scope of protection of the claims.

Claims

1. encrypting, by a first device, a packet header of a packet to be sent according to a transport layer security protocol to obtain an encrypted packet header, the packet to be sent including first data, the first data being encrypted by an application layer security protocol but not by the transport layer security protocol; transmitting, by the first device, a first encrypted packet to a second device, the first encrypted packet including the encrypted packet header and the first data; A secure transmission method comprising:

2. The application layer security protocol includes a Packet Data Convergence Protocol (PDCP) layer protocol; The method of claim 1.

3. The transport layer security protocol includes a media access control security protocol or an internet protocol security protocol. The method according to claim 1 or 2.

4. The method comprises: transmitting, by the first device, length information of the packet header of the packet to be transmitted to the second device; Further comprising: The method according to any one of claims 1 to 3.

5. The to-be-sent packet further includes second data not encrypted by the application layer security protocol, and the first encrypted packet further includes encrypted data, the method comprising: encrypting, by the first device, the second data in accordance with the Transport Layer Security Protocol to obtain the encrypted data. Further comprising: The method according to any one of claims 1 to 4.

6. The second data is placed before the first data. The method according to claim 5.

7. The method comprises: transmitting, by the first device, length information of the second data to the second device; Further comprising: The method according to claim 5 or 6.

8. the second data comprises control data, management plane data, or synchronized clock data transmitted over a fronthaul interface; The method according to any one of claims 5 to 7.

9. the first data being air interface data; The method according to any one of claims 1 to 8.

10. Before the first encrypted packet is generated, the method further comprises: receiving, by the first device, a second encrypted packet from the second device; performing, by the first device, an integrity check on the second encrypted packet according to the Transport Layer Security Protocol, where the check fails; Further comprising: The method according to any one of claims 1 to 9.

11. Before the first encrypted packet is generated, the method further comprises: sending, by the first device, a third encrypted packet to the second device, the third encrypted packet being generated by encrypting the to-be-sent packet in accordance with the Transport Layer Security Protocol; receiving, by the first device, an indication from the second device, the indication indicating that the integrity check on the third encrypted packet fails; Further comprising: The method according to any one of claims 1 to 10.

12. The first device is a source device for packet transmission or a routing device that connects the source device and a destination device in an Ethernet, the destination device is a destination device for packet transmission in the Ethernet, and the second device is the destination device or a routing device that connects the source device and the destination device. The method according to any one of claims 1 to 11.

13. receiving, by a second device, an encrypted packet from the first device, the encrypted packet including an encrypted packet header and first data, the first data being encrypted by an application layer security protocol but not by a transport layer security protocol; decrypting, by the second device, the encrypted packet header in accordance with the Transport Layer Security protocol; A secure transmission method comprising:

14. The application layer security protocol includes a Packet Data Convergence Protocol (PDCP) layer protocol; The method of claim 13.

15. The transport layer security protocol includes a media access control security protocol or an internet protocol security protocol.

15. The method according to claim 13 or 14.

16. The method comprises: receiving, by the second device, first length information from the first device; determining, by the second device, a length of the encrypted packet header before encryption based on the first length information; Further comprising: The method according to any one of claims 13 to 15.

17. The encrypted packet further comprises encrypted data, the method comprising: decrypting, by the second device, the encrypted data in accordance with the transport layer security protocol to obtain second data. Further comprising: The method according to any one of claims 13 to 16.

18. The method comprises: receiving, by the second device, second length information from the first device; determining, by the second device, a length of the second encrypted data before encryption based on the second length information; Further comprising:

20. The method of claim 17.

19. the second data comprises control data, management plane data, or synchronized clock data transmitted over a fronthaul interface; 19. The method according to claim 17 or 18.

20. The first data is air interface data. The method according to any one of claims 13 to 19.

21. The first device is a source device for packet transmission or a routing device connecting the source device and a destination device in an Ethernet, and the second device is the destination device or a routing device connecting the source device and the destination device. The method according to any one of claims 13 to 20.

22. An apparatus including at least one processor, said at least one processor being coupled to at least one memory, said at least one processor being configured to execute computer programs or instructions stored in said at least one memory, in order for said apparatus to perform a method according to any one of claims 1 to 12.

23. An apparatus including at least one processor, said at least one processor being coupled to at least one memory, said at least one processor being configured to execute computer programs or instructions stored in said at least one memory, such that said apparatus performs a method according to any one of claims 13 to 21.

24. A computer readable storage medium, the computer readable storage medium storing a computer program, the computer program being capable of performing the method according to any one of claims 1 to 21 when executed.

25. A system comprising the apparatus of claim 22 and the apparatus of claim 23.

Images