COMMUNICATION METHOD AND COMMUNICATION DEVICE

Abstract

The present application provides a communication method and a communication device. The method may include: a session management network element obtains first indication information in a process of session establishment in a first network for a terminal device, the first indication information indicating that user plane integrity protection in a second network is supported. The session management network element sends a first request message to an access and mobility management function network element in the first network based on the first indication information, the first request message is used to request to allocate a bearer identifier for the session, the bearer identifier corresponds to a bearer context of the terminal device in the second network. The session management network element receives a first response message from the access and mobility management function network element, the first response message including the bearer identifier. The method may remove a restriction that a session established in a first network for a terminal device cannot be handed over to a second network when a user plane security policy in the first network requires that user plane integrity protection be activated.

Description

[Technical field]

[0001] The present application relates to the field of communications, and more particularly to a communication method and device. [Background technology]

[0002] The on-demand user plane security protection mechanism is a security mechanism in a 5th generation (5G) network, and the on-demand user plane security protection includes user plane encryption protection and user plane integrity protection. In the on-demand user plane security protection mechanism, an access network device in a 5G network needs to determine whether to activate user plane encryption protection and / or user plane integrity protection between the access network device and a user equipment (UE) according to a user plane security policy received from a core network device. The on-demand user plane security protection mechanism can provide a more flexible user plane security protection for the UE.

[0003] However, the existing 4th Generation (4G) network does not support an on-demand user plane security protection mechanism. In the 4G network, the user plane security between the access network device and the UE in the 4G network is fixed. Specifically, the user plane security is fixed means that the user plane encryption protection is activated and the user plane integrity protection is not activated.

[0004] 4G networks will not be rolled back in the short term. In this case, how to apply on-demand user plane security protection mechanisms to 4G networks has become a research hotspot in the industry.

[0005] When the on-demand user plane security protection mechanism is introduced into the 4G network, how to implement interworking between the 4G network and the 5G network is an issue that needs to be urgently solved in the current standard. Summary of the Invention

[0006] The present application provides a communication method for removing the restriction that a session established for a terminal device in a first network cannot be handed over to a second network if a user plane security policy in the first network requires that user plane integrity protection be activated.

[0007] According to a first aspect, a communication method is provided. The method may include: a session management network element obtains first indication information in a process of session establishment in a first network for a terminal device, the first indication information indicating that user plane integrity protection in a second network is supported; the session management network element sends a first request message to an access and mobility management function network element in the first network based on the first indication information, the first request message is used to request allocation of a bearer identifier for the session, the bearer identifier corresponds to a bearer context of the terminal device in the second network; the session management network element receives a first response message from the access and mobility management function network element, the first response message including the bearer identifier.

[0008] According to the above technical solution, the session management network element can remove the restriction that a session established for a terminal device in a first network cannot be handed over to a second network if a user plane security policy in the first network requires that user plane integrity protection is activated based on the first indication information. According to the existing solution, if a user plane security policy in the first network requires that user plane integrity protection is activated, the session management network element does not request a bearer identifier from the access and mobility management function network element. Therefore, the access and mobility management function network element does not locally store the corresponding bearer identifier. In this case, when subsequently receiving a handover requirement from an access network device in the first network, the access and mobility management function network element does not perform the related procedure of handing over the session established for the terminal device in the first network to the second network.

[0009] In a possible implementation, the session management network element sends a first request message to the access and mobility management function network element based on the first indication information without taking into account the user plane security policy in the first network.

[0010] The session management network element not considering the user plane security policy in the first network may be understood as the session management network element not considering the value of the user plane security policy in the first network. In other words, regardless of the value of the user plane security policy in the first network, the session management network element may send the first request message to the access and mobility management function network element based on the first indication information. For example, if the user plane security policy in the first network includes activating user plane integrity protection (in other words, the value of user plane integrity protection is required), the session management network element may send the first request message to the access and mobility management function network element based on the first indication information.

[0011] It should be understood that if the terminal device is not connected in a third generation partnership project and the session requested to be established for the terminal device does not support interworking with the second network based on the N26 interface, the session management network element does not send the first request message to the access and mobility management function network element. Therefore, the session management network element sending the first request message to the access and mobility management function network element based on the first indication information without considering the user plane security policy in the first network can be understood as the session management network element sending the first request message to the access and mobility management function network element based on the first indication information without considering the user plane security policy in the first network when the terminal device is connected in a third generation partnership project and the session requested to be established for the terminal device supports interworking with the second network based on the N26 interface.

[0012] For example, the first network is a 5th generation (5G) network and the second network is a 4th generation (4G) network. 4 G) network, the session of the terminal device in the first network is a protocol data unit (PDU) session, and the bearer context is an evolved packet system bearer context (EPS bearer context).

[0013] For example, a process for establishing a session in a first network for a terminal device teeth, after the terminal device sends a PDU session establishment request message and before the terminal device receives a PDU session establishment acceptance message.

[0014] Referring to the first aspect, in some implementations of the first aspect, the method further includes: a session management network element maps a user plane security policy of the terminal device in the first network to a user plane security policy of the terminal device in the second network; and the session management network element stores the user plane security policy in the second network in a bearer context.

[0015] Based on the above technical solution, the session management network element may map the user plane security policy of the terminal device in the first network to the user plane security policy of the terminal device in the second network, and store the user plane security policy of the terminal device in the second network in a bearer context. Furthermore, in a process in which the terminal device is handed over from the first network to the second network, the access and mobility management function network element in the first network obtains the bearer context from the session management network element, and further sends the obtained bearer context to the mobility management entity in the second network, so that the terminal device is handed over from the first network to the second network.

[0016] For example, the user plane security policy of a terminal device in a first network includes a user plane encryption protection policy and / or a user plane integrity protection policy, and the user plane security policy of a terminal device in a second network includes a user plane encryption protection policy and / or a user plane integrity protection policy.

[0017] For example, the user plane security policy in the first network is stored locally by the session management network element, or the user plane security policy in the first network is obtained by the session management network element from an integrated data management network element.

[0018] For example, the user plane security policy of the terminal device in the first network is at the granularity of a PDU session, and the user plane security policy of the terminal device in the first network is at the granularity of an evolved packet system bearer (EPS bearer).

[0019] The user plane security policy of the terminal device in the first network may alternatively be at the granularity of data network name (DNN) + single network slice selection assistance information (S-NSSAI).

[0020] The user plane security policy of the terminal device in the second network may alternatively be at the granularity of an evolved universal terrestrial radio access network radio access bearer (E-RAB) or access point name (APN).

[0021] Referring to the first aspect, in some implementations of the first aspect, the method further includes: the session management network element obtains third indication information, where the third indication information indicates performing user plane security policy mapping; the session management network element mapping the user plane security policy of the terminal device in the first network to the user plane security policy of the terminal device in the second network includes: the session management network element maps the user plane security policy of the terminal device in the first network to the user plane security policy of the terminal device in the second network based on the third indication information.

[0022] Based on the above technical solution, when receiving the third indication information, the session management network element maps the user plane security policy of the terminal device in the first network to the user plane security policy of the terminal device in the second network, so that the session management network element can be prevented from performing unnecessary mapping, and the processing logic of the session management network element is optimized. If the session management network element does not receive the third indication information, the session management network element directly maps the user plane security policy of the terminal device in the first network to the user plane security policy of the terminal device in the second network. If the second network does not support the activation of user plane integrity protection, the terminal device cannot be handed over from the first network to the second network, and the mapping performed by the session management network element is unnecessary mapping.

[0023] Referring to the first aspect, in some implementations of the first aspect, the method further includes: the session management network element sends the bearer context via an access and mobility management function network element to a target mobility management entity in a second network, the target mobility management entity being a network element serving the terminal device when the session is handed over to the second network.

[0024] Based on the above technical solution, the session management network element sends the user plane security policy of the terminal device in the second network to the target mobility management entity, so that in the process of the terminal device being handed over from the first network to the second network, the target mobility management entity performs user plane security activation of the terminal device in the second network according to the user plane security policy of the terminal device in the second network. status This helps the terminal device to be successfully handed over from the first network to the second network.

[0025] Referring to the first aspect, in some implementations of the first aspect, the method further includes: the session management network element sends a fully qualified domain name of the session management network element over an S5 / S8 interface to the integrated data management network element based on the first indication information, without considering a user plane security policy of the terminal device in the first network.

[0026] Based on the above technical solution, the session management network element sends a fully qualified domain name of the session management network element to the integrated data management network element on the S5 / S8 interface based on the first indication information, to eliminate the limitation that a session established for a terminal device in the first network cannot be handed over to a second network when a user plane security policy in the first network requires that user plane integrity protection is activated. According to the existing solution, when a user plane security policy in the first network requires that user plane integrity protection is activated, the session management network element does not send a fully qualified domain name of the session management network element to the integrated data management network element on the S5 / S8 interface. Therefore, a session established for a terminal device in the first network cannot be subsequently handed over to a second network.

[0027] The session management network element not taking into account the user plane security policy in the first network may be understood as the session management network element not taking into account the value of the user plane security policy in the first network. In other words, regardless of the value of the user plane security policy in the first network, the session management network element may send the fully qualified domain name over the S5 / S8 interface to the integrated data management network element based on the first indication information. For example, if the user plane security policy in the first network includes activating user plane integrity protection (in other words, the value of user plane integrity protection is required), the session management network element may send the fully qualified domain name over the S5 / S8 interface to the integrated data management network element based on the first indication information.

[0028] It should be understood that if the terminal device does not support interworking with the second network and / or if the session of the terminal device in the first network does not support interworking with the second network, the session management network element does not send the fully qualified domain name over the S5 / S8 interface to the integrated data management network element. Therefore, the session management network element sending the fully qualified domain name over the S5 / S8 interface to the integrated data management network element based on the first indication information without considering the user plane security policy in the first network can be understood as the session management network element sending the fully qualified domain name over the S5 / S8 interface to the integrated data management network element based on the first indication information without considering the user plane security policy in the first network if the terminal device supports interworking with the second network and the session of the terminal device in the first network supports interworking with the second network.

[0029] Referring to the first aspect, in some implementations of the first aspect, the session management network element obtaining the first indication information includes: the session management network element receives the first indication information from an access and mobility management function network element.

[0030] For example, the first indication information is included in a protocol data unit session management context establishment request message.

[0031] Referring to the first aspect, in some implementations of the first aspect, the session management network element obtaining the first indication information includes: the session management network element receives the first indication information from the terminal device via an access and mobility management function network element.

[0032] For example, the first indication information is included in a protocol data unit session establishment request message.

[0033] According to a second aspect, a communication method is provided. The method may include: an access and mobility management function network element in a first network receives a registration request message from a terminal device, the registration request message including second indication information, the second indication information indicating that the terminal device supports user plane integrity protection in the second network; in a process of session establishment in the first network for the terminal device, the access and mobility management function network element sends first indication information to a session management network element based on the second indication information, the first indication information indicating that the terminal device supports user plane integrity protection in the second network; Noyu The access and mobility management function network element receives a first request message, the first request message is used to request allocation of a bearer identifier for the session, the bearer identifier corresponds to a bearer context of the terminal device in the second network. The access and mobility management function network element sends a first response message to the session management network element, the first response message including the bearer identifier.

[0034] Based on the above technical solution, the access and mobility management function network element sends a first indication information to the session management network element, so that the session management network element can remove the restriction that a session established in the first network for a terminal device cannot be handed over to a second network when a user plane security policy in the first network requires that user plane integrity protection is activated based on the first indication information. According to the existing solution, when a user plane security policy in the first network requires that user plane integrity protection is activated, the session management network element does not request a bearer identifier from the access and mobility management function network element. Therefore, the access and mobility management function network element does not locally store the corresponding bearer identifier. In this case, when subsequently receiving a handover requirement from an access network device in the first network, the access and mobility management function network element does not perform a related procedure of handing over a session established in the first network for a terminal device to a second network.

[0035] For example, the first network is a fifth generation network, the second network is a fourth generation network, the session of the terminal device in the first network is a protocol data unit session, and the bearer context is an evolved packet system bearer context.

[0036] For example, a process for establishing a session in a first network for a terminal device teeth , after the terminal device sends a PDU session establishment request message and before the terminal device receives a PDU session establishment acceptance message.

[0037] Referring to the second aspect, in some implementations of the second aspect, the method further includes: the access and mobility management function network element sends a second request message to the session management function network element; the access and mobility management function network element receives a second response message from the session management network element, the second response message including a bearer context, the bearer context including a user plane security policy of the terminal device in the second network, and the user plane security policy in the second network is obtained according to the user plane security policy of the terminal device in the first network; the access and mobility management function network element sends the bearer context to a target mobility management entity in the second network, the target mobility management entity being a network element serving the terminal device when the session is handed over to the second network.

[0038] Based on the above technical solution, the access and mobility management function network element can obtain the user plane security policy of the terminal device in the second network from the session management network element, and send the user plane security policy of the terminal device in the second network to the target mobility management entity, so that in the process of handing over the terminal device from the first network to the second network, the problem of how the access and mobility management function network element obtains the user plane security policy of the terminal device in the second network is solved. This helps the terminal device to be successfully handed over from the first network to the second network.

[0039] For example, the user plane security policy of a terminal device in a first network includes a user plane encryption protection policy and / or a user plane integrity protection policy, and the user plane security policy of a terminal device in a second network includes a user plane encryption protection policy and / or a user plane integrity protection policy.

[0040] For example, the granularity of the user plane security policy in the first network is the granularity of a protocol data unit session, and the granularity of the user plane security policy in the second network is the granularity of an evolved packet system bearer.

[0041] The user plane security policy of the terminal device in the first network may alternatively be data network name + single network slice selection support information granularity.

[0042] The user plane security policy of the terminal device in the second network may alternatively be at the granularity of the Evolved Universal Terrestrial Radio Access Network radio access bearer or access point name.

[0043] For example, the second request message is a protocol data unit session context request message, and the second response message is a protocol data unit session context response message.

[0044] Referring to the second aspect, in an implementation of the second aspect, the second request message includes third indication information, the third indication information indicates performing user plane security policy mapping, and the method further includes: the access and mobility management function network element determines to add the third indication information to the second request message according to a second local policy, the second local policy includes one or more of whether the session supports interworking with the second network and whether the target mobility management entity supports user plane integrity protection, and the target mobility management entity is a network element serving the terminal device when the session is handed over to the second network.

[0045] Based on the above technical solution, the access and mobility management function network element sends third indication information to the session management network element, so that if the session management network element receives the third indication information, the session management network element maps the user plane security policy of the terminal device in the first network to the user plane security policy of the terminal device in the second network. This can prevent the session management network element from performing unnecessary mapping, and optimize the processing logic of the session management network element. If the session management network element does not receive the third indication information, the session management network element directly maps the user plane security policy of the terminal device in the first network to the user plane security policy of the terminal device in the second network. If the second network does not support the activation of user plane integrity protection, the terminal device cannot be handed over from the first network to the second network, and the mapping performed by the session management network element is unnecessary mapping.

[0046] Referring to the second aspect, in an implementation of the second aspect, the method further includes: the access and mobility management function network element determines to send first indication information to the session management network element according to a first local policy, and the first local policy includes whether the session supports interworking with a second network.

[0047] According to a third aspect, a communication method is provided. The method may include: a terminal device sends second indication information to an access and mobility management function network element in a first network, the second indication information indicating that the terminal device supports user plane integrity protection in the second network; and the terminal device receives a radio resource control reconfiguration sent by an access network device in the second network, the radio resource control reconfiguration including indication information for activating user plane integrity protection.

[0048] Based on the above technical solution, the terminal device sends second indication information to an access and mobility management function network element in the first network, so that the terminal device can be successfully handed over from the first network to the second network.

[0049] For example, the second indication information is included in the registration request message.

[0050] For example, the second indication information is included in a protocol data unit session establishment request message.

[0051] According to a fourth aspect, a communication method is provided. The method may include: a session management network element receives a second request message from an access and mobility management function network element in a first network; in response to the second request message, the session management network element sends a second response message to the access and mobility management function network element, the second response message including a bearer context, the bearer context including a user plane security policy of a terminal device in the second network, and the user plane security policy in the second network is obtained according to the user plane security policy of the terminal device in the first network.

[0052] Based on the above technical solution, the session management network element sends the user plane security policy of the terminal device in the second network to the access and mobility management function network element, so that in the process of handing over the terminal device from the first network to the second network, the problem of how the access and mobility management function network element obtains the user plane security policy of the terminal device in the second network is solved, which helps the terminal device to be successfully handed over from the first network to the second network.

[0053] For example, in a process in which a terminal device is handed over from a first network to a second network, the session management network element receives a second request message from an access and mobility management function network element in the first network, and sends a second response message to the access and mobility management function network element in response to the second request message.

[0054] For example, the first network is a fifth generation network, the second network is a fourth generation network, and the bearer context is an evolved packet system bearer context.

[0055] For example, the user plane security policy of a terminal device in a first network includes a user plane encryption protection policy and / or a user plane integrity protection policy, and the user plane security policy of a terminal device in a second network includes a user plane encryption protection policy and / or a user plane integrity protection policy.

[0056] For example, the user plane security policy of the terminal device in the first network is at the granularity of a protocol data unit session, and the user plane security policy of the terminal device in the first network is at the granularity of an evolved packet system bearer.

[0057] The user plane security policy of the terminal device in the first network may alternatively be data network name + single network slice selection support information granularity.

[0058] The user plane security policy of the terminal device in the second network may alternatively be at the granularity of the Evolved Universal Terrestrial Radio Access Network radio access bearer or access point name.

[0059] For example, the second request message is a protocol data unit session context request message, and the second response message is a protocol data unit session context response message.

[0060] Referring to the fourth aspect, in some implementations of the fourth aspect, the method further includes: the session management network element maps a user plane security policy in the first network to a user plane security policy in the second network; the session management network element stores the user plane security policy in the second network in a bearer context.

[0061] Based on the above technical solution, the session management network element may map the user plane security policy of the terminal device in the first network to the user plane security policy of the terminal device in the second network, and store the user plane security policy of the terminal device in the second network in a bearer context. Furthermore, in a process in which the terminal device is handed over from the first network to the second network, the access and mobility management function network element in the first network obtains the bearer context from the session management network element, and further sends the obtained bearer context to the mobility management entity in the second network, so that the terminal device is handed over from the first network to the second network.

[0062] Referring to the fourth aspect, in some implementations of the fourth aspect, the method further includes: a session management network element obtains first indication information, and the first indication information is a second indication information for a session management network element in a second network; Noyu The session management network element mapping a user plane security policy in the first network to a user plane security policy in the second network includes: if receiving the first indication information, the session management network element maps a user plane security policy in the first network to a user plane security policy in the second network.

[0063] Based on the above technical solution, when receiving the first indication information, the session management network element may directly map the user plane security policy of the terminal device in the first network to the user plane security policy of the terminal device in the second network without considering the user plane security policy in the first network, so that the processing logic of the session management network element is optimized. If the session management network element does not receive the first indication information, before performing the mapping, optionally, the session management network element needs to first determine whether the user plane security policy in the first network requires the activation of user plane integrity protection, and if the user plane integrity protection is not required to be activated, maps the user plane security policy of the terminal device in the first network to the user plane security policy of the terminal device in the second network.

[0064] For example, the user plane security policy in the first network is stored locally by the session management network element, or the user plane security policy in the first network is obtained by the session management network element from an integrated data management network element.

[0065] Referring to the fourth aspect, in some implementations of the fourth aspect, the method further includes: a session management network element obtains first indication information, and the first indication information is a second indication information for a session management network element in a second network; Noyu The first indication information indicates that the first plane integrity protection is supported. The session management network element requests a bearer identifier from the access and mobility management function network element based on the first indication information, and the bearer identifier corresponds to a bearer context.

[0066] For example, the session management network element obtains the first indication information in a process of establishing a session in the first network for the terminal device. teeth , after the terminal device sends a PDU session establishment request message and before the terminal device receives a PDU session establishment acceptance message.

[0067] In a possible implementation, the session management network element sends a first request message to the access and mobility management function network element based on the first indication information without taking into account the user plane security policy in the first network.

[0068] The session management network element not considering the user plane security policy in the first network may be understood as the session management network element not considering the value of the user plane security policy in the first network. In other words, regardless of the value of the user plane security policy in the first network, the session management network element may send the first request message to the access and mobility management function network element based on the first indication information. For example, if the user plane security policy in the first network includes activating user plane integrity protection (in other words, the value of user plane integrity protection is required), the session management network element may send the first request message to the access and mobility management function network element based on the first indication information.

[0069] It should be understood that if the terminal device is not connected in a third generation partnership project and the session requested to be established for the terminal device does not support interworking with the second network based on the N26 interface, the session management network element does not send the first request message to the access and mobility management function network element. Therefore, the session management network element sending the first request message to the access and mobility management function network element based on the first indication information without considering the user plane security policy in the first network can be understood as the session management network element sending the first request message to the access and mobility management function network element based on the first indication information without considering the user plane security policy in the first network when the terminal device is connected in a third generation partnership project and the session requested to be established for the terminal device supports interworking with the second network based on the N26 interface.

[0070] According to the above technical solution, the session management network element can remove the restriction that a session established for a terminal device in a first network cannot be handed over to a second network if a user plane security policy in the first network requires that user plane integrity protection is activated based on the first indication information. According to the existing solution, if a user plane security policy in the first network requires that user plane integrity protection is activated, the session management network element does not request a bearer identifier from the access and mobility management function network element. Therefore, the access and mobility management function network element does not locally store the corresponding bearer identifier. In this case, when subsequently receiving a handover requirement from an access network device in the first network, the access and mobility management function network element does not perform the related procedure of handing over the session established for the terminal device in the first network to the second network.

[0071] Referring to the fourth aspect, in some implementations of the fourth aspect, the method further includes: the session management network element sends a fully qualified domain name of the session management network element over an S5 / S8 interface to the integrated data management network element based on the first indication information, without considering a user plane security policy of the terminal device in the first network.

[0072] Based on the above technical solution, the session management network element sends a fully qualified domain name of the session management network element to the integrated data management network element on the S5 / S8 interface based on the first indication information, to eliminate the limitation that a session established for a terminal device in the first network cannot be handed over to a second network when a user plane security policy in the first network requires that user plane integrity protection is activated. According to the existing solution, when a user plane security policy in the first network requires that user plane integrity protection is activated, the session management network element does not send a fully qualified domain name of the session management network element to the integrated data management network element on the S5 / S8 interface. Therefore, a session established for a terminal device in the first network cannot be subsequently handed over to a second network.

[0073] The session management network element not taking into account the user plane security policy in the first network may be understood as the session management network element not taking into account the value of the user plane security policy in the first network. In other words, regardless of the value of the user plane security policy in the first network, the session management network element may send the fully qualified domain name over the S5 / S8 interface to the integrated data management network element based on the first indication information. For example, if the user plane security policy in the first network includes activating user plane integrity protection (in other words, the value of user plane integrity protection is required), the session management network element may send the fully qualified domain name over the S5 / S8 interface to the integrated data management network element based on the first indication information.

[0074] It should be understood that if the terminal device does not support interworking with the second network and / or if the session of the terminal device in the first network does not support interworking with the second network, the session management network element does not send the fully qualified domain name over the S5 / S8 interface to the integrated data management network element. Therefore, the session management network element sending the fully qualified domain name over the S5 / S8 interface to the integrated data management network element based on the first indication information without considering the user plane security policy in the first network can be understood as the session management network element sending the fully qualified domain name over the S5 / S8 interface to the integrated data management network element based on the first indication information without considering the user plane security policy in the first network if the terminal device supports interworking with the second network and the session of the terminal device in the first network supports interworking with the second network.

[0075] Referring to the fourth aspect, in some implementations of the fourth aspect, the session management network element obtaining the first indication information includes: the session management network element receives the first indication information from an access and mobility management function network element.

[0076] For example, the first indication information is included in a protocol data unit session management context establishment request message.

[0077] Referring to the fourth aspect, in some implementations of the fourth aspect, the session management network element obtaining the first indication information includes: the session management network element receives the first indication information from the terminal device via an access and mobility management function network element.

[0078] For example, the first indication information is included in a protocol data unit session establishment request message.

[0079] According to a fifth aspect, a communication method is provided. The method may include: an access and mobility management function network element in a first network sends a second request message to a session management network element; the access and mobility management function network element receives a second response message from the session management network element, the second response message including a bearer context, the bearer context including a user plane security policy of a terminal device in the second network, the user plane security policy in the second network being obtained according to the user plane security policy of the terminal device in the first network; and the access and mobility management function network element sends the bearer context to a target mobility management entity serving the terminal device in the second network.

[0080] Based on the above technical solution, the access and mobility management function network element can obtain the user plane security policy of the terminal device in the second network from the session management network element, and send the user plane security policy of the terminal device in the second network to the target mobility management entity, so that in the process of handing over the terminal device from the first network to the second network, the problem of how the access and mobility management function network element obtains the user plane security policy of the terminal device in the second network is solved. This helps the terminal device to be successfully handed over from the first network to the second network.

[0081] For example, the user plane security policy of a terminal device in a first network includes a user plane encryption protection policy and / or a user plane integrity protection policy, and the user plane security policy of a terminal device in a second network includes a user plane encryption protection policy and / or a user plane integrity protection policy.

[0082] For example, the granularity of the user plane security policy in the first network is the granularity of a protocol data unit session, and the granularity of the user plane security policy in the second network is the granularity of an evolved packet system bearer.

[0083] The user plane security policy of the terminal device in the first network may alternatively be data network name + single network slice selection support information granularity.

[0084] The user plane security policy of the terminal device in the second network may alternatively be at the granularity of the Evolved Universal Terrestrial Radio Access Network radio access bearer or access point name.

[0085] For example, the second request message is a protocol data unit session context request message, and the second response message is a protocol data unit session context response message.

[0086] Referring to the fifth aspect, in some implementations of the fifth aspect, the method further includes: the access and mobility management function network element receives second indication information from the terminal device, the second indication information indicating that the terminal device supports user plane integrity protection in the second network; the access and mobility management function network element sends first indication information to a session management network element based on the second indication information, the first indication information indicating that the terminal device supports user plane integrity protection in the second network; Noyu This indicates that user-plane integrity protection is supported.

[0087] For example, the second indication information is included in a registration request message, and the first indication information is included in a protocol data unit session management context establishment request message.

[0088] Referring to the fifth aspect, in some implementations of the fifth aspect, the method further includes: the access and mobility management function network element determines whether to send first indication information to the session management network element according to a first local policy, the first local policy including whether a session of the terminal device in the first network supports interworking with a second network.

[0089] According to a sixth aspect, there is provided a communication device, comprising a unit configured to perform steps in a method according to the first aspect or any one of the implementations of the first aspect.

[0090] According to a seventh aspect, there is provided a communication device, comprising a unit configured to perform steps in a method according to the second aspect or any one of the implementations of the second aspect.

[0091] According to an eighth aspect, there is provided a communication device, comprising a unit configured to perform steps in a method according to the third aspect or any one of the implementations of the third aspect.

[0092] According to a ninth aspect, a communication apparatus is provided. The communication apparatus may include a transceiver unit, the transceiver unit is configured to receive a second request message from an access and mobility management function network element in a first network. The transceiver unit is further configured to send a second response message to the access and mobility management function network element in response to the second request message, the second response message including a bearer context, the bearer context including a user plane security policy of a terminal device in the second network, and the user plane security policy in the second network is obtained according to the user plane security policy of the terminal device in the first network.

[0093] For example, in a process in which a terminal device is handed over from a first network to a second network, the transceiver unit is configured to receive a second request message from an access and mobility management function network element in the first network, and send a second response message to the access and mobility management function network element in response to the second request message.

[0094] For example, the first network is a fifth generation network, the second network is a fourth generation network, and the bearer context is an evolved packet system bearer context.

[0095] For example, the user plane security policy of a terminal device in a first network includes a user plane encryption protection policy and / or a user plane integrity protection policy, and the user plane security policy of a terminal device in a second network includes a user plane encryption protection policy and / or a user plane integrity protection policy.

[0096] For example, the user plane security policy of the terminal device in the first network is at the granularity of a protocol data unit session, and the user plane security policy of the terminal device in the first network is at the granularity of an evolved packet system bearer.

[0097] The user plane security policy of the terminal device in the first network may alternatively be data network name + single network slice selection support information granularity.

[0098] The user plane security policy of the terminal device in the second network may alternatively be at the granularity of the Evolved Universal Terrestrial Radio Access Network radio access bearer or access point name.

[0099] For example, the second request message is a protocol data unit session context request message, and the second response message is a protocol data unit session context response message.

[0100] Referring to the ninth aspect, in some implementations of the ninth aspect, the communication device further includes a processing unit configured to map a user plane security policy in the first network to a user plane security policy in the second network, and the processing unit is further configured to store the user plane security policy in the second network in a bearer context.

[0101] Referring to the ninth aspect, in some implementations of the ninth aspect, the transceiver unit is further configured to obtain first indication information, the first indication information being in the second network. Noyu The processing unit is specifically configured, when receiving the first indication information, to map a user plane security policy in the first network to a user plane security policy in the second network.

[0102] For example, the user plane security policy in the first network is stored locally by the session management network element, or the user plane security policy in the first network is obtained by the session management network element from an integrated data management network element.

[0103] Referring to the ninth aspect, in some implementations of the ninth aspect, the transceiver unit is further configured to obtain first indication information, the first indication information being in the second network. Noyu The transceiver unit is further configured to request a bearer identifier from the access and mobility management function network element based on the first indication information, the bearer identifier corresponding to the bearer context.

[0104] For example, the transceiver unit is configured to obtain the first indication information in a process of session establishment in the first network for the terminal device, for example, in a process of session establishment in the first network for the terminal device, including after the terminal device sends a PDU session establishment request message and before the terminal device receives a PDU session establishment accept message.

[0105] In a possible implementation, the transceiver unit is configured to send a first request message to the access and mobility management function network element based on the first indication information without taking into account a user plane security policy in the first network.

[0106] Referring to the ninth aspect, in some implementations of the ninth aspect, the transceiver unit is further configured to send a fully qualified domain name of the session management network element over the S5 / S8 interface to the integrated data management network element based on the first indication information, without taking into account a user plane security policy of the terminal device in the first network.

[0107] Referring to the ninth aspect, in some implementations of the ninth aspect, the session management network element obtaining the first indication information includes: the session management network element receives the first indication information from an access and mobility management function network element.

[0108] For example, the first indication information is included in a protocol data unit session management context establishment request message.

[0109] Referring to the ninth aspect, in some implementations of the ninth aspect, the session management network element obtaining the first indication information includes: the session management network element receives the first indication information from the terminal device via an access and mobility management function network element.

[0110] For example, the first indication information is included in a protocol data unit session establishment request message.

[0111] According to a tenth aspect, a communication apparatus is provided. The communication apparatus may include a transceiver unit, the transceiver unit configured to send a second request message to a session management network element. The transceiver unit is further configured to receive a second response message from the session management network element, the second response message including a bearer context, the bearer context including a user plane security policy of a terminal device in the second network, the user plane security policy in the second network being obtained according to the user plane security policy of the terminal device in the first network. The transceiver unit is further configured to send the bearer context to a target mobility management entity serving the terminal device in the second network.

[0112] For example, the user plane security policy of a terminal device in a first network includes a user plane encryption protection policy and / or a user plane integrity protection policy, and the user plane security policy of a terminal device in a second network includes a user plane encryption protection policy and / or a user plane integrity protection policy.

[0113] For example, the granularity of the user plane security policy in the first network is the granularity of a protocol data unit session, and the granularity of the user plane security policy in the second network is the granularity of an evolved packet system bearer.

[0114] The user plane security policy of the terminal device in the first network may alternatively be data network name + single network slice selection support information granularity.

[0115] The user plane security policy of the terminal device in the second network may alternatively be at the granularity of the Evolved Universal Terrestrial Radio Access Network radio access bearer or access point name.

[0116] For example, the second request message is a protocol data unit session context request message, and the second response message is a protocol data unit session context response message.

[0117] Referring to the tenth aspect, in some implementation examples of the tenth aspect, the transceiver unit is further configured to receive second indication information from the terminal device, the second indication information indicating that the terminal device supports user plane integrity protection in the second network. The transceiver unit is further configured to send first indication information to a session management network element based on the second indication information, the first indication information indicating that the terminal device supports user plane integrity protection in the second network. Noyu This indicates that user-plane integrity protection is supported.

[0118] For example, the second indication information is included in a registration request message, and the first indication information is included in a protocol data unit session management context establishment request message.

[0119] Referring to the tenth aspect, in some implementations of the tenth aspect, the communication device further includes a processing unit, wherein the processing unit is configured to determine whether to send first indication information to the session management network element in accordance with a first local policy, the first local policy including whether a session of the terminal device in the first network supports interworking with a second network.

[0120] According to an eleventh aspect, the present application provides a communication device including a processor. The processor is coupled to a memory and may be configured to execute instructions in the memory to implement the method in the first aspect or any one of the possible implementations of the first aspect, or to implement the method in the fourth aspect or any one of the possible implementations of the fourth aspect. The communication device further includes the memory. The communication device further includes a communication interface. The processor is coupled to the communication interface.

[0121] In one implementation, the communication device is a session management network element. When the communication device is a session management network element, the communication interface may be a transceiver or an input / output interface.

[0122] In another implementation, the communication device is a chip or chip system configured in a session management network element. When the communication device is a chip or chip system configured in a session management network element, the communication interface may be an input / output interface.

[0123] The transceiver may be a transceiver circuit. The input / output interface may be an input / output circuit.

[0124] According to a twelfth aspect, the present application provides a communication device including a processor. The processor may be coupled to a memory and configured to execute instructions in the memory to implement the method of the second aspect or any one of the possible implementations of the second aspect, or to implement the method of the fifth aspect or any one of the possible implementations of the fifth aspect. The communication device further includes the memory. The communication device further includes a communication interface. The processor is coupled to the communication interface.

[0125] In one implementation, the communication device is an access and mobility management function network element. When the communication device is an access and mobility management function network element, the communication interface may be a transceiver or an input / output interface.

[0126] In another implementation, the communication device is a chip or chip system configured in an access and mobility management function network element. When the communication device is a chip or chip system configured in an access and mobility management function network element, the communication interface may be an input / output interface.

[0127] The transceiver may be a transceiver circuit. The input / output interface may be an input / output circuit.

[0128] According to a thirteenth aspect, the present application provides a communication device including a processor. The processor may be coupled to a memory and configured to execute instructions in the memory to implement the method in any one of the third aspect and possible implementations of the third aspect. The communication device further includes the memory. The communication device further includes a communication interface. The processor is coupled to the communication interface.

[0129] In one implementation, the communication device is a terminal device. When the communication device is a terminal device, the communication interface may be a transceiver or an input / output interface.

[0130] In another implementation, the communication device is a chip or chip system configured in a terminal device. When the communication device is a chip or chip system configured in a terminal device, the communication interface may be an input / output interface.

[0131] The transceiver may be a transceiver circuit. The input / output interface may be an input / output circuit.

[0132] According to a fourteenth aspect, the present application provides a processor including an input circuit, an output circuit, and a processing circuit configured to receive a signal via the input circuit and to transmit a signal via the output circuit such that the processor performs a method in the aforementioned aspect.

[0133] During a particular implementation, the processor may be a chip, the input circuit may be an input pin, the output circuit may be an output pin, the processing circuit may be a transistor, a gate circuit, a trigger, any logic circuit, etc. The input signal received by the input circuit may be received and input, for example, but not limited to, by using a receiver, and the signal output by the output circuit may be output, for example, but not limited to, to a transmitter and transmitted by the transmitter, and the input circuit and the output circuit may be the same circuit, which is used as the input circuit and the output circuit at different moments. The particular implementation of the processor and various circuits is not limited in this embodiment of the present application.

[0134] According to a fifteenth aspect, the present application provides a processing device including a communication interface and a processor. The communication interface is coupled to the processor. The communication interface is configured to input and / or output information. The information includes at least one of instructions or data. The processor executes a computer program such that the processing device is configured to perform the method in the aforementioned aspect.

[0135] According to a sixteenth aspect, the present application provides a processing device including a processor and a memory, the processor being configured to read instructions stored in the memory, receive a signal by using the receiver, and transmit a signal by using the transmitter, such that the processing device performs a method in the aforementioned aspect.

[0136] Optionally, there are one or more processors. Where there is a memory, there may alternatively be one or more memories.

[0137] Optionally, the memory may be integrated into the processor, or the memory and the processor are separately located.

[0138] During a particular implementation, the memory may be a non-transitory memory, such as a read-only memory (ROM). The memory and the processor may be integrated into one chip, or may be separately arranged on different chips. The type of memory and the manner of arranging the memory and the processor are not limited in this embodiment of the present application.

[0139] It should be understood that in the related information exchange process, for example, sending the indication information may be a process of outputting the indication information from a processor, and receiving the indication information may be a process of inputting the received indication information to a processor. Specifically, the information output by the processor may be output to a transmitter, and the input information received by the processor may be from a receiver. The transmitter and receiver may be collectively referred to as a transceiver.

[0140] The device in the fifteenth and sixteenth aspects may be a chip, and the processor may be implemented by hardware or software. When the processor is implemented by hardware, the processor may be a logic circuit, an integrated circuit, etc. When the processor is implemented by software, the processor may be a general-purpose processor, and is implemented by reading software code stored in a memory. The memory may be integrated in the processor, or may be located outside the processor and exist independently.

[0141] According to a seventeenth aspect, the present application provides a computer program product. The computer program product includes a computer program (also referred to as code or instructions). When the computer program is executed, the computer is enabled to perform the method in the aforementioned aspect.

[0142] According to an eighteenth aspect, the present application provides a computer readable medium. The computer readable medium stores a computer program (also referred to as code or instructions). When the computer program is executed on a computer, the computer is enabled to perform the method in the aforementioned aspect.

[0143] According to a nineteenth aspect, the present application provides a communication system including the above-mentioned session management network element, a terminal device, and an access and mobility management function network element. [Brief description of the drawings]

[0144] [Figure 1] FIG. 1 is a schematic diagram of a network architecture to which an embodiment of the present application can be applied. [Diagram 2] 1 is a schematic flowchart of a communication method according to an embodiment of the present application. [Diagram 3] 4 is a schematic flowchart of a communication method according to another embodiment of the present application. [Figure 4] 4 is a schematic flowchart of a communication method according to another embodiment of the present application. [Diagram 5] 4 is a schematic flowchart of a communication method according to another embodiment of the present application. [Figure 6] 4 is a schematic flowchart of a communication method according to another embodiment of the present application. [Figure 7(a)] 4 is a schematic flowchart of a communication method according to another embodiment of the present application. [Figure 7(b)] 4 is a schematic flowchart of a communication method according to another embodiment of the present application. [Figure 8]1 is a schematic block diagram of a communication device according to an embodiment of the present application; [Figure 9] 1 is a schematic block diagram of a communication device according to an embodiment of the present application; DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0145] The following describes the technical solutions of the present application with reference to the accompanying drawings.

[0146] The technical solutions in the embodiments of the present application may be applied to various communication systems, such as long term evolution (LTE) systems, LTE frequency division duplex (FDD) systems, LTE time division duplex (TDD) systems, universal mobile telecommunications system (UMTS), worldwide interoperability for microwave access (WiMAX) communication systems, 5th generation (5G) systems, new radio (NR) systems, or future networks. The 5G mobile communication systems described in the present application include non-standalone (NSA) 5G mobile communication systems or standalone (SA) 5G mobile communication systems. The technical solutions provided in the present application may further be applied to future communication systems, such as 6th generation mobile communication systems. Alternatively, the communication system may be a public land mobile network (PLMN), a device-to-device (D2D) communication system, a machine-to-machine (M2M) communication system, an internet of things (IoT) communication system, or another communication system.

[0147] 1 shows a network architecture to which the embodiments of the present application are applicable. Specifically, the system architecture 100 may include a network element in a 4G network and a network element in a 5G network. Some modules in the system architecture 100 have functions of network elements in a 4G network and functions of network elements in a 5G network, such as a user plane function (UPF)+packet data network gateway for user plane (PGW-U) function entity, a session management function (SMF)+packet data network gateway control plane function (PGW-C) entity, a policy control function (PCF)+policy and charging rules function (PCRF) entity, and a home subscriber server (HSS)+unified data management (UDM) entity.

[0148] The UPF+PGW-U entity is used for user data transmission management. In the interworking system architecture, the module can not only be used for 4G data transmission, but also provides 5G data transmission functions.

[0149] The SMF+PGW-C entity is used for session establishment, deletion and modification management. In the interworking system architecture, the module can provide both 4G session management functions and 5G session management functions.

[0150] The PCF+PCRF entity is used for policy and charging control. In the interworking system architecture, the module can provide both 4G policy and charging control and 5G policy and charging control to the terminal.

[0151] The HSS+UDM entity is configured to store the subscription data of the user. In the interworking system architecture, the module stores both the 4G subscription information and the 5G subscription information of the terminal.

[0152] It should be understood that "+" indicates an integrated configuration. UPF is a user plane function in a 5G network, PGW-U is a gateway user plane function in a 4G network corresponding to UPF, SMF is a session management function in a 5G network, PGW-C is a gateway control plane function in a 4G network and corresponding to SMF, PCF is a policy control function in a 5G network, and PCRF is a policy and charging rule function in a 4G network and corresponding to PCF. "Integrated configuration" in this specification means that the same network element may have the functions of two network function entities.

[0153] In the embodiment of the present application, for the sake of simplicity, the HSS+UDM entity is referred to as a subscriber data management network element, the SMF+PGW-C is referred to as a session management network element, and the UPF+PGW-U is referred to as a user plane function network element. This is described once in this specification, and the details will not be described again below. Of course, the aforementioned network devices obtained through the integrated configuration may use other names. This is not particularly limited in the embodiment of the present application.

[0154] The system architecture 100 may also include a mobility management entity (MME) and a serving gateway (SGW) in the 4G network, and an access and mobility management function (AMF) entity in the 5G network.

[0155] The MME is used for user mobility management. For example, mobility management mainly includes user attachment management, accessibility management, mobility management, paging management, access authentication and authorization, non-access stratum signaling ciphering and integrity protection, etc.

[0156] The SGW is a user plane gateway and a user plane termination point of the evolved universal terrestrial radio access network (E-UTRAN). The SGW manages data packet routing and transmission, adds transport layer packet tags, etc.

[0157] The AMF entity is mainly used for user access and mobility management, including user registration management, accessibility management, mobility management, paging management, access authentication and authorization, non-access stratum signaling encryption and integrity protection, etc.

[0158] The terminal accesses the 4G network through the E-UTRAN, and the terminal accesses the 5G network through a next generation radio access network (NG-RAN) device.

[0159] The NG-RAN device is configured to provide a wireless air interface for terminals to access the core network to obtain corresponding services.

[0160] The E-UTRAN is configured to perform radio resource management for terminals, establish, modify or delete air interface resources, provide data and signaling transmissions for terminals, and so on.

[0161] The following describes the communication interfaces between the aforementioned modules in the system architecture 100.

[0162] The S1-MME interface is the control plane interface between the MME and the E-UTRAN.

[0163] The S1-U interface is the user plane interface between the SGW and the E-UTRAN.

[0164] The S5-U interface is a user plane interface between the SGW and the PGW-U and is configured to transmit user plane data of the terminal.

[0165] The S5-C interface is a control plane management interface between the SGW and the PGW-U, and is configured to establish a user plane connection between the SGW and the PGW-U for a terminal.

[0166] The S6a interface is an interface between the MME and the HSS, and is configured to obtain user subscription data and perform authentication and authorization functions for terminals.

[0167] The S11 interface is an interface between the SGW and the MME and is configured to establish a user plane bearer.

[0168] The N1 interface is an interface between the terminal and the AMF and is used for non-access stratum signaling management and transmission.

[0169] The N2 interface is an interface between the NG-RAN and the AMF and is used for signaling transmission.

[0170] The N3 interface is an interface between the UPF and the NG-RAN and is configured to transmit user data.

[0171] The N4 interface is an interface between the SMF and the UPF and is configured to establish a user plane transmission channel.

[0172] The N7 interface is an interface between the SMF and the PCF and is configured to organize and distribute policy control and charging information.

[0173] The N8 interface is an interface between the AMF and the UDM, and is configured to obtain user mobility-related subscription information, etc.

[0174] The N10 interface is an interface between the SMF and the UDM, and is configured to obtain user session management related subscription information, etc.

[0175] The N11 interface is an interface between the SMF and AMF and is used for transmitting session management information, etc.

[0176] The N15 interface is an interface between the AMF and the PCF and is configured to obtain access and mobility related policy information.

[0177] It should be understood that in the system architecture 100, a first interface is introduced to support interworking between a 4G network and a 5G network. The first interface is a communication interface between an AMF in a 5G network and an MME in a 4G network, and may be represented by an N26 interface. The system architecture optionally supports the N26 interface. The handover procedure may be used only in an interworking system architecture that supports the N26 interface to ensure service continuity.

[0178] It should be noted that the names of the interfaces between modules in the system architecture 100 are merely examples, and the interfaces may have other names in a specific implementation, which is not particularly limited in the embodiments of the present application.

[0179] It should be further noted that in the system architecture 100, the NG-RAN devices in the 5G network may be referred to as access devices. An access device is a device that accesses the core network, such as a base station, a broadband network service gateway, etc. service The base station may be a base station, a gateway (BNG), an aggregation switch, or a non-3rd generation partnership project (3GPP) access device. The base station may be in various forms, for example, a macro base station, a micro base station (also called a small cell), a relay station, or an access point. This is not limited in the embodiments of the present application.

[0180] Of course, in the system architecture 100, other modules may be further included in the 4G network and the 5G network. For example, a serving general packet radio system (GPRS) support node (SGSN) module, etc. may be further included in the 4G network, and an authentication server function (AUSF) module, a network slice selection function (NSSF) module, etc. may be included in the 5G network. This is not limited in the embodiment of the present application.

[0181] The terminal in the embodiment of the present application may include various handheld devices, in-vehicle devices, wearable devices, and computing devices or other processing devices connected to a wireless modem having wireless communication capabilities, and may further include a subscriber unit, a cellular phone, a smartphone, a wireless data card, a personal digital assistant (PDA) computer, a tablet computer, a wireless modem, a handheld device, a laptop computer, a cordless phone or a wireless local loop (WLL) station, a machine type communication (MTC) terminal, a user equipment (UE), a mobile station (MS), a terminal device, etc. For ease of explanation, all the aforementioned devices are collectively referred to as a terminal device in the embodiment of the present application.

[0182] It should be understood that as the terminal device moves continuously, the location change of the terminal device may cause the terminal device to be handed over between different networks. For example, when moving from a 4G network to a 5G network, the terminal device needs to be handed over from an evolved packet system (EPS) bearer in the 4G network to a protocol data unit (PDU) session in the 5G network, or when moving from a 5G network to a 4G network, the terminal device needs to be handed over from a PDU session in the 5G network to an EPS bearer in the 4G network.

[0183] At present, the security mechanism used in 5G networks is an on-demand user plane security protection mechanism, where the on-demand user plane security protection includes user plane encryption protection and user plane integrity protection. In the on-demand user plane security protection mechanism, the access network device needs to determine whether to activate user plane encryption protection and / or user plane integrity protection between the access network device and the terminal device according to a user plane security policy received from the core network device. However, the existing 4G network does not support the on-demand user plane security protection mechanism. In the 4G network, the method for protecting user plane security between the access network device and the terminal device is fixed. Specifically, the user plane security being fixed means that the user plane encryption protection is activated and the user plane integrity protection is not activated.

[0184] Therefore, if a user plane security policy corresponding to a PDU session in a 5G network requires that user plane integrity protection be activated, the PDU session cannot be handed over to an EPS bearer in a 4G network, because an access network device in the 4G network cannot activate user plane integrity protection for a terminal device.

[0185] Currently, the session management network element determines whether to request an EPS bearer identifier from the AMF for the PDU session requested to be established based on the following factors: (1) the access type is 3GPP access or non-3GPP access, (2) whether the user plane integrity protection policy of the session requested to be established in the first network is necessarily set to be activated, and (3) the session requested to be established in the first network supports interworking with the second network based on the N26 interface or supports interworking with the second network not based on the N26 interface. If the access type is 3GPP access, the user plane integrity protection policy of the session requested to be established in the first network is not necessarily set to be activated, and the session requested to be established in the first network supports interworking with the second network based on the N26 interface, the session management network element requests an EPS bearer identifier from the AMF for the PDU session requested to be established.

[0186] Currently, the session management network element determines whether to send a fully qualified domain name (FQDN) of the session management network element over the S5 / S8 interface to the integrated data management network element based on the following factors: (1) whether the terminal device supports interworking with the second network, (2) whether the user plane integrity protection policy of the session requested to be established in the first network is necessarily set to be activated, and (3) whether the session requested to be established in the first network supports interworking with the second network. If the terminal device supports interworking with the second network, the user plane integrity protection policy of the session requested to be established in the first network is not necessarily set to be activated, and the session requested to be established in the first network supports interworking with the second network, the session management network element sends the FQDN of the session management network element over the S5 / S8 interface to the integrated data management network element; otherwise, it does not send the FQDN of the session management network element over the S5 / S8 interface.

[0187] Based on this, in the process of preparing an EPS bearer context in a 5G network, if the user plane security policy corresponding to the PDU session includes activating user plane integrity, the session management network element does not request an EPS bearer identifier (EBI) for the EPS bearer context from the AMF, and the session management network element does not send the fully qualified domain name of the session management network element over the S5 / S8 interface to the UDM. Furthermore, the PDU session cannot be handed over to the EPS bearer.

[0188] 4G networks will not fall back in the short term. In this case, if 4G networks also support user plane integrity protection, how to remove the limitation that 5G networks cannot interwork with EPS when 5G networks have the requirement to forcefully activate user plane integrity protection becomes an urgent problem to be solved.

[0189] Also, in the process of handing over a PDU session in a 5G network to an EPS bearer in a 4G network, it has been proposed that a forward relocation request message sent by the AMF to a target MME may carry the user plane security policy of a terminal device in a 4G network, but how the AMF obtains the user plane security policy of a terminal device in a 4G network is not resolved. This is because the user plane security policy of a terminal device in a 5G network is at the granularity of a PDU session, but the user plane security policy of a terminal device in a 4G network is at the granularity of an E-UTRAN radio access bearer (E-RAB).

[0190] In view of this, the present application provides a communication method to remove the limitation that a 5G network cannot interwork with an EPS when the 5G network has a requirement to forcibly activate user plane integrity protection.

[0191] It should be understood that the specific structure of the implementation entity of the method provided in the embodiment of the present application is not particularly limited in the following embodiments, as long as the program recording the code for the method in the embodiment of the present application can be executed to perform communication according to the method provided in the embodiment of the present application. For example, the method provided in the embodiment of the present application can be performed by a terminal device, a core network device, or a functional module that is in a terminal device or a core network device and can call and execute a program.

[0192] It should be further noted that in the following embodiment, the session management network element is a network element in a first network and a network element in a second network. Specifically, the session management network element may communicate with a network element in another first network in the first network, or may communicate with a network element in another second network in the second network. The access and mobility management function network element is a network element in the first network, and the mobility management function entity is a network element in the second network. In the process in which the terminal device is handed over from the first network to the second network, the access and mobility management function network element in the first network may communicate with a target mobility management function entity in the second network.

[0193] The first network may be a 5G network and the second network may be a 4G network, or the first network may be a 4G network and the second network may be a 5G network.

[0194] 2 is a schematic flowchart of a communication method according to an embodiment of the present application. As shown in FIG. 2, the method 200 may include S210 to S240. The following describes the steps in detail.

[0195] S210: A session management network element obtains first indication information.

[0196] Specifically, in a process of establishing a session in the first network for a terminal device, a session management network element obtains first indication information. The process of establishing a session in the first network for a terminal device includes a process of the terminal device completing a session establishment with the network after the terminal device sends a session establishment request message. For example, the session is a protocol data unit (PDU) session, and the process of establishing a PDU session includes a process of the terminal device completing a PDU session establishment after the terminal device sends a PDU session establishment request message. For example, for the process of establishing a PDU session, please refer to the relevant contents in section 4.3.2 in 3GPP technical specification (TS) 23.502.

[0197] The first indication information indicates that user plane integrity protection in the second network is supported. Alternatively, the first indication information indicates that user plane integrity protection with an access network device in the second network is supported. Alternatively, the first indication information indicates that on-demand user plane protection with an access network device in the second network is supported. The on-demand user plane protection may cause the access network device in the second network to determine whether to activate user plane encryption protection and / or user plane integrity protection with the terminal device according to a user plane security policy received from the core network device. Alternatively, the first indication information indicates that interworking of user plane security policies between the first network and the second network is supported, in other words, indicates that the terminal device supports mapping of user plane security policies between the first network and the second network. In other words, supporting user plane integrity protection in the second network may be replaced with supporting user plane integrity protection with access network devices in the second network, supporting on-demand user plane protection with access network devices in the second network, supporting interworking of user plane security policies between the first network and the second network, or supporting mapping of user plane security policies between the first network and the second network.

[0198] The manner in which the session management network element obtains the first indication information is not limited in this embodiment of the present application.

[0199] In one example, the session management network element receives the first indication information from the access and mobility management function network element. In this example, S210 may include:

[0200] S211a: The terminal device sends second indication information to the access and mobility management function network element. Correspondingly, in S211a, the access and mobility management function network element receives the second indication information.

[0201] The second indication information indicates that the terminal device supports user plane integrity protection in the second network.

[0202] Alternatively, the second indication information indicates that the terminal device supports user plane integrity protection with an access network device in the second network. Alternatively, the second indication information indicates that the terminal device supports on-demand user plane protection with an access network device in the second network. On-demand user plane protection means that the access network device in the second network may determine whether to activate user plane encryption protection and / or user plane integrity protection with the terminal device according to a user plane security policy received from a core network device. Alternatively, the second indication information indicates that the terminal device supports user plane security policy interworking between the first network and the second network, in other words, the terminal device supports on-demand user plane protection with an access network device in the second network according to a user plane security policy received from a core network device. No. This indicates that the IEEE 802.11a / b / g / n / 802.11n supports mapping.

[0203] In other words, the terminal device supporting user plane integrity protection in the second network may be replaced with the terminal device supporting user plane integrity protection with an access network device in the second network, the terminal device supporting on-demand user plane protection with an access network device in the second network, the terminal device supporting interworking of user plane security policies between the first network and the second network, or the terminal device supporting mapping of user plane security policies between the first network and the second network.

[0204] For example, the second indication information sent by the terminal device to the access and mobility management function network element may be included in a registration request message. For example, the second indication information may be carried in 5G mobility management (MM) capability, UE security capability, or S1 UE network capability.

[0205] S212a: The access and mobility management function network element sends the first indication information based on the second indication information. Correspondingly, in S212a, the session management network element receives the first indication information.

[0206] The first indication information and the second indication information may be the same. For example, the second indication information indicates that the terminal device supports user plane integrity protection with the access network device in the second network, and the first indication information also indicates that the terminal device supports user plane integrity protection with the access network device in the second network.

[0207] Alternatively, the first indication information and the second indication information may be different, for example, the second indication information indicates that the terminal device supports on-demand user plane protection with the access network device in the second network, and the first indication information indicates that mapping of user plane security policies between the first network and the second network is supported.

[0208] In other words, after receiving the second indication information sent by the terminal device, the access and mobility management function network element may send the second indication information to the session management network element as the first indication information. Alternatively, after receiving the second indication information sent by the terminal device, the access and mobility management function network element generates the first indication information based on the second indication information and sends the first indication information to the session management network element.

[0209] For example, the first indication information may be included in a PDU session session management context establishment request (Nsmf_PDUSession_CreateSMContext Request) message or a PDU session context request (Nsmf_PDUSession_Context Request) message.

[0210] Optionally, in this example, the method S210 may further include: S213: The access and mobility management function network element determines whether to send the first indication information to the session management network element according to the local policy #1.

[0211] Specifically, with reference to another embodiment, the following describes in detail how the access and mobility management function network element determines whether to send the first indication information to the session management network element according to local policy #1 (an example of a first local policy). For the sake of brevity, the details are not described in this specification.

[0212] In another example, the session management network element receives the first indication information from the terminal device through the access and mobility management function network element. In this example, S210 may include:

[0213] S211b and S212b: The terminal device sends first indication information to the session management network element via the access and mobility management function network element.

[0214] For example, the terminal device sends a PDU Session Establishment Request message to a session management network element via an access and mobility management function network element, where the PDU Session Establishment Request message includes first indication information.

[0215] In a possible implementation, the terminal device sends a non-access stratum (NAS) message to the access and mobility management function network element, the NAS message including an N1 session management (SM) container, the N1 SM container including the first indication information. The access and mobility management function network element sends an N1 SM container to the session management network element. Optionally, the N1 SM container includes a PDU session establishment request, the PDU session establishment request including the first indication information.

[0216] S220: The session management network element sends a request message #1 (an example of a first request message) to the access and mobility management function network element based on the first indication information. In response, in S220, the access and mobility management function network element receives the request message #1.

[0217] The request message #1 is used to request a bearer identifier, where the bearer identifier corresponds to a bearer context, where the bearer context corresponds to a second network.

[0218] Optionally, request message #1 includes a session identifier, and request message #1 is used to request that a bearer identifier be assigned for this session.

[0219] For example, the first network is a 5G network, the second network is a 4G network, the session is a PDU session, the session identifier is a PDU session ID, the bearer is an EPS bearer, the bearer identifier is an EBI, and request message #1 is an EBI assignment request (Namf_Communication_EBIAssignment Request) message.

[0220] Optionally, if the first indication information indicates that user plane integrity protection with the access network device in the second network is supported, the session management network element sends a request message #1 to the access and mobility management function network element based on the first indication information.

[0221] Specifically, the session management network element sending a request message #1 to the access and mobility management function network element based on the first indication information includes: The session management network element sends the request message #1 to the access and mobility management function network element based on the first indication information without considering the user plane security policy of the terminal device in the first network. For example, the session management network element not considering the user plane security policy of the terminal device in the first network means that the session management network element does not consider the value of the user plane integrity protection policy of the terminal device in the first network. In other words, regardless of which of the following three values, namely "required", "not needed", and "preferred", is the value of the user plane integrity protection policy of the terminal device in the first network, if the session in the first network supports interworking with the second network, the session management network element sends the request message #1 to the access and mobility management function network element based on the first indication information.

[0222] In a possible implementation, the session management network element determines based on the first indication information that a user plane security policy of the terminal device in the first network has no restrictions on whether a session established for the terminal device in the first network can be handed over to the second network.

[0223] In a possible implementation, the session management network element further receives an N26 interface-based interworking indication of the second network from the access and mobility management function network element, where the N26 interface-based interworking indication of the second network indicates that the session requested to be established supports N26 interface-based interworking with the second network. The session management network element further receives an access type from the access and mobility management function network element, where the access type indicates whether 3GPP access or non-3GPP access is currently used. If the access type is 3GPP access and the N26 interface-based interworking indication of the second network indicates that the session requested to be established supports N26 interface-based interworking with the second network, when the session management network element receives the first indication information, the session management network element directly determines that the session of the terminal device in the first network supports EPS interworking without taking into account the user plane security policy of the terminal device in the first network.

[0224] After determining that a session of a terminal device in a first network supports EPS interworking and to subsequently hand over the session to a second network, the session management network element may perform S220 and S230 to request an access and mobility management function network element to assign a bearer identifier for the session.

[0225] S230: The access and mobility management function network element sends a response message #1 (an example of a first response message) in response to the request message #1. Correspondingly, in S230, the session management network element receives the response message #1.

[0226] The response message #1 includes a bearer identifier assigned to the session by the access and mobility management function network element, the bearer identifier may be identified by the second network, the first network is a 5G network, the second network is a 4G network, and the bearer identifier is an EBI. For example, the response message #1 is an EBI assignment response (Namf_Communication_EBIAssignment Response) message.

[0227] In this embodiment of the present application, the session management network element can remove the restriction that a session established for a terminal device in a first network cannot be handed over to a second network if the user plane security policy in the first network requires that user plane integrity protection is activated based on the first indication information. According to the existing solution, if the user plane security policy in the first network requires that user plane integrity protection is activated, the session management network element does not request a bearer identifier from the access and mobility management function network element. Therefore, the access and mobility management function network element does not locally store the corresponding bearer identifier. In this case, when subsequently receiving a handover requirement from the access network device in the first network, the access and mobility management function network element does not perform the related procedure of handing over the session established for the terminal device in the first network to the second network.

[0228] Optionally, the method 200 may further include S240: The session management network element sends an FQDN of the session management network element over an S5 / S8 interface to the integrated data management network element based on the first indication information.

[0229] Optionally, if the first indication information indicates that user plane integrity protection with the access network device in the second network is supported, the session management network element sends a fully qualified domain name of the session management network element over the S5 / S8 interface to the integrated data management network element.

[0230] Specifically, the session management network element sending the FQDN of the session management network element over the S5 / S8 interface to the integrated data management network element based on the first indication information includes: the session management network element sending the FQDN of the session management network element over the S5 / S8 interface to the integrated data management function network element based on the first indication information without considering the user plane security policy in the first network. For example, the session management network element not considering the user plane security policy of the terminal device in the first network means that the session management network element does not consider the value of the user plane integrity protection policy of the terminal device in the first network. In other words, regardless of which of the following three values, namely "required", "not required", and "preferred", is the value of the user plane integrity protection policy of the terminal device in the first network, if the session in the first network supports interworking with the second network, the session management network element sends the FQDN of the session management network element over the S5 / S8 interface to the integrated data management user plane function network element based on the first indication information.

[0231] In a possible implementation, the session management network element further receives an EPS interworking indication from the access and mobility management function network element, where the EPS interworking indication indicates that the terminal device supports EPS interworking. The session management network element further determines that the session of the terminal device in the first network allows EPS interworking based on subscription data of the terminal device. If the terminal device supports EPS interworking and the session of the terminal device in the first network allows EPS interworking, when the session management network element receives the first indication information, the session management network element directly determines that the session of the terminal device in the first network supports EPS interworking without considering the user plane security policy of the terminal device in the first network.

[0232] After determining that the session of the terminal device in the first network supports EPS interworking and subsequently handing over the session to the second network, the session management network element may further perform S240 to store the FQDN of the session management network element in the integrated data management network element.

[0233] In this embodiment of the present application, the session management network element sends the FQDN of the session management network element to the integrated data management network element on the S5 / S8 interface based on the first indication information, eliminating the limitation that a session established for a terminal device in the first network cannot be handed over to a second network when the user plane security policy in the first network requires that user plane integrity protection is activated. According to the existing solution, when the user plane security policy in the first network requires that user plane integrity protection is activated, the session management network element does not send the FQDN of the session management network element to the integrated data management network element on the S5 / S8 interface. Therefore, the session established for the terminal device in the first network cannot be subsequently handed over to the second network.

[0234] In the above embodiment, the restriction that a session established for a terminal device in a first network cannot support EPS interworking if the user plane security policy in the first network requires that user plane integrity protection be activated is removed, but it still remains unresolved how a device in a second network (e.g., a mobility management entity in the second network or an access device in the second network) obtains the user plane security policy of the terminal device in the second network.

[0235] In view of this, an embodiment of the present application further provides a communication method, so that in a process of handing over a session established for a terminal device in a first network to a second network, the device in the second network can obtain a user plane security policy of the terminal device in the second network. In this way, the session of the terminal device in the first network can be successfully handed over to the second network.

[0236] 3 is a schematic flowchart of a communication method according to an embodiment of the present application. As shown in FIG. 3, the method 300 may include S310 and S320. The following describes the steps in detail.

[0237] S310: A session management network element maps a user plane security policy of a terminal device in a first network to a user plane security policy of a terminal device in a second network.

[0238] For example, the first network may be a 5G network and the second network may be a 4G network.

[0239] The user plane security policy of the terminal device in the first network / second network may include a user plane encryption protection policy and a user plane integrity protection policy. The user plane encryption protection policy indicates whether to activate user plane encryption protection. The user plane encryption protection policy has three possible values, namely, "required", "preferred", and "not required". "Required" indicates that protection needs to be activated, "preferred" indicates that protection can or cannot be activated, and "not required" indicates that protection does not need to be activated. The user plane integrity protection policy indicates whether to activate user plane integrity protection. The user plane integrity protection policy also has three possible values, namely, "required", "preferred", and "not required". "Required" indicates that protection needs to be activated, "preferred" indicates that protection can or cannot be activated, and "not required" indicates that protection does not need to be activated. Each of the above three possible values ​​may be indicated by using two bits. For example, 00 indicates that protection does not need to be activated, 01 indicates that protection may or may not be activated, and 10 indicates that protection needs to be activated.

[0240] For example, the granularity of the user plane security policy of the terminal device in the first network may be any one of the following granularities: protocol data unit (PDU) session granularity, and data network name (DNN) granularity.

[0241] For example, the granularity of the user plane security policy of the terminal device in the second network may be any one of the following granularities: EPS bearer granularity, E-RAB granularity, and access point name (APN) granularity.

[0242] The manner in which the session management network element acquires the user plane security policy of the terminal device in the first network is not limited in this embodiment of the present application. For example, the user plane security policy of the terminal device in the first network may be stored locally by the session management network element. As another example, the user plane security policy of the terminal device in the first network may be acquired from the unified data management network element. With reference to another embodiment, the following will describe in detail how the session management network element acquires the user plane security policy of the terminal device in the first network from the unified data management network element. For the sake of brevity, the details will not be described in this specification.

[0243] Mapping a user plane security policy of a terminal device in a first network to a user plane security policy of a terminal device in a second network may be understood as converting a user plane security policy that can be identified by the first network to a user plane security policy that can be identified by the second network, or storing a user plane security policy in the first network in a context that can be identified by the second network. For example, the user plane security policy that can be identified by the first network is at the granularity of a DNN or a PDU session. The user plane security policy that can be identified by the second network is at the granularity of an EPS bearer, an E-RAB, or an APN. The DNN and the PDU session may have a one-to-many relationship, the PDU session and the EPS bearer may have a one-to-many relationship, the DNN and the APN may have a one-to-one relationship, the APN and the EPS bearer may have a one-to-many relationship, and the EPS bearer and the E-RAB may have a one-to-many relationship.

[0244] The user plane security policy of the terminal device in the first network, which is stored locally by the session management network element or obtained from the integrated data management network element, may be at the granularity of DNN+single network slice selection assistance information (S-NSSAI). If the user plane security policy of the terminal device in the second network obtained by the session management network element through mapping in S310 is at the granularity of EPS bearer, the session management network element first maps the user plane security policy of the terminal device in the first network at the granularity of DNN+S-NSSAI to the user plane security policy at the granularity of PDU session, and then maps the user plane security policy of the terminal device in the first network at the granularity of PDU session to the user plane security policy of the terminal device in the second network at the granularity of EPS bearer. If the user plane security policy of the terminal device in the second network obtained by the session management network element through mapping at S310 is at the granularity of the APN, the session management network element maps the user plane security policy of the terminal device in the first network at the granularity of the DNN to the user plane security policy of the terminal device in the second network at the granularity of the APN.

[0245] The user plane security policy of the terminal device in the first network, which is stored locally by the session management network element or obtained from the integrated data management network element, may be at the granularity of the PDU session. If the user plane security policy of the terminal device in the second network obtained by the session management network element through mapping in S310 is at the granularity of the EPS bearer, the session management network element maps the user plane security policy at the granularity of the PDU session to the user plane security policy of the terminal device in the second network at the granularity of the EPS bearer. If the user plane security policy of the terminal device in the second network obtained by the session management network element through mapping in S310 is at the granularity of the E-RAB, the session management network element obtains the user plane security policy of the terminal device in the second network at the granularity of the EPS bearer in the manner described above, and then maps the user plane security policy of the terminal device in the second network at the granularity of the EPS bearer to the user plane security policy at the granularity of the E-RAB.

[0246] For example, an implementation in which a session management network element stores a user plane security policy in a first network in a context that can be identified by a second network may include: the session management network element obtains a user plane security policy 1 of a terminal device in the first network, where the user plane security policy 1 corresponds to a PDU session 1, and stores the user plane security policy 1 in an EPS bearer context corresponding to the PDU session 1.

[0247] As another example, an implementation in which a session management network element stores a user plane security policy in a first network in a context that can be identified by a second network may include: the session management network element obtains a user plane security policy 1 of a terminal device in the first network, the user plane security policy 1 corresponds to DNN 1+S-NSSAI 1, determines a PDU session 1 and a PDU session 1 corresponding to DNN 1+S-NSSAI 1, stores the user plane security policy 1 in an EPS bearer context 1 corresponding to PDU session 1, and stores the user plane security policy 1 in an EPS bearer context 2 corresponding to PDU session 2.

[0248] Optionally, the session management network element may perform S310 in the process of handing over the terminal device from the first network to the second network. For details, please refer to the description in the following method 700. Optionally, the session management network element may perform S310 before the terminal device is handed over from the first network to the second network. For details, please refer to the description in the following method 500 and method 600.

[0249] When obtaining the user plane security policy of the terminal device in the first network, the session management network element may map the user plane security policy in the first network to the user plane security policy of the terminal device in the second network, or when obtaining the third indication information / first indication information, the session management network element may map the user plane security policy of the terminal device in the first network to the user plane security policy of the terminal device in the second network.

[0250] When the session management network element maps the user plane security policy of the terminal device in the first network to the user plane security policy of the terminal device in the second network based on the third indication information / first indication information, the method 300 further includes S320. The session management network element obtains the third indication information / first indication information.

[0251] For a description of the first indication information and the description of obtaining the first indication information by the session management network element, please refer to the above description in S210. For the sake of brevity, the details will not be described again in this specification.

[0252] The third indication information indicates a session management network element for mapping the user plane security policy in the second network. For further description of the third indication information and the description of obtaining the third indication information by the session management network element, please refer to the description in S718 in Figure 7(a) and Figure 7(b). For brevity, the details will not be described again in this specification.

[0253] Optionally, the method 300 may further include: The session management network element stores a user plane security policy of the terminal device in the second network in a bearer context of the terminal device in the second network.

[0254] Optionally, the method 300 may further include: the session management network element locally stores a user plane security policy of the terminal device in the second network, and stores a binding relationship between the user plane security policy of the terminal device in the second network and a bearer context.

[0255] In this embodiment of the present application, the session management network element may map the user plane security policy of the terminal device in the first network to the user plane security policy of the terminal device in the second network, and store the user plane security policy of the terminal device in the second network in the bearer context. Furthermore, in the process of the terminal device being handed over from the first network to the second network, the access and mobility management function network element in the first network obtains the bearer context from the session management network element, and further sends the obtained bearer context to the mobility management entity in the second network, so that the terminal device is handed over from the first network to the second network.

[0256] Also, when receiving the third indication information, the session management network element maps the user plane security policy of the terminal device in the first network to the user plane security policy of the terminal device in the second network, so that the session management network element can be prevented from performing unnecessary mapping, and the processing logic of the session management network element is optimized. If the session management network element does not receive the third indication information, the session management network element directly maps the user plane security policy of the terminal device in the first network to the user plane security policy of the terminal device in the second network. If the second network does not support the activation of user plane integrity protection, the terminal device cannot be handed over from the first network to the second network, and the mapping performed by the session management network element is unnecessary mapping.

[0257] With reference to Figures 4 to 7(a) and 7(b), the following describes in detail the communication method provided in the embodiment of the present application by using an example in which a terminal device is handed over from 5G to 4G. It should be understood that the following source AMF corresponds to the above-mentioned access and mobility management function network element, the SMF+PGW-C corresponds to the above-mentioned session management network element, the UE corresponds to the above-mentioned terminal device, and the UDM corresponds to the above-mentioned integrated data management network element. It should be further understood that the following UE capability indication may correspond to the above-mentioned second indication information or first indication information, the indication information #1 may correspond to the above-mentioned first indication information, and the indication information #2 may correspond to the above-mentioned third indication information.

[0258] Figure 4 is a schematic flowchart of a method according to an embodiment of the present application. Specifically, Figure 4 is a flowchart of how a source AMF obtains a user plane security policy in a 4G network from an SMF+PGW-C in a process in which a UE is handed over from a 5G network to a 4G network. As shown in Figure 4, the method 400 includes S401 to S413. The following describes the steps in detail.

[0259] S401: A source next generation Node Base station (gNB) decides to trigger an N2 handover.

[0260] The UE accesses the 5G network through a source gNB, a PDU session in the 5G network is established, and the source gNB decides to initiate a handover from a 5G system (5G system, 5GS) to an EPS, so that the UE is handed over to an eNB in ​​the 4G network. The eNB in ​​the 4G network is referred to as a target eNB hereinafter.

[0261] In the process of the UE accessing the 5G network, the source gNB obtains a user plane security policy of the UE in the 5G network from the core network side, and activates user plane security between the source gNB and the UE by using the user plane security policy of the UE in the 5G network. The source gNB further stores the obtained user plane security policy of the UE in the 5G network in an access stratum (AS) context of the UE.

[0262] If the source gNB determines that the UE needs to be handed over to the target eNB, a 5GS to EPS handover may be triggered based on the following conditions: (1) current insufficient wireless network status, (2) load balancing, and (3) voice service requirements.

[0263] S402: The source gNB sends a handover required message to the source AMF.

[0264] The handover request message carries a UE identifier. The UE identifier is used to obtain the UE context. The UE identifier may include a unique identifier of the terminal device on the NG interface on the source gNB side (gNB UE NG application protocol identifier, gNB UE NGAP ID) or a unique identifier of the terminal device on the NG interface on the source AMF side (AMF UE NG application protocol identifier, AMF UE NGAP ID).

[0265] S403: The source AMF sends a PDU session context request (Nsmf_PDUSession_Context Request) message (an example of a second request message) to the SMF+PGW-C.

[0266] Before sending a PDU session context request message to the SMF+PGW-C, the source AMF determines whether to obtain an EPS bearer context from the SMF+PGW-C according to local policy #2. If the source AMF determines to obtain an EPS bearer context from the SMF+PGW-C according to local policy #2, the source AMF sends a PDU session context request message to the SMF+PGW-C. The PDU session context request message includes a PDU session ID.

[0267] The local policy #2 of the source AMF may include the following: The source AMF has allocated an EBI for the PDU session to be handed over. Specifically, the source AMF obtains a UE context based on the UE identifier. Furthermore, the source AMF obtains a PDU session that needs to be handed over based on the UE context, and allocates an EBI for the PDU session. Be Determine if the

[0268] According to the embodiment shown in Figure 2, when a PDU session in a 5G network is established for a UE, and the SMF + PGW-C determines that the PDU session supports handover to EPS, it should be noted that S220 and S230 are performed to request the AMF to allocate an EBI for the PDU session. After allocating an EBI for the PDU session, the AMF may store the allocated EBI in the context of the UE.

[0269] S404: The SMF+PGW-C obtains the EPS bearer context of the UE based on the PDU session ID.

[0270] In a possible implementation, according to the embodiment shown in FIG. 3, the EPS bearer context of the UE already stores the user plane security policy of the UE in the 4G network.

[0271] In another possible implementation, according to the embodiment shown in Figure 3, the SMF+PGW-C may locally store the user plane security policy of the UE in the 4G network, and store the correspondence between the user plane security policy of the UE in the 4G network and the EPS bearer context. In this case, the SMF+PGW-C determines the corresponding EPS bearer context based on the PDU session ID, and then obtains the user plane security policy of the UE in the 4G network based on the EPS bearer context.

[0272] The user plane security policy of a UE in a 4G network includes a user plane encryption protection policy and a user plane integrity protection policy. The user plane encryption protection policy indicates whether to activate user plane encryption protection, and the user plane integrity protection policy indicates whether to activate user plane integrity protection. The user plane encryption protection policy has three possible values, namely, "not required", "preferred", and "required", and the user plane integrity protection policy has three possible values, namely, "not required", "preferred", and "not required". "Not required" indicates that protection does not need to be activated, "preferred" indicates that protection can or cannot be activated, and "required" indicates that protection needs to be activated. Each of the aforementioned three possible values ​​can be indicated by using two bits. For example, 00 indicates that protection does not need to be activated, 01 indicates that protection can or cannot be activated, and 11 indicates that protection needs to be activated.

[0273] The user plane security policy of a UE in a 4G network may be at the granularity of EPS bearer / E-RAB / APN. For example, the format of an EPS bearer context is {EPS bearer 1:user plane security policy 1};{E-RAB 1:user plane security policy 1}; or {APN 1:user plane security policy 1}. {EPS bearer 1:user plane security policy 1} indicates that EPS bearer 1 corresponds to user plane security policy 1, in other words, user plane security policy 1 is at the granularity of EPS bearer. {E-RAB 1:user plane security policy 1} indicates that E-RAB 1 corresponds to user plane security policy 1, in other words, user plane security policy 1 is at the granularity of E-RAB. {APN 1:user plane security policy 1} indicates that APN 1 corresponds to user plane security policy 1, in other words, user plane security policy 1 is at the granularity of APN.

[0274] S405: SMF+PGW-C sends a PDU session context response (Nsmf_PDUSession_Context Response) message (an example of a second response message) to the source AMF.

[0275] In a possible implementation, the PDU session context response message includes an EPS bearer context, which includes a user plane security policy of the UE in the 4G network.

[0276] In another possible implementation, the PDU session context response message includes the EPS bearer context and the user plane security policy of the UE in the 4G network.

[0277] S406: The source AMF sends a forward relocation request message to the target MME.

[0278] In a possible implementation, the forward relocation request message includes an EPS bearer context, which includes a user plane security policy of the UE in the 4G network.

[0279] In another possible implementation, the forward relocation request message includes the EPS bearer context and the user plane security policy of the UE in the 4G network.

[0280] S407: The target MME sends a handover request message to the target eNB (an access network device in a 4G network).

[0281] The handover request message includes the user plane security policy of the UE in the 4G network.

[0282] In a possible implementation, the target MME obtains a user plane security policy of the UE in the 4G network based on the EPS bearer context. Optionally, if the user plane security policy of the UE in the 4G network obtained by the target MME is at the granularity of the EPS bearer / APN, the target MME maps the user plane security policy at the granularity of the EPS bearer / APN to the user plane security policy at the granularity of the E-RAB.

[0283] S408: The target eNB determines a user plane security activation status of the UE in the 4G network according to a user plane security policy of the UE in the 4G network.

[0284] The user plane security activation status indicates whether to activate user plane encryption protection and / or user plane integrity protection. The target eNB determines the user plane security activation status at the granularity of data radio bearer (DRB) according to the user plane security policy at the granularity of E-RAB. The relationship between E-RAB and DRB is a one-to-many mapping relationship. For example, the target eNB obtains DRB 1 and DRB 2 through mapping from E-RAB 1, determines the user plane security activation status of DRB 1 according to the user plane security policy 1 corresponding to E-RAB 1, and then determines the user plane security activation status of DRB 2 according to the user plane security policy 1.

[0285] Specifically, if the user plane encryption protection policy corresponding to the E-RAB is required for all DRBs corresponding to the E-RAB, the target eNB determines that the encryption activation status corresponding to all DRBs is activated. If the user plane encryption protection policy corresponding to the E-RAB is suitable for all DRBs corresponding to the E-RAB, the target eNB determines that the encryption activation status corresponding to the DRBs can be activated or cannot be activated. The target eNB may determine whether to activate the encryption activation status according to a local policy (e.g., the running status of the target eNB, a control policy, or a required regulation). If the user plane encryption protection policy corresponding to the E-RAB is not required for all DRBs corresponding to the E-RAB, the target eNB determines that the encryption activation status corresponding to all DRBs is not activated.

[0286] If the user plane integrity protection policy is required for all DRBs corresponding to the E-RAB, the target eNB determines that the integrity encryption activation status corresponding to all DRBs is activated. If the user plane integrity protection policy corresponding to the E-RAB is suitable for all DRBs corresponding to the E-RAB, the target eNB determines that the integrity encryption activation status corresponding to the DRBs can be activated or cannot be activated. The target eNB may determine whether to activate the integrity protection activation status according to a local policy (e.g., the running status of the target eNB, a control policy, or a required regulation). If the user plane integrity protection policy corresponding to the E-RAB is not required for all DRBs corresponding to the E-RAB, the target eNB determines that the integrity encryption activation status corresponding to all DRBs is not activated.

[0287] S409: The target eNB sends a handover request acknowledge message to the target MME.

[0288] The handover request acknowledgement message includes a radio resource control (RRC) reconfiguration (connection reconfiguration), where the RRC reconfiguration is established by the target eNB.

[0289] The RRC reconfiguration carries configuration information, which indicates whether the UE activates user plane ciphering protection and / or user plane integrity protection in the 4G network. The configuration information is determined based on the user plane security activation status in S408.

[0290] Specifically, if the target eNB determines that the ciphering activation status is activated, the target eNB encapsulates a ciphering disabled field in the configuration information. If the target eNB determines that the ciphering activation status is not activated, the target eNB does not encapsulate a ciphering disabled field in the configuration information. If the target eNB determines that the integrity protection activation status is activated, the target eNB encapsulates an integrity protection field in the configuration information. If the target eNB determines that the integrity protection activation status is not activated, the target eNB does not encapsulate an integrity protection field in the configuration information.

[0291] The integrity protection field indicates to activate user plane integrity protection. The integrity protection field may be equivalent to indication information for activating user plane integrity protection, or the content of the integrity protection field may be indication information for activating user plane integrity protection. Therefore, if the integrity protection field is encapsulated in the configuration information, the RRC reconfiguration may be considered to include indication information for activating user plane integrity protection.

[0292] S410: The target MME sends a forward relocation response message to the source AMF. The forward relocation response message includes an RRC reconfiguration, and the RRC reconfiguration includes configuration information.

[0293] S411: The source AMF sends a handover command message to the source gNB. The handover command message includes an RRC reconfiguration, and the RRC reconfiguration includes configuration information.

[0294] S412: The source gNB sends an RRC reconfiguration to the UE. The UE determines whether to activate user plane security encryption protection and / or user plane integrity protection between the UE and the target eNB based on the configuration information included in the RRC reconfiguration.

[0295] Specifically, if a ciphering disabled field is encapsulated in the configuration information, the UE does not activate ciphering protection in the 4G network. If a ciphering disabled field is not encapsulated in the configuration information, the UE activates ciphering protection in the 4G network. If an integrity protection field is encapsulated in the configuration information, the UE activates integrity protection in the 4G network. If an integrity protection field is not encapsulated in the configuration information, the UE does not activate integrity protection in the 4G network.

[0296] S413: The UE sends an RRC reconfiguration complete message to the target eNB to complete the handover.

[0297] Figure 5 is a schematic flowchart of a method according to an embodiment of the present application. Specifically, Figure 5 illustrates a process in which the SMF+PGW-C maps the user plane security policy of the UE in the 5G network to the user plane security policy of the UE in the 4G network before the UE is handed over from the 5G network to the 4G network, and Figure 5 further illustrates a procedure in which the SMF+PGW-C requests to allocate an EBI and send an FQDN on the S5 / S8 interface based on the indication information #1. As shown in Figure 5, the method 500 includes S501 to S516. The following describes the steps in detail.

[0298] S501: The UE sends a registration request message to the AMF.

[0299] The registration request message includes a UE capability indication. The UE capability indication is equivalent to the second indication information in the embodiment of FIG. 2. For related descriptions, please refer to the related contents in the embodiment of FIG. 2. Details will not be described again here. The UE capability indication can be carried in 5G MM capability, UE security capability, or S1 UE network capability.

[0300] S502: The AMF sends a registration accept message to the UE.

[0301] Optionally, the AMF stores the UE capability indication in the context of the UE.

[0302] S503: The UE sends an uplink NAS transport message to the AMF.

[0303] The uplink NAS transport message includes SM container information, and the SM container information includes a PDU session establishment request message. The uplink NAS transport message further includes a DNN and an S-NSSAI.

[0304] Optionally, the method 500 may further include S504: The AMF determines whether to send the indication information #1.

[0305] The indication information #1 is equivalent to the first indication information in the embodiment of Fig. 2. For related explanations, please refer to the related content in the embodiment of Fig. 2. The details will not be described again here.

[0306] The AMF obtains the UE's context based on the uplink NAS transport message. Furthermore, the AMF determines whether to send the indication information #1 based on the uplink NAS transport message and the UE's context. In a possible implementation, the AMF determines whether to send the indication information #1 based on the indication that the DNN and S-NSSAI support interworking with EPS stored in the UE's context and the UE capability indication. If the indication that the DNN and S-NSSAI support interworking with EPS indicates that the UE supports interworking with EPS and the UE capability indication indicates that the UE supports user plane integrity protection with the eNB, the AMF decides to send the indication information #1.

[0307] The process of the AMF determining whether to send the indication information #1 based on the uplink NAS transport message and the UE context is equivalent to the access and mobility management function network element determining whether to send the first indication information in the embodiment of Figure 2 according to the local policy #1. That is, the local policy #1 of the access and mobility management function network element may include whether the DNN and S-NSSAI support interworking with EPS and whether the UE capability indication has been obtained. Whether the DNN+S-NSSAI supports interworking with EPS may be understood as whether the PDU session corresponding to the DNN+S-NSSAI supports interworking with EPS.

[0308] The indication of supporting interworking with EPS indicates whether the UE supports interworking with EPS, and the indication of supporting interworking with EPS is stored in the subscription information of the UE. When the UE registers with the network, the AMF obtains from the UDM the indication stored in the subscription information of the UE that indicates that interworking with EPS is supported, and stores the indication of supporting interworking with EPS in the context of the UE.

[0309] S505: The AMF sends a PDU session SM context establishment request (Nsmf_PDUSession_CreateSMContext Request) message to the SMF+PGW-C. The PDU session SM context establishment request message includes a subscription permanent identifier (SUPI), a DNN, an S-NSSAI, and indication information #1 of the UE.

[0310] The AMF obtains the UE's context based on the uplink NAS transport message. Furthermore, the AMF selects the SMF+PGW-C based on the uplink NAS transport message and the UE's context. Optionally, the AMF selects the SMF+PGW-C based on the DNN and S-NSSAI in the uplink NAS transport message and an indication stored in the UE's context that indicates that the UE supports evolved packet core (EPC) NAS. Optionally, the AMF further selects the SMF+PGW-C based on an indication stored in the UE's context that indicates that the DNN and S-NSSAI support interworking with EPS. The indication that the UE supports EPC NAS indicates whether the UE supports an S1 mode (a mode in which an access network device interacts with a core network device through an S1 interface). When the UE registers with the network, the UE reports an indication based on its 5G mobility management capability (5G MM capability) that the UE supports the EPC NAS.

[0311] S506: The SMF+PGW-C sends a subscription data management request (Nudm_SubscriberDataManagement_Get) message to the UDM to request subscription information of the UE. The acquired subscription data management request message includes the SUPI, the DNN, and the S-NSSAI.

[0312] S507: UDM sends a subscription data management response (Nudm_SubscriberDataManagement_Response) message to the SMF+PGW-C.

[0313] The subscription data management response message includes the session management subscription data of the UE. The session management subscription data of the UE includes the DNN, the S-NSSAI, the user plane security policy of the UE in the 5G network, and an indication of supporting interworking with the EPS. The user plane security policy of the UE in the 5G network and the indication of supporting interworking with the EPS are at the granularity of the DNN, the S-NSSAI, or the DNN+S-NSSAI. For example, the user plane security policy of the UE in the 5G network and the indication of supporting interworking with the EPS are at the granularity of the DNN+S-NSSAI. The session management subscription data of the UE may be represented as {S-NSSAI 1, DNN 1, user plane security policy 1, indication of supporting interworking with the EPS 1}. {S-NSSAI 1, DNN 1, User Plane Security Policy 1, Indication 1 of supporting interworking with EPS} indicates that User Plane Security Policy 1 and Indication 1 of supporting interworking with EPS correspond to S-NSSAI 1+DNN 1, in other words, User Plane Security Policy 1 and Indication 1 of supporting interworking with EPS are at the granularity of S-NSSAI 1+DNN 1.

[0314] If the user plane security policy of the UE in the 5G network, which is included in the session management subscription data of the UE, is at the granularity of DNN+S-NSSAI, the SMF+PGW-C may map the user plane security policy of the UE in the 5G network at the granularity of DNN+S-NSSAI to the user plane security policy at the granularity of PDU session. One DNN+S-NSSAI may correspond to one or more PDU sessions. For example, the SMF+PGW-C obtains PDU session 1 through mapping from DNN 1+S-NSSAI 1, and then determines the user plane security policy 1 corresponding to PDU session 1 according to the user plane security policy 1 corresponding to DNN 1+S-NSSAI 1.

[0315] S508: The SMF+PGW-C sends the FQDN of the SMF+PGW-C to the UDM on the S5 / S8 interface.

[0316] Specifically, the SMF+PGW-C sends the FQDN of the SMF+PGW-C to the UDM over the S5 / S8 interface based on the indication information #1. For further explanation of how the SMF+PGW-C sends the FQDN of the SMF+PGW-C over the S5 / S8 interface based on the indication information #1, please refer to the above description in S240. For brevity, the details will not be described again here.

[0317] Optionally, the SMF+PGW-C may add the FQDN of the SMF+PGW-C to the subscription data management request message over the S5 / S8 interface and send the FQDN to the UDM. In this case, S508 and S506 may be combined into one step.

[0318] S509: The SMF+PGW-C maps the 5G context to the EPS bearer context.

[0319] The SMF+PGW-C mapping the 5G context to the EPS bearer context includes mapping 5G QoS parameters to EPS QoS parameters, and further includes mapping a 5G user plane security policy to an EPS user plane security policy.

[0320] Optionally, the SMF+PGW-C maps the 5G user plane security policy to the EPS user plane security policy based on the indication information #1. The SMF+PGW-C stores the mapped EPS user plane security policy in the EPS context of the UE. In other words, when the indication information #1 is received, the SMF+PGW-C maps the 5G context to the EPS bearer context.

[0321] Specifically, for a description of how the SMF+PGW-C maps the user plane security policy to the EPS user plane security policy, please refer to the above description in S310. For brevity, the details will not be described again here.

[0322] S510: SMF+PGW-C sends an N1N2 message transfer (Namf_Communication_N1N2MessageTransfer) message to AMF.

[0323] The N1N2 Message Transfer message includes N1 SM information and N2 SM information. The AMF does not parse the N1 SM information and transparently transfers the N1 SM information to the UE. The N1 SM information includes a PDU Session Establishment Accept message. The AMF does not parse the N2 SM information and transparently transfers the N2 SM information to the gNB. The N2 SM information includes the user plane security policy at the granularity of the PDU session.

[0324] S511: The AMF sends N2 SM information to the gNB, and the gNB determines the user plane security activation status at the granularity of the DRB according to the user plane security policy at the granularity of the PDU session.

[0325] S512a: The gNB sends an RRC reconfiguration to the UE, where the RRC reconfiguration includes configuration information. The UE determines whether to activate user plane security encryption protection / user plane integrity protection between the UE and the gNB according to the configuration information included in the RRC reconfiguration.

[0326] S512b: The AMF sends the contents of the N1 SM information, i.e., a PDU session establishment acceptance message, to the UE to complete the PDU session establishment.

[0327] S513: The SMF+PGW-C determines whether to request the AMF to allocate an EBI according to local policy #3.

[0328] Local policy #3 may, for example, include that the current PDU session is used for 3rd generation partnership project (3GPP) access and supports interworking with EPS over the N26 interface.

[0329] Furthermore, the SMF+PGW-C further makes a further decision based on the indication information #1 and the integrity protection policy in the user plane security policy of the UE in the 5G network. For example, when obtaining the indication information #1, the SMF+PGW-C does not need to determine the user plane security policy of the UE in the 5G network. When the SMF+PGW-C does not obtain the indication information #1 of the UE, the integrity protection policy in the user plane security policy of the UE in the 5G network is not required. In this case, the SMF+PGW-C needs to request the AMF to allocate an EBI. When the integrity protection policy in the user plane security policy of the UE in the 5G network is required, the SMF+PGW-C cannot request the AMF to allocate an EBI.

[0330] For how the SMF+PGW-C determines whether to request the AMF to allocate an EBI for a PDU session, please refer to the relevant description in S220 in the embodiment of Figure 2. The details will not be described again here.

[0331] S514: If the SMF+PGW-C decides to request the AMF to allocate an EBI, the SMF+PGW-C sends an EBI allocation request message to the AMF. The EBI allocation request message includes a PDU session ID.

[0332] S515: The AMF allocates an EBI for the PDU session.

[0333] S516: The AMF sends an EBI allocation response message to the SMF+PGW-C. The EBI allocation response message includes the allocated EBI. The SMF+PGW-C associates the EBI with the mapped EPS context.

[0334] It should be understood that in the method 500, the sequence numbers of the above-mentioned processes do not mean an execution sequence. The execution sequence of the processes should be determined based on the functions and internal logic of the processes, and should not be interpreted as any limitation on the implementation process of the method 500. For example, S508 may be performed between S505 and S512 (S512a / S512b), or S508 may be performed after S516. Specifically, after the SMF+PGW-C successfully receives an EBI allocation response message, which indicates that the SMF+PGW-C determines that the AMF has successfully allocated the EBI, the SMF+PGW-C performs S508. As another example, S 512b The content of N1 SM information in S 512a Therefore, the RRC reconfiguration message in S 512a and S. 512b As another example, S509 may be performed between S505 and S516, or S509 may be performed after S516.

[0335] In this embodiment of the present application, before the UE is handed over from the 5G network to the 4G network, the SMF+PGW-C maps the user plane security policy of the UE in the 5G network to the user plane security policy of the UE in the 4G network, so that in the process of subsequently handing over the UE from the 5G network to the 4G network, the AMF in the 5G network can directly obtain the user plane security policy of the UE in the 4G network from the SMF+PGW-C, and does not need to wait for the SMF+PGW-C to map the user plane security policy of the UE in the 5G network to the user plane security policy of the UE in the 4G network, thereby reducing the handover delay.

[0336] Figure 6 is a schematic flow chart of a method according to an embodiment of the present application. Specifically, Figure 6 illustrates a process in which the SMF+PGW-C maps the user plane security policy of the UE in the 5G network to the user plane security policy of the UE in the 4G network before the UE is handed over from the 5G network to the 4G network, and Figure 6 further illustrates a procedure in which the SMF+PGW-C allocates an EBI and requests to send an FQDN on the S5 / S8 interface based on the UE capability indication. As shown in Figure 6, the method 600 includes S601 to S613. The following describes the steps in detail.

[0337] S601: The UE sends an uplink NAS transport message to the AMF.

[0338] The uplink NAS transport message includes SM container information, and the SM container information includes a PDU session establishment request message. The uplink NAS transport message further includes a DNN and an S-NSSAI.

[0339] The PDU session establishment request message includes a UE capability indication. The UE capability indication is equivalent to the first indication information in S211b and S212b in the embodiment of Figure 2. For related descriptions, please refer to the related content in the embodiment of Figure 2. Details will not be described again here.

[0340] S602: The AMF sends a PDU Session Establishment SM Context Request message to the SMF+PGW-C. The PDU Session Establishment SM Context Request message includes a SUPI, a DNN, an S-NSSAI, and a PDU Session Establishment Request message of the UE.

[0341] S603 to S613 are the same as S506 to S516 of method 500. For brevity, the details will not be described again here.

[0342] It should be understood that in the method 600, the sequence numbers of the above processes do not mean an execution sequence. The execution sequence of the processes should be determined based on the functions and internal logic of the processes, and should not be interpreted as any limitation on the implementation process of the method 600. For example, S606 may be performed between S604 and S609 (S609a / S609b), or S606 may be performed after S613. Specifically, after the SMF+PGW-C successfully receives an EBI allocation response message, which indicates that the SMF+PGW-C determines that the AMF has successfully allocated the EBI, the SMF+PGW-C performs S606. As another example, the content of the N1 SM information in S609b may be carried in the RRC reconfiguration message in S609a. Therefore, S609a and S609b may be performed simultaneously. As another example, S605 may be performed between S602 and S613, or S605 may be performed after S613.

[0343] In this embodiment of the present application, before the UE is handed over from the 5G network to the 4G network, the SMF+PGW-C maps the user plane security policy of the UE in the 5G network to the user plane security policy of the UE in the 4G network, so that in the process of subsequently handing over the UE from the 5G network to the 4G network, the AMF in the 5G network can directly obtain the user plane security policy of the UE in the 4G network from the SMF+PGW-C, and does not need to wait for the SMF+PGW-C to map the user plane security policy of the UE in the 5G network to the user plane security policy of the UE in the 4G network, thereby reducing the handover delay.

[0344] 7(a) and 7(b) are schematic flow charts of a method according to an embodiment of the present application. Specifically, FIG. 7(a) illustrates a process in which the SMF+PGW-C requests to allocate an EBI and send an FQDN on the S5 / S8 interface based on the indication information #2 before the UE is handed over from the 5G network to the 4G network. FIG. 7(b) illustrates a process in which the SMF+PGW-C maps the user plane security policy of the UE in the 5G network to the user plane security policy of the UE in the 4G network in the process of handing over the UE from the 5G network to the 4G network. As shown in FIG. 7(a) and FIG. 7(b), the method 700 includes steps S701 to S705. 729 The following describes the steps in detail.

[0345] S701 to S708 are the same as S501 to S508 in method 500, and S709 to S715 are the same as S510 to S516 in method 500. For brevity, the details will not be described again here.

[0346] Optionally, at S705, the SMF+PGW-C stores the indication information #1 in the context of the terminal device.

[0347] S716 to S717 are the same as S401 to S402 in method 400. For brevity, the details will not be described again here.

[0348] S718: The source AMF determines whether to send indication information #1 / indication information #2.

[0349] The indication information #1 is equivalent to the first indication information in the embodiment of Fig. 2. For related explanations, please refer to the related content in the embodiment of Fig. 2. The details will not be described again here.

[0350] The indication information #2 indicates that user plane security policy mapping is performed. Alternatively, the indication information #2 indicates that user plane integrity protection with an access network device in a 4G network is supported. Alternatively, the indication information #2 indicates that on-demand user plane protection with an access network device in a 4G network is supported. Alternatively, the indication information #2 indicates that interworking of user plane security policies between a 5G network and a 4G network is supported, in other words, that mapping of user plane security policies between a 5G network and a 4G network is supported.

[0351] The source AMF obtains the UE context based on the uplink NAS transport message. Furthermore, the source AMF determines whether to send indication information #1 / indication information #2 based on the uplink NAS transport message, the UE context, and whether the target MME supports user plane integrity protection. The source AMF further stores the capability information of the target MME, which indicates whether the target MME supports user plane integrity protection. If the target MME supports user plane integrity protection, the source AMF sends the UE indication information #1 / indication information #2. information Decide to send #1 / indication information #2. The capability information of the target MME is configured locally by the AMF.

[0352] The process of the AMF determining whether to send the indication information #1 based on the uplink NAS transport message and the UE context is equivalent to the access and mobility management function network element determining whether to send the first indication information in the embodiment of FIG. 2 according to the local policy #1. That is, the local policy #1 of the access and mobility management function network element may further include whether the target MME supports user plane integrity protection. The source AMF determines whether to send the indication information #2 according to the local policy #4 (an example of a second local policy). The local policy #4 may include whether the DNN and the S-NSSAI support interworking with EPS, whether the UE capability indication has been obtained, and whether the target MME supports user plane integrity protection. For the manner in which the source AMF determines whether the DNN and S-NSSAI support interworking with EPS and whether the target MME supports user plane integrity protection, please refer to the description of Local Policy #1 in the embodiments of Figure 5 and Figures 7(a) and 7(b).

[0353] S719: The source AMF sends a PDU session context request (Nsmf_PDUSession_Context Request) message to the SMF+PGW-C.

[0354] Before sending a PDU session context request message to the SMF+PGW-C, the source AMF determines whether to obtain an EPS bearer context from the SMF+PGW-C according to local policy #2. If the source AMF determines to obtain an EPS bearer context from the SMF+PGW-C according to local policy #2, the source AMF sends a PDU session context request message to the SMF+PGW-C. The PDU session context request message includes a PDU session ID.

[0355] Optionally, the PDU session context request message further includes indication information #2.

[0356] The local policy #2 of the source AMF may include: The source AMF has allocated an EBI for the PDU session to be handed over. Specifically, the source AMF obtains a UE context based on the UE identifier. Further, the source AMF obtains a PDU session that needs to be handed over based on the UE context, and determines whether an EBI has been allocated for the PDU session.

[0357] 2 and the embodiment of Figures 7(a) and 7(b), it should be noted that between S703 and S711b (in other words, in the process of PDU session establishment in the 5G network for the UE), if the SMF+PGW-C determines that the PDU session supports handover to EPS, S713 to S715 in method 700 are performed to request the AMF to allocate an EBI for the PDU session. After allocating the EBI for the PDU session, the AMF may store the allocated EBI in the context of the UE.

[0358] S720: The SMF+PGW-C maps the 5G user plane security policy to the EPS user plane security policy.

[0359] Optionally, the SMF+PGW-C obtains UE context information based on the PDU session context request message, and obtains indication information #1 from the UE context information. The SMF+PGW-C maps the 5G user plane security policy to the EPS user plane security policy based on the indication information #1.

[0360] Optionally, the SMF+PGW-C maps the 5G user plane security policy to the EPS user plane security policy based on indication information #2 obtained from the PDU session context request message.

[0361] Specifically, for further description of the mapping of 5G user plane security policy to EPS user plane security policy by the SMF+PGW-C, see the above description in S310.

[0362] S721 to S729 are the same as S405 to S413 in method 400. For brevity, the details will not be described again here.

[0363] In this embodiment of the present application, in the process of handing over a UE from a 5G network to a 4G network, the SMF+PGW-C maps the user plane security policy of the UE in the 5G network to the user plane security policy of the UE in the 4G network to avoid unnecessary mapping. For example, before the UE is handed over from a 5G network to a 4G network, if the UE does not access the 4G network after the SMF+PGW-C maps the user plane security policy of the UE in the 5G network to the user plane security policy of the UE in the 4G network, the UE does not perform a handover procedure. In this case, when the SMF+PGW-C performs unnecessary mapping, the computing resources and storage resources of the SMF+PGW-C are wasted.

[0364] The method provided in the embodiment of the present application is described in detail above with reference to Figures 2 to 7(a) and 7(b). The communication device provided in the embodiment of the present application is described in detail below with reference to Figures 8 and 9. It should be understood that the description of the device embodiment corresponds to the description of the method embodiment. Therefore, for the contents that are not described in detail, please refer to the above-mentioned method embodiment. For the sake of brevity, the details will not be described again here.

[0365] In the embodiment of the present application, the sending device or the receiving device may be divided into functional modules according to the above-mentioned method example. For example, each functional module may be obtained through a division corresponding to each function, or two or more functions may be integrated into one processing module. The integrated module may be implemented in the form of hardware or in the form of a software function module. It should be noted that in the embodiment of the present application, the module division is an example and is merely a logical function division. During actual implementation, other division methods may be used. An example in which each functional module is obtained through a division based on each corresponding function is used below for explanation.

[0366] 8 is a schematic block diagram of a communication device 800 according to an embodiment of the present application. As shown in the figure, the communication device 800 may include a transceiver unit 810 and a processing unit 820.

[0367] In a possible design, the apparatus 800 may be a session management network element in the aforementioned method embodiments, or may be a chip configured to implement the functionality of the session management network element in the aforementioned method embodiments.

[0368] It should be understood that the communication device 800 may correspond to the session management network element in the method 200 to the method 700 according to the embodiment of the present application. The communication device 800 may correspond to the method 200 in FIG. 2, the method 300 in FIG. 3, the method 400 in FIG. 4, and the method 500 in FIG. 5. 4005, 600, and 700 of FIG. 7(a) and 7(b). In addition, the units in the communication device 800 and other operations and / or functions described above may include units configured to perform the methods performed by the session management network element in the method 500 of FIG. 5, the method 600 of FIG. 6, and the method 700 of FIG. 7(a) and 7(b), respectively. 400 , is intended to implement the corresponding procedures of the method 500 of FIG. 5, the method 600 of FIG. 6, and the method 700 of FIG. 7(a) and FIG. 7(b). It should be understood that the specific processes by which the units perform the aforementioned corresponding steps have been described in detail in the aforementioned method embodiments. For the sake of brevity, the details will not be described herein.

[0369] In another possible design, the communications device 800 may be an access and mobility management function network element in the aforementioned method embodiments, or may be a chip configured to implement the functionality of the access and mobility management function network element in the aforementioned method embodiments.

[0370] It should be understood that the communication device 800 may correspond to the access and mobility management function network element in the method 200 to the method 700 according to the embodiment of the present application. The communication device 800 may correspond to the method 200 of FIG. 2, the method 300 of FIG. 3, the method 400 of FIG. 4, and the method 500 of FIG. 5. 400 5, 600, and 700 of FIG. 7(a) and 7(b). The units in the communication device 800 and other operations and / or functions described above may include units configured to perform the methods performed by the access and mobility management function network element in the method 500 of FIG. 5, the method 600 of FIG. 6, and the method 700 of FIG. 7(a) and 7(b). Also, the units in the communication device 800 and other operations and / or functions described above may include units configured to perform the methods performed by the access and mobility management function network element in the method 500 of FIG. 5, the method 600 of FIG. 6, and the method 700 of FIG. 7(a) and 7(b), respectively. 400 , is intended to implement the corresponding procedures of the method 500 of FIG. 5, the method 600 of FIG. 6, and the method 700 of FIG. 7(a) and FIG. 7(b). It should be understood that the specific processes by which the units perform the aforementioned corresponding steps have been described in detail in the aforementioned method embodiments. For the sake of brevity, the details will not be described herein.

[0371] In a possible design, the apparatus 800 may be a terminal device in the aforementioned method embodiments, or may be a chip configured to implement the functions of the terminal device in the aforementioned method embodiments.

[0372] It should be understood that the communication device 800 may correspond to the terminal device in the method 200 to the method 700 according to the embodiment of the present application. The communication device 800 may correspond to the method 200 in FIG. 2, the method 300 in FIG. 3, the method 400 in FIG. 4, and the method 500 in FIG. 5. 400 5, 600, and 700 of FIG. 7(a) and 7(b). The units in the communication device 800 and other operations and / or functions described above may include units configured to perform the methods performed by the terminal device in the method 500 of FIG. 5, the method 600 of FIG. 6, and the method 700 of FIG. 7(a) and 7(b). 400 , is intended to implement the corresponding procedures of the method 500 of FIG. 5, the method 600 of FIG. 6, and the method 700 of FIG. 7(a) and FIG. 7(b). It should be understood that the specific processes by which the units perform the aforementioned corresponding steps have been described in detail in the aforementioned method embodiments. For the sake of brevity, the details will not be described herein.

[0373] It should be further understood that the transceiver unit 810 in the communication apparatus 800 may correspond to the transceiver 920 in the communication device 900 shown in FIG. 9, and the processing unit 820 in the communication apparatus 800 may correspond to the processor 910 in the communication device 900 shown in FIG. 9.

[0374] It should be further understood that if the communication device 800 is a chip, the chip includes a transceiver unit and a processing unit. The transceiver unit may be an input / output circuit or a communication interface. The processing unit may be a processor, a microprocessor, or an integrated circuit integrated on the chip.

[0375] The transceiver unit 810 is configured to implement signal reception and transmission operations of the communications device 800, and the processing unit 820 is configured to implement signal processing operations of the communications device 800.

[0376] Optionally, the communication device 800 further includes a storage unit 830, which is configured to store instructions.

[0377] 9 is a schematic block diagram of a communication device 900 according to one embodiment of the present application. As shown in the figure, the communication device 900 includes at least one processor 910 and a transceiver 920. The processor 910 is coupled to a memory and configured to execute instructions stored in the memory and control the transceiver 920 to send and / or receive signals. Optionally, the communication device 900 further includes a memory 930 configured to store instructions.

[0378] It should be understood that the processor 910 and the memory 930 may be integrated into one processing unit, and the processor 910 is configured to execute program code stored in the memory 930 to implement the functions described above. During a particular implementation, the memory 930 may alternatively be integrated into the processor 910 or may be separate from the processor 910.

[0379] It should be further understood that the transceiver 920 may include a receiver (or referred to as a receiver) and a transmitter (or referred to as a transmitter). The transceiver 920 may further include an antenna. There may be one or more antennas. The transceiver 920 may be a communication interface or interface circuit.

[0380] When the communication device 900 is a chip, the chip includes a transceiver unit and a processing unit. The transceiver unit may be an input / output circuit or a communication interface. The processing unit may be a processor, a microprocessor, or an integrated circuit integrated on the chip. An embodiment of the present application further provides a processing device including a processor and an interface. The processor may be configured to perform the method in the above-mentioned method embodiment.

[0381] It should be understood that the processing device may be a chip. For example, the processing device may be a field programmable gate array (FPGA), an application-specific integrated circuit (ASIC), a system on chip (SoC), a central processing unit (CPU), a network processor (NP), a digital signal processor (DSP), a microcontroller unit (MCU), a programmable logic device (PLD), or another integrated chip.

[0382] During implementation, the steps in the aforementioned method can be implemented by using hardware integrated logic circuits in a processor or by using instructions in the form of software. The steps in the method disclosed with reference to the embodiments of the present application can be performed and completed directly by using a hardware processor, or can be performed and completed by using a combination of hardware modules and software modules in a processor. The software modules can be located in a storage medium mature in the technical field, such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, an electrically erasable programmable memory, or a register. The storage medium is located in the memory, and the processor reads the information in the memory and completes the steps in the aforementioned method in combination with the hardware of the processor. In order to avoid repetition, the details will not be described again here.

[0383] It should be noted that the processor in the embodiments of the present application may be an integrated circuit chip and have signal processing capabilities. During implementation, the steps in the above method embodiments can be implemented by using hardware integrated logic circuits in the processor or by using instructions in the form of software. The processor may be a general-purpose processor, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or another programmable logic device, a discrete gate or transistor logic device, or a discrete hardware component. The processor may implement or perform the methods, steps, and logic block diagrams disclosed in the embodiments of the present application. The general-purpose processor may be a microprocessor, or the processor may be any conventional processor, etc. The steps in the methods disclosed with reference to the embodiments of the present application may be performed and completed directly by using a hardware decode processor, or may be performed and completed by using a combination of hardware modules and software modules in the decode processor. The software module may be located in a storage medium matured in the art, such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, an electrically erasable programmable memory, or a register, etc. The storage medium is located in the memory, and the processor reads the information in the memory and completes the steps in the above-mentioned method in combination with the hardware of the processor.

[0384] It can be understood that the memory in the embodiments of the present application may be volatile or non-volatile memory, or may include both volatile and non-volatile memory. The non-volatile memory may be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. The volatile memory may be random access memory (RAM) used as an external cache. By way of example and not limitation, many types of RAM may be used, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), and direct rambus dynamic random access memory (DR RAM). It should be noted that the memory of the systems and methods described herein include, but are not limited to, these and any other suitable types of memory.

[0385] According to the method provided in the embodiment of the present application, the present application further provides a computer program product. The computer program product includes a computer program code. When the computer program code is executed on a computer, the computer is enabled to perform the method in any one of the embodiments shown in Figure 2 to Figure 7 (a) and Figure 7 (b).

[0386] According to the method provided in the embodiment of the present application, the present application further provides a computer-readable medium. The computer-readable medium stores a program code. When the program code is executed on a computer, the computer is enabled to perform the method in any one of the embodiments shown in Figure 2 to Figure 7 (a) and Figure 7 (b).

[0387] According to a method provided in an embodiment of the present application, the present application further provides a system including the above-mentioned session management network element, a terminal device, and an access and mobility management function network element.

[0388] All or part of the above-mentioned embodiments may be implemented by software, hardware, firmware, or any combination thereof. When software is used to implement the embodiments, all or part of the embodiments may be implemented in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer instructions are loaded and executed on a computer, the procedures or functions according to the embodiments of the present application are generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium or transmitted from a computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from a website, computer, server, or data center to another website, computer, server, or data center by wired (e.g., coaxial cable, fiber optic, or digital subscriber line (DSL)) or wireless (e.g., infrared, radio, or microwave) methods. The computer-readable storage medium may be any available medium accessible by a computer, or a data storage device, such as a server or a data center that integrates one or more available media. The available media may be magnetic media (e.g., floppy disks, hard disk drives, or magnetic tapes), optical media (e.g., digital video discs (DVDs)), semiconductor media (e.g., solid-state discs (SSDs)), etc.

[0389] The network side device and the terminal device in the above apparatus embodiments correspond to the network side device or the terminal device in the method embodiments. The corresponding module or unit performs the corresponding step. For example, a communication unit (transmitter / receiver) performs the receiving step or the transmitting step in the method embodiments, and steps other than the transmitting step or the receiving step may be performed by a processing unit (processor). For the functions of specific units, please refer to the corresponding method embodiments. There may be one or more processors.

[0390] As used herein, terms such as "component," "module," and "system" are used to indicate computer-related entities, hardware, firmware, a combination of hardware and software, software, or software in execution. For example, a component may be, but is not limited to, a process running on a processor, a processor, an object, an executable file, a thread of execution, a program, and / or a computer. As illustrated by the use of figures, both computing devices and applications running on computing devices may be components. One or more components may reside within a process and / or thread of execution, and components may be located on one computer and / or distributed among two or more computers. Also, these components may execute from various computer-readable media that store various data structures. For example, components may communicate by using local and / or remote processing, e.g., based on signals having one or more data packets (e.g., data from two components interacting with another component in a local system, a distributed system, and / or over a network such as the Internet that interacts with other systems by using signals).

[0391] Those skilled in the art may recognize that the units and algorithm steps in the examples described with reference to the embodiments disclosed herein may be implemented by electronic hardware, or a combination of computer software and electronic hardware. Whether a function is performed by hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art may use different methods to implement the described functions for each specific application, but the implementation should not be considered to go beyond the scope of this application.

[0392] For the purpose of convenient and simple description, it can be clearly understood by those skilled in the art that for the detailed operation processes of the above-mentioned systems, devices and units, please refer to the corresponding processes in the above-mentioned method embodiments, and the details will not be described again here.

[0393] In some embodiments provided in the present application, it should be understood that the disclosed system, device, and method may be implemented in other ways. For example, the described device embodiment is only an example. For example, the unit division is only a logical functional division. During actual implementation, other division methods may be used. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not implemented. In addition, the shown or discussed mutual couplings or direct couplings or communication connections may be implemented through some interfaces. Indirect couplings or communication connections between devices or units may be implemented in electronic, mechanical, or other forms.

[0394] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, may be located in one location, or may be distributed across multiple network units. Some or all of the units may be selected based on the actual requirements to achieve the objectives of the solutions of the embodiments.

[0395] Furthermore, the functional units in the embodiments of the present application may be integrated into one processing unit, and each of the units may exist physically independently, or two or more units may be integrated into one unit.

[0396] When the function is implemented in the form of a software functional unit and sold or used as an independent product, the function may be stored in a computer-readable storage medium. Based on such understanding, the technical solution of the present application may be substantially or in part contributing to the current technology, or some of the technical solutions may be implemented in the form of a software product. The computer software product is stored in a storage medium and includes some instructions for instructing a computer device (which may be a personal computer, a server, or a network device) to perform all or part of the steps in the method described in the embodiments of the present application. The aforementioned storage medium includes any medium that can store program code, such as a USB flash drive, a removable hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, etc.

[0397] The above description is merely a specific implementation of the present application, and is not intended to limit the scope of protection of the present application. Any variation or replacement that is easily conceived by a person skilled in the art within the technical scope disclosed in the present application should fall within the scope of protection of the present application. Therefore, the scope of protection of the present application should be subject to the scope of protection of the claims.

Claims

1. 1. A communication method comprising: obtaining, by a session management function network element, a first indication information in a process of establishing a session in a first network for a terminal device, the first indication information indicating that user plane integrity protection in a second network is supported; sending a first request message by the session management function network element to an access and mobility management function network element in the first network based on the first indication information, the first request message being used to request allocation of a bearer identifier for the session, the bearer identifier corresponding to a bearer context of the terminal device in the second network; receiving, by the session management function network element, a first response message from the access and mobility management function network element, the first response message including the bearer identifier; A communication method comprising:

2. The method comprises: mapping, by the Session Management Function network element, a user plane security policy of the terminal device in the first network to a user plane security policy of the terminal device in the second network; storing, by the Session Management Function network element, the user plane security policy in the second network in the bearer context; The method of claim 1 further comprising:

3. The method comprises: obtaining, by the session management function network element, third indication information, the third indication information indicating performing user plane security policy mapping; Further comprising: The step of mapping, by the Session Management Function network element, a user plane security policy of the terminal device in the first network to a user plane security policy of the terminal device in the second network, comprises: mapping, by the Session Management Function network element, the user plane security policy of the terminal device in the first network to the user plane security policy of the terminal device in the second network based on the third indication information.

3. The method of claim 2 comprising:

4. The method comprises: sending the bearer context by the session management function network element via the access and mobility management function network element to a target mobility management entity in the second network, the target mobility management entity being a network element serving the terminal device when the session is handed over to the second network; The method of claim 2 or 3, further comprising:

5. The step of sending a first request message by the session management function network element to an access and mobility management function network element in the first network based on the first indication information includes: sending, by the session management function network element, the first request message to the access and mobility management function network element based on the first indication information without taking into account a user plane security policy of the terminal device in the first network; 5. The method according to claim 1 , comprising:

6. The method comprises: sending, by the session management function network element, a fully qualified domain name of the session management function network element over an S5 / S8 interface based on the first indication information to an integrated data management network element without taking into account a user plane security policy of the terminal device in the first network. The method of any one of claims 1 to 5, further comprising:

7. The method of claim 5 or 6, wherein the user plane security policy of the terminal device in the first network includes activating user plane integrity protection.

8. The step of obtaining, by a session management function network element, a first indication information, comprises: receiving, by the session management function network element, the first indication information from the access and mobility management function network element; 8. The method of claim 1 , comprising:

9. The method of claim 8 , wherein the first indication information is included in a Protocol Data Unit Session Management Context Establishment Request message.

10. The step of obtaining, by a session management function network element, a first indication information, comprises: receiving, by the session management function network element, the first indication information from the terminal device via the access and mobility management function network element; 10. The method of claim 1, comprising:

11. 11. The method according to claim 1, wherein the first network is a fifth generation communication system network, the second network is an evolved packet system network, and the bearer context is an evolved packet system bearer context.

12. 1. A communication method comprising: receiving, by an access and mobility management function network element in a first network, a registration request message from a terminal device, the registration request message including second indication information, the second indication information indicating that the terminal device supports user plane integrity protection in a second network; In a process of establishing a session in the first network for the terminal device, sending first indication information by the access and mobility management function network element to a session management function network element based on the second indication information, the first indication information indicating that the user plane integrity protection in the second network is supported; receiving, by the access and mobility management function network element, a first request message, the first request message being used to request allocation of a bearer identifier for the session, the bearer identifier corresponding to a bearer context of the terminal device in the second network; sending a first response message by the access and mobility management function network element to the session management function network element, the first response message including the bearer identifier; A communication method comprising:

13. The method comprises: sending a second request message by the Access and Mobility Management Function network element to the Session Management Function network element; receiving, by the access and mobility management function network element, a second response message from the session management function network element, the second response message including the bearer context, the bearer context including a user plane security policy of the terminal device in the second network, the user plane security policy in the second network being obtained according to the user plane security policy of the terminal device in the first network; sending the bearer context by the access and mobility management function network element to a target mobility management entity in the second network, the target mobility management entity being a network element serving the terminal device when the session is handed over to the second network; The method of claim 12 further comprising:

14. The second request message includes third indication information, and the third indication information indicates that user plane security policy mapping is to be performed; The method comprises: determining, by the access and mobility management function network element, to add the third indication information to the second request message according to a second local policy; Further comprising:

14. The method of claim 13, wherein the second local policy includes one or more of whether the session supports interworking with the second network and whether the target mobility management entity supports user plane integrity protection, the target mobility management entity being a network element serving the terminal device when the session is handed over to the second network.

15. the granularity of the user plane security policy in the first network is a protocol data unit session granularity; The granularity of the user plane security policy in the second network is that of an evolved packet system bearer.

15. The method according to claim 13 or 14.

16. The method comprises: determining, by the access and mobility management function network element, to send the first indication information to the session management function network element according to a first local policy, the first local policy including whether the session supports interworking with the second network; 16. The method of any one of claims 12 to 15, further comprising:

17. 17. The method of any one of claims 12 to 16, wherein the first network is a fifth generation communication system network, the second network is an evolved packet system network, and the bearer context is an evolved packet system bearer context.

18. A communication device comprising a transceiver unit, The transceiver unit is configured to obtain first indication information in a process of establishing a session in a first network for a terminal device, the first indication information indicating that user plane integrity protection in a second network is supported; The transceiver unit is further configured to send a first request message to an access and mobility management function network element in the first network based on the first indication information, the first request message being used to request allocation of a bearer identifier for the session, the bearer identifier corresponding to a bearer context of the terminal device in the second network; The communications device, wherein the transceiver unit is further configured to receive a first response message from the access and mobility management function network element, the first response message including the bearer identifier.

19. The communication device further comprises a processing unit, The processing unit is configured to map a user plane security policy of the terminal device in the first network to a user plane security policy of the terminal device in the second network; The communications device of claim 18 , wherein the processing unit is further configured to store the user plane security policy in the second network in the bearer context.

20. The transceiver unit is further configured to obtain third indication information, the third indication information indicating performing user plane security policy mapping; 20. The communication device of claim 19, wherein the processing unit is particularly configured to map the user plane security policy of the terminal device in the first network to the user plane security policy of the terminal device in the second network based on the third indication information.

21. 21. The communication apparatus according to claim 19 or 20, wherein the transceiver unit is further configured to send the bearer context via the access and mobility management function network element to a target mobility management entity in the second network, the target mobility management entity being a network element serving the terminal device when the session is handed over to the second network.

22. 22. The communication device according to any one of claims 18 to 21, wherein the transceiver unit is specifically configured to send the first request message to the Access and Mobility Management Function network element based on the first indication information without taking into account a user plane security policy of the terminal device in the first network.

23. 23. The communication device according to any one of claims 18 to 22, wherein the transceiver unit is further configured to send a fully qualified domain name of the communication device over an S5 / S8 interface to an integrated data management network element based on the first indication information without taking into account a user plane security policy of the terminal device in the first network.

24. 24. The communications apparatus of claim 22 or 23, wherein a user plane security policy of the terminal device in the first network includes activating user plane integrity protection.

25. 25. The communication device according to any one of claims 18 to 24, wherein the transceiver unit is specifically configured to receive the first indication information from the Access and Mobility Management Function network element.

26. 26. The communication device according to any one of claims 18 to 25, wherein the transceiver unit is specifically configured to receive the first indication information from the terminal device via the Access and Mobility Management Function network element.

27. 27. The communication device of claim 26, wherein the first indication information is included in a protocol data unit session establishment request message.

28. 28. The communication device of claim 18, wherein the first network is a fifth generation communication system network, the second network is an evolved packet system network, and the bearer context is an evolved packet system bearer context.

29. A communication device comprising a transceiver unit, The transceiver unit is configured to receive a registration request message from a terminal device in a first network, the registration request message including second indication information, the second indication information indicating that the terminal device supports user plane integrity protection in a second network; The transceiver unit is further configured to send first indication information to a session management function network element based on the second indication information in a process of establishing a session in the first network for the terminal device, the first indication information indicating that the user plane integrity protection in the second network is supported; The transceiver unit is further configured to receive a first request message, the first request message being used to request allocation of a bearer identifier for the session, the bearer identifier corresponding to a bearer context of the terminal device in the second network; The communications device, wherein the transceiver unit is further configured to send a first response message to the Session Management Function network element, the first response message including the bearer identifier.

30. The transceiver unit is further configured to send a second request message to the Session Management Function network element; The transceiver unit is further configured to receive a second response message from the Session Management Function network element, the second response message including the bearer context, the bearer context including a user plane security policy of the terminal device in the second network, the user plane security policy in the second network being obtained according to the user plane security policy of the terminal device in the first network; 30. The communications apparatus of claim 29, wherein the transceiver unit is further configured to send the bearer context to a target mobility management entity in the second network, the target mobility management entity being a network element serving the terminal device when the session is handed over to the second network.

31. The second request message includes third indication information, and the third indication information indicates that user plane security policy mapping is to be performed; The communication device further comprises a processing unit; The processing unit is configured to determine, according to a second local policy, to add the third indication information to the second request message; 31. The communications apparatus of claim 30, wherein the second local policy includes one or more of whether the session supports interworking with the second network and whether the target mobility management entity supports user plane integrity protection, the target mobility management entity being a network element serving the terminal device if the session is handed over to the second network.

32. the granularity of the user plane security policy in the first network is a protocol data unit session granularity; The granularity of the user plane security policy in the second network is that of an evolved packet system bearer.

32. A communication device according to claim 30 or 31.

33. The communication device further comprises a processing unit; 33. The communication device of claim 29, wherein the processing unit is configured to determine to send the first indication information to the Session Management Function network element according to a local policy, the local policy including whether the session supports interworking with the second network.

34. 34. The communication device of claim 29, wherein the first network is a fifth generation communication system network, the second network is an evolved packet system network, and the bearer context is an evolved packet system bearer context.

35. 1. A communications device, comprising: a memory configured to store a computer program; and a transceiver configured to perform the sending and receiving steps; A processor configured to call the computer program from the memory and to execute the computer program to enable the communication device to perform a method according to any one of claims 1 to 11.

36. A communications device comprising: a memory configured to store a computer program; and a transceiver configured to perform the sending and receiving steps; A processor configured to call the computer program from the memory and to execute the computer program to enable the communications device to perform a method according to any one of claims 12 to 17.

37. 12. A computer readable storage medium, the computer readable storage medium storing a computer program, the computer program being enabled, when executed on a computer, to perform the method according to any one of claims 1 to 11.

38. A computer-readable storage medium, the computer-readable storage medium storing a computer program, the computer program enabling the computer, when executed on a computer, to perform a method according to any one of claims 12 to 17.

39. A communication method comprising a method according to any one of claims 1 to 11 and a method according to any one of claims 12 to 17.

40. The method according to claim 1, sending, by the terminal device, second indication information to an access and mobility management function network element in a first network, the second indication information indicating that the terminal device supports user plane integrity protection in a second network; receiving, by the terminal device, a radio resource control reconfiguration sent by an access network device in the second network, the radio resource control reconfiguration including an indication information for activating user plane integrity protection; 40. The method of claim 39, further comprising:

41. A communications system comprising a session management function network element configured to implement a method according to any one of claims 1 to 11, and an access and mobility management function network element configured to implement a method according to any one of claims 12 to 17.

42. The system comprising: Sending second indication information to an access and mobility management function network element in a first network, the second indication information indicating that the terminal device supports user plane integrity protection in a second network; and receiving a radio resource control reconfiguration sent by an access network device in the second network, the radio resource control reconfiguration including indication information for activating user plane integrity protection; 42. The system of claim 41, further comprising a terminal device configured to:

Images