Method for establishing a secure transmission channel, key determination method and communication device

Abstract

The present application provides a method for establishing a secure transmission channel, a key determination method and a communication device. The method is applied to a user plane entity of a donor node central unit, and the method includes: receiving a first message from a control plane entity of the donor node central unit, the first message including a first key, the first key being different from a root key, the root key being a key obtained by the control plane entity of the donor node central unit from a network in a procedure in which the integrated access and backhaul node registers with the network; and establishing a user plane secure transmission channel between the user plane entity of the donor node central unit and a distributed unit of the integrated access and backhaul node based on the first key. According to the present application, the user plane entity of the donor node central unit can establish a user plane secure transmission channel between the user plane entity of the donor node central unit and a distributed unit of the integrated access and backhaul node based on the first key.

Description

[Technical Field]

[0001] Book The present application relates to an integrated access and backhaul network, and in particular to a method for establishing a secure transmission channel, a key determination method, and a communication device. [Background technology]

[0002] To meet the ultra-high capacity requirements of 5th generation (5G) mobile communication systems, high-frequency small cell networking will become mainstream. High-frequency carriers have poor propagation characteristics, severe blocking attenuation, and narrow coverage, necessitating the dense deployment of a large number of small cells. Integrated access and backhaul (IAB) technology offers a solution to the aforementioned problems. To avoid the deployment of optical fiber, wireless transmission solutions are used in both the access link and backhaul link in an IAB network.

[0003] As shown in Figures 3 and 4, an F1 interface needs to be established between the IAB node and the donor node. To secure the F1 interface, an internet protocol (IP) security (IPsec) secure connection can be established between the IAB node and the IAB donor.

[0004] In the case of an architecture with separation between the control plane and user plane of the IAB donor central unit, how to establish IPsec secure connections between the distributed units of the IAB node and the user plane entities of the IAB donor central unit becomes an urgent problem to solve. Summary of the Invention [Problem to be solved by the invention]

[0005] The present application provides a method for establishing a secure transmission channel for establishing a user plane secure transmission channel between a donor centralized unit user plane entity (donor-CU-UP) and an IAB-distributed unit (IAB-DU). [Means for solving the problem]

[0006] According to a first aspect, there is provided a method for establishing a secure transmission channel, the method being applied to a donor CU-UP, the method including: receiving a first message from a donor centralized unit control plane entity (donor-CU-CP), the first message including a first key, the first key being different from a root key, the root key being a key obtained by the donor CU-CP from a network during a procedure in which an IAB node registers with the network; and establishing a user plane secure transmission channel between the donor CU-UP and the IAB-DU based on the first key.

[0007] For example, in the procedure of establishing a user plane secure transmission channel by the donor CU-UP and IAB-DU, the first key is the authentication credential used by the donor CU-UP and IAB-DU.

[0008] For example, the first key is K IAB and the root key is K gNB is.

[0009] Based on the aforementioned technical solution, the first message received by the donor CU-UP from the donor CU-CP includes a first key, which helps the donor CU-UP establish a user plane secure transmission channel between the donor CU-UP and the IAB-DU based on the first key, and helps the donor CU-UP and the IAB-DU avoid the problem of authentication errors generated when establishing the user plane secure transmission channel.

[0010] For example, the first message is a bearer context setup request message. For example, in a procedure in which a terminal device accesses a network via an IAB-DU, a donor CU-CP sends a bearer context setup request message to a donor CU-UP, and the bearer context setup request message includes the first key.

[0011] In another example, the first message is a modify bearer context request message. For example, in a procedure in which a terminal device accesses a network via an IAB-DU, a donor CU-CP sends a modify bearer context request message to a donor CU-UP, and the modify bearer context request message includes the first key.

[0012] In relation to the first aspect, in some implementations of the first aspect, the first message further includes a first IP address of the donor CU-UP, and the method further includes: determining to establish a user plane secure transmission channel by using the first IP address of the donor CU-UP; and determining a first key based on the first IP address.

[0013] Optionally, the first message further includes the IP address of the IAB-DU.

[0014] In relation to the first aspect, in some implementations of the first aspect, the first message includes a one-to-one correspondence between a plurality of Internet Protocol (IP) addresses of the donor CU-UP and a plurality of keys, the plurality of keys including a first key, the first key corresponding to the first IP address; the method further includes: determining to establish a user plane secure transmission channel by using the first IP address of the donor CU-UP; and determining the first key based on the first IP address.

[0015] Specifically, the donor CU-UP determines a key corresponding to the first IP address and included in the first message as a first key.

[0016] Based on the above technical solution, when the donor CU-UP has multiple IP addresses, the donor CU-UP can receive keys corresponding to the multiple IP addresses to help the donor CU-UP establish different user plane secure transmission channels between the donor CU-UP and the IAB-DU based on the multiple keys and the multiple IP addresses.

[0017] For example, the first message is a bearer context setup request message. For example, in a procedure in which an IAB node's mobile termination (IAB-MT) accesses a network through a donor node's distributed unit (donor-DU), the donor CU-CP sends a bearer context setup request message to the donor CU-UP, and the bearer context setup request message includes a one-to-one correspondence between multiple IP addresses of the donor CU-UP and multiple keys. It should be understood that the donor DU, donor CU-UP, and donor CU-CP belong to the same donor node, and the IAB-DU and IAB-MT belong to the same IAB node.

[0018] Optionally, the first message further includes an IP address of the IAB-DU, and all of the plurality of keys correspond to the IP addresses of the IAB-DU, in other words, each of the plurality of keys corresponds to one IP address of the donor CU-UP and the IP address of the IAB-DU.

[0019] In relation to the first aspect, in some implementations of the first aspect, the method further includes: receiving first instruction information from the donor CU-CP; and sending multiple IP addresses of the donor CU-UP to the donor CU-CP based on the first instruction information.

[0020] For example, the first indication information indicates that the IAB-DU belongs to the IAB node.

[0021] In relation to the first aspect, in some implementations of the first aspect, the method further includes: storing a correspondence between the first key and the IP address of the IAB-DU.

[0022] For example, the donor CU-UP stores the correspondence between the first key and the IP address of the IAB-DU in the context of the donor CU-UP.

[0023] In relation to the first aspect, in some implementations of the first aspect, the first message further includes the first indication information, and the first indication information indicates that the IAB-DU belongs to the IAB node.

[0024] Based on the aforementioned technical solution, the donor CU-UP determines that the IAB-DU belongs to the IAB node based on the first indication information, so that the first key included in the first message can be received and stored on demand.

[0025] According to a second aspect, there is provided a method for establishing a secure transmission channel, the method being applied to an IAB-DU, the method including the steps of: receiving a second message from a donor CU-CP, the second message including a first IP address of the donor CU-UP; sending a first request message to an IAB-MT, the first request message requesting a first key, the first key being different from a root key, the root key being a key generated by the IAB-MT in a procedure for registering with the network, the first request message including the first IP address; receiving a first response message from the IAB-MT, the first response message including the first key; and establishing a user plane secure transmission channel between the IAB-DU and the donor CU-UP based on the first key.

[0026] For example, in the procedure of establishing a user plane secure transmission channel by the donor CU-UP and IAB-DU, the first key is the authentication credential used by the donor CU-UP and IAB-DU.

[0027] For example, the first key is K IAB and the root key is K gNB is.

[0028] Based on the above technical solution, upon receiving the first IP address of the donor CU-UP, the IAB-DU sends the first IP address of the donor CU-UP to the IAB-MT via a first request message, so that the IAB-MT can determine a first key based on the first IP address of the donor CU-UP and send the first key to the IAB-DU. After the IAB-DU receives the first key, this helps the IAB-DU to establish a user plane secure transmission channel between the IAB-DU and the donor CU-UP based on the first key, thereby helping to avoid the problem of authentication errors generated when the donor CU-UP and the IAB-DU establish the user plane secure transmission channel.

[0029] In relation to the second aspect, in some implementations of the second aspect, before the step of sending the first request message to the IAB-MT, the method further includes a step of receiving a user plane data request message from the terminal device, wherein the user plane secure transmission channel is for transmission of user plane data of the terminal device.

[0030] Based on the aforementioned technical solution, the IAB-DU can request the first key from the IAB-MT on demand based on a user plane data request message.

[0031] In relation to the second aspect, in some implementations of the second aspect, before the step of sending the first request message to the IAB-MT, the method further includes a step of receiving an authentication request message from the donor CU-UP, wherein the authentication request message is for establishing a user plane secure transmission channel.

[0032] Based on the aforementioned technical solution, the IAB-DU can request the first key from the IAB-MT on demand based on the authentication request message.

[0033] In relation to the second aspect, in some implementations of the second aspect, the method further includes: storing a correspondence between the first key and the first IP address of the donor CU-UP.

[0034] For example, the IAB-DU stores the correspondence between the first key and the first IP address of the donor CU-UP in the context of the IAB-DU.

[0035] According to a third aspect, there is provided a method for establishing a secure transmission channel, the method is applied to an IAB-DU, the method including: a step of receiving a second message from a donor CU-CP, the second message including a first IP address of the donor CU-UP; a step of sending a second request message to an IAB-MT, the second request message requesting a root key, the root key being for generating a first key, the first key being different from the root key, the root key being a key generated by the IAB-MT in a procedure of registering with the network; a step of receiving a second response message from the IAB-MT, the second response message including the root key; and a step of deriving the first key based on the root key, the IP address of the IAB-DU, and the first IP address; and a step of establishing a user plane secure transmission channel between the IAB-DU and the donor CU-UP based on the first key.

[0036] For example, the IAB-DU derives the first key by using the root key as the input key and by using the IP address of the IAB-DU and the first IP address as input parameters.

[0037] For example, in the procedure of establishing a user plane secure transmission channel by the donor CU-UP and IAB-DU, the first key is the authentication credential used by the donor CU-UP and IAB-DU.

[0038] For example, the first key is K IAB and the root key is K gNB is.

[0039] Based on the aforementioned technical solution, when receiving the first IP address of the donor CU-UP, the IAB-DU may obtain from the IAB-MT a root key for generating a first key, and determine the first key based on the first IP address of the donor CU-UP, the root key, and the IP address of the IAB-DU, thereby helping the IAB-DU to establish a user plane secure transmission channel between the IAB-DU and the donor CU-UP based on the first key, and helping to avoid the problem of authentication errors generated when the donor CU-UP and the IAB-DU establish a user plane secure transmission channel.

[0040] In relation to the third aspect, in some implementations of the third aspect, before the step of sending the second request message to the IAB-MT, the method further includes the step of: receiving a user plane data request message from the terminal device, wherein the user plane secure transmission channel is for transmission of user plane data of the terminal device.

[0041] Based on the aforementioned technical solution, the IAB-DU can request the root key of the donor node from the IAB-MT on demand based on the user plane data request message.

[0042] In relation to the third aspect, in some implementations of the third aspect, before the step of sending the second request message to the IAB-MT, the method further includes the step of: receiving an authentication request message from the donor CU-UP, wherein the authentication request message is for establishing a user plane secure transmission channel.

[0043] Based on the aforementioned technical solution, the IAB-DU can request the root key of the donor node from the IAB-MT on demand based on the authentication request message.

[0044] In relation to the third aspect, in some implementations of the third aspect, the method further includes: storing a correspondence between the first key and the first IP address of the donor CU-UP.

[0045] For example, the IAB-DU stores the correspondence between the first key and the first IP address of the donor CU-UP in the context of the IAB-DU.

[0046] According to a fourth aspect, there is provided a key determination method, which is applied to a donor CU-CP, and which includes: a step of deriving a first key based on a root key, an IP address of an IAB-DU, and a first IP address of a donor CU-UP, where the first key is different from the root key, and the root key is a key obtained by the donor CU-CP from the network in a procedure in which an integrated access and backhaul node registers with the network; and a step of sending a first message to the donor CU-UP, where the first message includes the first key.

[0047] For example, the IAB-DU derives the first key by using the root key as the input key and by using the IP address of the IAB-DU and the first IP address as input parameters.

[0048] The first key is K IAB and the root key is K gNB is.

[0049] Based on the aforementioned technical solution, the donor CU-CP derives a first key based on the root key, the IP address of the IAB-DU, and the first IP address of the donor CU-UP, and sends the first key to the donor CU-UP through a first message to help the donor CU-UP establish a user plane secure transmission channel between the donor CU-UP and the IAB-DU based on the first key, and help the donor CU-UP and the IAB-DU avoid the problem of authentication errors generated when establishing the user plane secure transmission channel.

[0050] For example, the first message is a bearer context setup request message. For example, in a procedure in which a terminal device accesses a network via an IAB-DU, a donor CU-CP sends a bearer context setup request message to a donor CU-UP, and the bearer context setup request message includes the first key.

[0051] In another example, the first message is a modify bearer context request message. For example, in a procedure in which a terminal device accesses a network via an IAB-DU, a donor CU-CP sends a modify bearer context request message to a donor CU-UP, and the modify bearer context request message includes the first key.

[0052] Optionally, the first message further includes a first IP address of the donor CU-UP.

[0053] Optionally, the first message further includes the IP address of the IAB-DU.

[0054] In relation to the fourth aspect, in some implementations of the fourth aspect, the method further includes: sending first instruction information to the donor CU-UP; and receiving one or more IP addresses from the donor CU-UP, wherein the one or more IP addresses include the first IP address.

[0055] For example, the first indication information indicates that the IAB-DU belongs to the IAB node.

[0056] In relation to the fourth aspect, in some implementations of the fourth aspect, when the one or more IP addresses further include a second IP address, the method further includes: deriving a second key based on the root key, the IP address of the IAB-DU, and the second IP address, wherein the first message includes a correspondence between the first key and the first IP address and a correspondence between the second key and the second IP address.

[0057] Based on the above technical solution, when the donor CU-UP has multiple IP addresses, the donor CU-UP can send the multiple IP addresses to the donor CU-CP according to the first indication information, so that the donor CU-UP can receive keys corresponding to the multiple IP addresses and help the donor CU-UP establish different user plane secure transmission channels between the donor CU-UP and the IAB-DU according to the multiple keys and the multiple IP addresses.

[0058] For example, the first message is a bearer context setup request message. For example, in a procedure in which an IAB-MT accesses a network through a donor DU, the donor CU-CP sends a bearer context setup request message to the donor CU-UP, and the bearer context setup request message includes a one-to-one correspondence between multiple IP addresses of the donor CU-UP and multiple keys. It should be understood that the donor DU, donor CU-UP, and donor CU-CP belong to the same donor node, and the IAB-DU and IAB-MT belong to the same IAB node.

[0059] In relation to the fourth aspect, in some implementations of the fourth aspect, the method further includes: deriving a third key based on the root key, the IP address of the IAB-DU, and the IP address of the donor CU-CP; and establishing a control plane secure transmission channel between the donor CU-CP and the IAB-DU based on the third key.

[0060] For example, the donor CU-CP derives the third key by using the root key as the input key and the IP address of the IAB-DU and the IP address of the donor CU-CP as input parameters.

[0061] Based on the aforementioned technical solution, the donor CU-CP can further derive a third key for establishing a control plane secure transmission channel between the donor CU-CP and the IAB-DU, thereby effectively avoiding the problem of authentication errors generated when the donor CU-CP and the IAB-DU establish a control plane secure transmission channel.

[0062] In relation to the fourth aspect, in some implementations of the fourth aspect, the method further includes: determining that the IAB-DU belongs to the IAB node based on the first identifier in the context of the IAB-DU.

[0063] Based on the foregoing technical solution, the donor CU-CP can derive a first key on demand based on the first identifier.

[0064] In relation to the fourth aspect, in some implementations of the fourth aspect, the method further includes: a step of sending first instruction information to the donor CU-UP, wherein the first instruction information indicates that the IAB-DU belongs to the IAB node.

[0065] Based on the above technical solution, the donor CU-CP sends first instruction information to the donor CU-UP, so that the donor CU-UP can receive and store the first key on demand based on the first instruction information.

[0066] According to a fifth aspect, there is provided a method for establishing a secure transmission channel, the method including: a donor CU-UP receives first information from a donor CU-CP; the donor CU-UP determines a first key based on the first information, the first key being different from a root key, the root key being a key obtained by the donor CU-CP from the network in a procedure in which the IAB node registers with the network; and the donor CU-UP sets up a user plane secure transmission channel between the donor CU-UP and the IAB node based on the first key.

[0067] For example, in the procedure of establishing a user plane secure transmission channel by the donor CU-UP and IAB-DU, the first key is the authentication credential used by the donor CU-UP and IAB-DU.

[0068] For example, the first key is K IAB and the root key is K gNB is.

[0069] Based on the aforementioned technical solution, the donor CU-UP determines a first key based on the received first information, to help the donor CU-UP and IAB-DU establish a user plane secure transmission channel based on the first key, and help the donor CU-UP and IAB-DU avoid the problem of authentication errors generated when establishing the user plane secure transmission channel.

[0070] For example, the first information is carried in a Modify Bearer Context Request message. For example, in a procedure in which an IAB-MT accesses a network through a donor DU, a donor CU-CP sends a Modify Bearer Context Request message to a donor CU-UP, and the Modify Bearer Context Request message includes the first information. It should be understood that the donor DU, donor CU-UP, and donor CU-CP belong to the same donor node, and the IAB-DU and IAB-MT belong to the same IAB node.

[0071] In relation to the fifth aspect, in some implementations of the fifth aspect, the first information includes at least one of: an intermediate key or a user plane key used between the donor node and the IAB node, and the intermediate key and the user plane key are for determining the first key.

[0072] The donor node includes donor CU-CP and donor CU-UP, and the IAB node includes IAB-DU.

[0073] In some implementations of the fifth aspect, the first information includes an intermediate key, the intermediate key including one of a random number or a key determined based on a root key and a second parameter, the second parameter including one or more of a physical cell identifier, an absolute radio frequency channel number—downlink, a secondary node count, a constant, or a freshness parameter. Determining the first key based on the first information by the donor CU-UP includes: the donor CU-UP deriving the first key based on the intermediate key, the IP address of the IAB-DU, and the IP address of the donor CU-UP.

[0074] For example, the donor CU-UP derives the first key by using the intermediate key as the input key and the IP address of the IAB-DU and the IP address of the donor CU-UP as input parameters.

[0075] Based on the aforementioned technical solution, the donor CU-UP derives a first key based on the intermediate key, so that the user plane key, the signaling plane key, and the input key for deriving the first key can remain independent of each other, and data transmission security is guaranteed.

[0076]

[0013] In relation to the fifth aspect, in some implementations of the fifth aspect, the first information includes a user plane key. The donor CU-UP determining the first key based on the first information includes: the donor CU-UP deriving the first key based on the user plane key, the IP address of the IAB-DU, and the IP address of the donor CU-UP.

[0077] For example, the donor CU-UP derives the first key by using the user plane key as the input key and the IP address of the IAB-DU and the IP address of the donor CU-UP as input parameters.

[0078] Based on the aforementioned technical solution, the donor CU-UP derives the first key based on the user plane key, and no additional signaling transmission is required, simplifying the management and implementation of the first key.

[0079] In relation to the fifth aspect, in some implementations of the fifth aspect, the first information includes a user plane key. The donor CU-UP determining the first key based on the first information includes: the donor CU-UP determining a fourth key based on the user plane key; and the donor CU-UP deriving the first key based on the fourth key, the IP address of the IAB-DU, and the IP address of the donor CU-UP.

[0080] For example, donor CU-UP derives the first key by using the fourth key as the input key and by using the IP address of IAB-DU and the IP address of donor CU-UP as input parameters.

[0081] In relation to the fifth aspect, in some implementations of the fifth aspect, the method further includes: storing a correspondence between the first key and the IP address of the IAB-DU.

[0082] For example, the donor CU-UP stores the correspondence between the first key and the IP address of the IAB-DU in the context of the donor CU-UP.

[0083] In relation to the fifth aspect, in some implementations of the fifth aspect, the method includes: a donor CU-UP receiving first instruction information and determining a first key based on the first information upon receiving the first instruction information.

[0084] For example, the first indication information indicates that the IAB-DU belongs to the IAB node.

[0085] Based on the above technical solution, the donor CU-UP may determine that the IAB-DU belongs to the IAB node based on the first indication information, so that the first key can be derived on demand based on the first information.

[0086] According to a sixth aspect, there is provided a method for establishing a secure transmission channel, the method including: an IAB-DU receiving a second message from a donor CU-CP, the second message including an IP address of the donor CU-UP; the IAB-DU sending a third request message to the IAB-MT, the third request message requesting the second information; the IAB-DU receiving a third response message from the IAB-MT, the third response message including the second information; the IAB-DU determining a first key based on the second information, the first key being different from a root key, the root key being a key generated by the IAB-MT in a procedure for registering with the network; and the IAB-DU establishing a user plane secure transmission channel between the IAB-DU and the donor CU-UP based on the first key.

[0087] For example, in the procedure of establishing a user plane secure transmission channel by the donor CU-UP and IAB-DU, the first key is the authentication credential used by the donor CU-UP and IAB-DU.

[0088] For example, the first key is K IAB and the root key is K gNB is.

[0089] Based on the aforementioned technical solution, upon receiving the IP address of the donor CU-UP, the IAB-DU obtains second information from the IAB-MT, and the IAB-DU determines a first key based on the received second information to help the donor CU-UP establish a user plane secure transmission channel between the donor CU-UP and the IAB-DU based on the first key, and help the donor CU-UP and the IAB-DU avoid the problem of authentication errors generated when establishing the user plane secure transmission channel.

[0090] Related to the sixth aspect, in some implementations of the sixth aspect, the second information includes at least one of an intermediate key, a root key and a second parameter, or a user plane key used between the donor node and the IAB node, wherein the intermediate key and the user plane key are for determining the first key, and the second parameter is for determining the intermediate key, and the second parameter includes one or more of a physical cell identifier, an absolute radio frequency channel number - downlink, a secondary node count, a constant, or a freshness parameter.

[0091] The donor node includes donor CU-CP and donor CU-UP, and the IAB node includes IAB-DU.

[0092] In relation to the sixth aspect, in some implementations of the sixth aspect, the second information includes an intermediate key, and the intermediate key includes any one of a random number or a key determined based on the root key and the second parameter. The IAB-DU determining the first key based on the second information includes: the IAB-DU deriving the first key based on the intermediate key, the IP address of the IAB-DU, and the IP address of the donor CU-UP.

[0093] For example, the IAB-DU derives the first key by using the intermediate key as the input key and the IP address of the IAB-DU and the IP address of the donor CU-UP as input parameters.

[0094] Based on the aforementioned technical solution, the IAB-DU derives a first key based on the intermediate key, so that the user plane key, the signaling plane key, and the input key for deriving the first key can be kept independent of each other, and data transmission security is guaranteed.

[0095]

[0013] In relation to the sixth aspect, in some implementations of the sixth aspect, the second information includes the user plane key. The IAB-DU determining the first key based on the second information includes: the IAB-DU deriving the first key based on the user plane key, an IP address of the IAB-DU, and an IP address of the donor CU-UP.

[0096] For example, the IAB-DU derives the first key by using the user plane key as the input key and the IP address of the IAB-DU and the IP address of the donor CU-UP as input parameters.

[0097] Based on the above technical solution, the IAB-DU derives the first key based on the user plane key, and no additional signaling transmission is required, which simplifies the management and implementation of the first key.

[0098] In relation to the sixth aspect, in some implementations of the sixth aspect, the second information includes a user plane key. The IAB-DU determining the first key based on the second information includes: the IAB-DU determining a fourth key based on the user plane key; and the IAB-DU deriving the first key based on the fourth key, the IAB-DU's IP address, and the donor CU-UP's IP address.

[0099] For example, the IAB-DU derives the first key by using the fourth key as an input key and the IP address of the IAB-DU and the IP address of the donor CU-UP as input parameters.

[0100] In relation to the sixth aspect, in some implementations of the sixth aspect, before the IAB-DU sends the third request message to the IAB-MT, the method further includes: the IAB-DU receiving a user plane data request message from the terminal device, the user plane secure transmission channel being for transmission of user plane data of the terminal device.

[0101] Based on the above technical solution, the IAB-DU can request the second information from the IAB-MT on demand based on the user plane data request message.

[0102] In relation to the sixth aspect, in some implementations of the sixth aspect, before the IAB-DU sends the third request message to the IAB-MT, the method further includes: the IAB-DU receiving an authentication request message from the donor CU-UP, the authentication request message being for establishing a user plane secure transmission channel.

[0103] Based on the above technical solution, the IAB-DU can request the second information from the IAB-MT on demand based on the authentication request message.

[0104] In relation to the sixth aspect, in some implementations of the sixth aspect, the method further includes: the IAB-DU storing a correspondence between the first key and the IP address of the donor CU-UP.

[0105] For example, the IAB-DU stores the correspondence between the first key and the IP address of the donor CU-UP in the context of the IAB-DU.

[0106] According to a seventh aspect, there is provided a key determination method, the method including: an IAB-MT receiving a third request message from an IAB-DU, the third request message requesting second information, the second information being for determining a first key, the first key being different from a root key, the root key being a key generated in a procedure in which the IAB-MT registers with a network; and the IAB-MT sending a third response message to the IAB-DU, the third response message including the second information.

[0107] For example, the first key is K IAB and the root key is K gNB is.

[0108] Based on the above technical solution, the IAB-MT sends the second information to the IAB-DU based on the third request message, so that the IAB-DU can determine a first key based on the second information and help the IAB-DU establish a user plane secure transmission channel between the IAB-DU and the donor CU-UP based on the first key.

[0109] Related to the seventh aspect, in some implementations of the seventh aspect, the second information includes at least one of an intermediate key, a root key and a second parameter, or a user plane key used between the donor node and the IAB node, wherein the intermediate key and the user plane key are for determining the first key, and the second parameter is for determining the intermediate key, and the second parameter includes one or more of a physical cell identifier, an absolute radio frequency channel number - downlink, a secondary node count, a constant, or a freshness parameter.

[0110] The donor node includes donor CU-CP and donor CU-UP, and the IAB node includes IAB-DU.

[0111] In relation to the seventh aspect, in some implementations of the seventh aspect, the intermediate key includes one of a random number or a key determined based on the root key and the second parameter. The method further includes: the IAB-MT receiving a fourth message from the donor CU-CP. The fourth message includes the intermediate key or the second parameter.

[0112] For example, if the second parameters for deriving the intermediate key include a parameter unknown to the IAB-MT, the donor CU-CP sends a fourth message to the IAB-MT. Optionally, the fourth message includes the parameter unknown to the IAB-MT among the second parameters for deriving the intermediate key.

[0113] In another example, if the intermediate key is a random number, the donor CU-CP sends a fourth message to the IAB-MT, where the fourth message includes the intermediate key.

[0114] For example, the fourth message is a radio resource control (RRC) reconfiguration message sent by the donor CU-CP to the IAB-MT in a procedure in which the IAB-MT accesses the network via the donor DU. It should be understood that the donor DU and the donor CU-CP belong to the same donor node.

[0115] According to an eighth aspect, there is provided a key determination method, the method including: an IAB-MT receiving a first request message from an IAB-DU, the first request message requesting a first key, the first key being different from a root key, the root key being a key generated by the IAB-MT in a procedure for registering with the network, and the first request message including an IP address of a donor CU-UP; the IAB-MT deriving the first key based on the intermediate key, the IP address of the IAB-DU, and the IP address of the donor CU-UP; and the IAB-MT sending a first response message to the IAB-DU, the first response message including the first key.

[0116] For example, the IAB-MT derives the first key by using the intermediate key as the input key and the IP address of the IAB-DU and the IP address of the donor CU-UP as input parameters.

[0117] For example, the first key is K IAB and the root key is K gNB is.

[0118] Based on the above technical solution, the IAB-MT derives a first key based on the IP address of the donor CU-UP included in the first request message and sends the first key to the IAB-DU, so that the IAB-DU can establish a user plane secure transmission channel between the IAB-DU and the donor CU-UP based on the first key.

[0119] In addition, the IAB-MT derives the first key based on the intermediate key, so that the user plane key, the signaling plane key, and the input key for deriving the first key can remain independent of each other, and data transmission security is guaranteed.

[0120] In relation to the eighth aspect, in some implementations of the eighth aspect, the intermediate key comprises one of a random number or a key determined based on a root key and a second parameter, and the second parameter comprises one or more of a physical cell identifier, an absolute radio frequency channel number - downlink, a secondary node count, a constant, or a freshness parameter.

[0121] The donor nodes include the donor CU-CP and donor CU-UP.

[0122] In relation to the eighth aspect, in some implementations of the eighth aspect, the intermediate key includes a key determined based on the root key and the second parameter. The method includes: an IAB-MT receiving a fourth message from the donor CU-CP, the fourth message including the intermediate key or the second parameter.

[0123] For example, if the second parameters for deriving the intermediate key include parameters unknown to the IAB-MT, the donor CU-CP sends a fourth message to the IAB-MT. Optionally, the fourth message includes the intermediate key or the second parameters for deriving the intermediate key that are unknown to the IAB-MT.

[0124] For example, the fourth message is an RRC reconfiguration message sent by the donor CU-CP to the IAB-MT in the procedure in which the IAB-MT accesses the network via the donor DU. It should be understood that the donor DU and the donor CU-CP belong to the same donor node.

[0125]

[0013] In relation to the eighth aspect, in some implementations of the eighth aspect, the intermediate key includes a random number. The method further includes: the IAB-MT receiving a fourth message from the donor CU-CP. The fourth message includes the intermediate key.

[0126] According to a ninth aspect, a key determination method is provided, the method including: an IAB-MT receiving a first request message from an IAB-DU, the first request message requesting a first key, the first key being different from a root key, the root key being a key generated by the IAB-MT during a network registration procedure, and the first request message including an IP address of a donor CU-UP; the IAB-MT deriving the first key based on a user plane key, the IP address of the IAB-DU, and the IP address of the donor CU-UP, the user plane key being a user plane key used between the donor node and the IAB node; and the IAB-MT sending a first response message to the IAB-DU, the first response message including the first key.

[0127] For example, the IAB-MT derives the first key by using the user plane key as the input key and the IP address of the IAB-DU and the IP address of the donor CU-UP as input parameters.

[0128] For example, the first key is K IAB and the root key is K gNB is.

[0129] Based on the above technical solution, the IAB-MT derives a first key based on the IP address of the donor CU-UP included in the first request message and sends the first key to the IAB-DU, so that the IAB-DU can establish a user plane secure transmission channel between the IAB-DU and the donor CU-UP based on the first key.

[0130] In addition, the IAB-MT derives the first key based on the user plane key, and no additional signaling transmission is required, simplifying the management and implementation of the first key.

[0131] According to a tenth aspect, a key determination method is provided, the method including: an IAB-MT receiving a first request message from an IAB-DU, the first request message requesting a first key, the first key being different from a root key, the root key being a key generated by the IAB-MT during a network registration procedure, and the first request message including an IP address of a donor CU-UP; the IAB-MT determining a fourth key based on the user plane key, the user plane key being a user plane key used between the donor node and the IAB node; the IAB-MT deriving a first key based on the fourth key, the IP address of the IAB-DU, and the IP address of the donor CU-UP; and the IAB-MT sending a first response message to the IAB-DU, the first response message including the first key.

[0132] For example, the IAB-MT derives the first key by using the fourth key as an input key and the IP address of the IAB-DU and the IP address of the donor CU-UP as input parameters.

[0133] For example, the first key is K IAB and the root key is K gNB is.

[0134] Based on the above technical solution, the IAB-MT derives a first key based on the IP address of the donor CU-UP included in the first request message and sends the first key to the IAB-DU, so that the IAB-DU can establish a user plane secure transmission channel between the IAB-DU and the donor CU-UP based on the first key.

[0135] In addition, the IAB-MT derives the first key based on the fourth key derived from the user plane key, and no additional signaling transmission is required, simplifying the management and implementation of the first key.

[0136] According to an eleventh aspect, there is provided a key determination method, the method including: a donor CU-CP determines first information, the first information being for determining a first key, the first key being different from a root key, the root key being a key obtained by the donor CU-CP from a network in a procedure in which an IAB node registers with the network; and the donor CU-CP sends the first information to the donor CU-UP.

[0137] For example, the first key is K IAB and the root key is K gNB is.

[0138] Based on the aforementioned technical solution, the donor CU-CP sends first information to the donor CU-UP, so that the donor CU-UP determines a first key based on the received first information, and helps the donor CU-UP establish a user plane secure transmission channel between the donor CU-UP and the IAB-DU based on the first key, and helps the donor CU-UP and the IAB-DU avoid the problem of authentication errors generated when establishing the user plane secure transmission channel.

[0139] For example, the first information is carried in a Modify Bearer Context Request message. For example, in a procedure in which an IAB-MT accesses a network through a donor DU, a donor CU-CP sends a Modify Bearer Context Request message to a donor CU-UP, and the Modify Bearer Context Request message includes the first information. It should be understood that the donor DU, donor CU-UP, and donor CU-CP belong to the same donor node, and the IAB-DU and IAB-MT belong to the same IAB node.

[0140] In relation to the eleventh aspect, in some implementations of the eleventh aspect, the first information includes at least one of an intermediate key or a user plane key used between the donor node and the IAB node, and the intermediate key and the user plane key are for determining the first key.

[0141] In relation to the eleventh aspect, in some implementations of the eleventh aspect, the first information includes an intermediate key, and the intermediate key includes a key determined based on a root key and a second parameter. The donor CU-CP determining the first information includes the donor CU-CP deriving the intermediate key based on the root key and the second parameter. The second parameter includes one or more of a physical cell identifier, an absolute radio frequency channel number—downlink, a secondary node count, a constant, or a freshness parameter.

[0142] For example, the donor CU-CP derives the intermediate key by using the root key as the input key and the second parameter as the input parameter.

[0143] In relation to the eleventh aspect, in some implementations of the eleventh aspect, the method further includes: the donor CU-CP sending a fourth message to the IAB-MT, the fourth message including the intermediate key or the second parameter.

[0144] For example, if the second parameters for deriving the intermediate key include a parameter unknown to the IAB-MT, the donor CU-CP sends a fourth message to the IAB-MT. Optionally, the fourth message includes the parameter unknown to the IAB-MT among the second parameters for deriving the intermediate key.

[0145] For example, the fourth message is an RRC reconfiguration message sent by the donor CU-CP to the IAB-MT in the procedure in which the IAB-MT accesses the network via the donor DU. It should be understood that the donor DU and the donor CU-CP belong to the same donor node.

[0146]

[0046] In relation to the eleventh aspect, in some implementations of the eleventh aspect, the first information includes an intermediate key, and the intermediate key includes a random number. The donor CU-CP determining the first information includes: the donor CU-CP generating the random number.

[0147]

[0033] In relation to the eleventh aspect, in some implementations of the eleventh aspect, the method includes: the donor CU-CP sending a fourth message to the IAB-MT, the fourth message including the intermediate key.

[0148] In relation to the eleventh aspect, in some implementations of the eleventh aspect, the first information includes the user plane key. The donor CU-CP determining the first information includes: the donor CU-CP deriving the user plane key based on a root key.

[0149] In relation to the eleventh aspect, in some implementations of the eleventh aspect, the method includes: receiving, by the donor CU-CP, second indication information, the second indication information indicating that the IAB-DU belongs to the IAB node.

[0150] Based on the aforementioned technical solution, the donor CU-CP can determine the first information on demand based on the second instruction information.

[0151] For example, the donor CU-CP receives second instruction information from the IAB-MT, and the second instruction information is an "IAB instruction" information element. In a procedure in which the IAB-MT accesses the network through the donor DU, the IAB-MT sends the "IAB instruction" information element to the donor CU-UP through the donor DU.

[0152] In another example, the donor CU-CP receives second indication information from the core network element, where the second indication information is an "IAB Authorization" information element. In a procedure in which the IAB-MT accesses the network via the donor DU, after authentication between the IAB-MT and the core network is completed, an initial context setup request message sent by the AMF to the donor CU-CP includes the "IAB Authorization" information element.

[0153] With respect to the eleventh aspect, in some implementations of the eleventh aspect, the method includes: the donor CU-CP sending first instruction information to the donor CU-UP.

[0154] For example, the first indication information indicates that the IAB-DU belongs to the IAB node.

[0155] Based on the above technical solution, the donor CU-CP sends first instruction information to the donor CU-UP, so that the donor CU-UP can determine the first key based on the first information on demand.

[0156] According to a twelfth aspect, there is provided a communication device, the communication device including: a transceiver unit; a processing unit; a first message received from a donor CU-CP; the first message including a first key, the first key being different from a root key; and the root key being a key obtained by the donor CU-CP from a network in a procedure in which the IAB node registers with the network. The processing unit is configured to establish a user plane secure transmission channel between the donor CU-UP and the IAB-DU based on the first key.

[0157] For example, in the procedure of establishing a user plane secure transmission channel between the communication device and the IAB-DU, the first key is an authentication credential used by the communication device and the IAB-DU.

[0158] For example, the first key is K IAB and the root key is K gNB is.

[0159] For example, the first message is a bearer context setup request message. For example, in a procedure in which a terminal device accesses a network via an IAB-DU, a donor CU-CP sends a bearer context setup request message to the communication device, and the bearer context setup request message includes the first key.

[0160] In another example, the first message is a modify bearer context request message. For example, in a procedure in which a terminal device accesses a network via an IAB-DU, a donor CU-CP sends a modify bearer context request message to the communication device, and the modify bearer context request message includes the first key.

[0161] In some implementations of the twelfth aspect, the first message further includes a first IP address of the donor CU-UP. The processing unit is further configured to determine to establish a user plane secure transmission channel by using the first IP address of the donor CU-UP. The processing unit is further configured to determine a first key based on the first IP address.

[0162] Optionally, the first message further includes the IP address of the IAB-DU.

[0163] In relation to the twelfth aspect, in some implementations of the twelfth aspect, the first message includes a one-to-one correspondence between a plurality of IP addresses of the donor CU-UP and a plurality of keys, the plurality of keys including a first key corresponding to the first IP address. The processing unit is further configured to determine to establish a user plane secure transmission channel by using the first IP address of the donor CU-UP. The processing unit is further configured to determine the first key based on the first IP address.

[0164] For example, the first message is a bearer context setup request message. For example, in a procedure in which an IAB-MT accesses a network through a donor DU, a donor CU-CP sends a bearer context setup request message to a communication device, and the bearer context setup request message includes multiple keys and multiple IP addresses.

[0165] Optionally, the first message further includes an IP address of the IAB-DU, and all of the multiple keys correspond to the IP addresses of the IAB-DU. In other words, each of the multiple keys corresponds to one IP address of the donor CU-UP and the IP address of the IAB-DU.

[0166] In some implementations of the twelfth aspect, the transceiver unit is further configured to receive first instruction information from the donor CU-CP, and to transmit, based on the first instruction information, a plurality of IP addresses of the donor CU-UP to the donor CU-CP.

[0167] For example, the first indication information indicates that the IAB-DU belongs to the IAB node.

[0168] With respect to the twelfth aspect, in some implementations of the twelfth aspect, the processing unit is further configured to store a correspondence between the first key and an IP address of the IAB-DU.

[0169] With respect to the twelfth aspect, in some implementations of the twelfth aspect, the first message further includes first instruction information.

[0170] For example, the first indication information indicates that the IAB-DU belongs to the IAB node.

[0171] According to a thirteenth aspect, there is provided a communication device, the communication device including a transceiver unit and a processing unit. The transceiver unit is configured to receive a second message from a donor CU-CP and to send a first request message to an IAB-MT, the second message including a first IP address of the donor CU-UP, the first request message requesting a first key, the first key being different from a root key, the root key being a key generated by the IAB-MT in a procedure for registering with the network, and the first request message including the first IP address. The transceiver unit is further configured to receive a first response message from the IAB-MT, the first response message including the first key. The processing unit is configured to establish a user plane secure transmission channel between the IAB-DU and the donor CU-UP based on the first key.

[0172] For example, in the procedure of establishing a user plane secure transmission channel by the donor CU-UP and the communication device, the first key is the authentication credential used by the donor CU-UP and the communication device.

[0173] For example, the first key is K IAB and the root key is K gNB is.

[0174] In relation to the thirteenth aspect, in some implementations of the thirteenth aspect, before sending the first request message to the IAB-MT, the transceiver unit is further configured to receive a user plane data request message from the terminal device, and the user plane secure transmission channel is for transmission of user plane data of the terminal device.

[0175] In relation to the thirteenth aspect, in some implementations of the thirteenth aspect, before sending the first request message to the IAB-MT, the transceiver unit is further configured to receive an authentication request message from the donor CU-UP, the authentication request message being for establishing a user plane secure transmission channel.

[0176] In relation to the thirteenth aspect, in some implementations of the thirteenth aspect, the processing unit is further configured to store a correspondence between the first key and a first IP address of the donor CU-UP.

[0177] According to a fourteenth aspect, a communication device is provided, the communication device including a transceiver unit and a processing unit. The transceiver unit is configured to receive a second message from the donor CU-CP, the second message including a first IP address of the donor CU-UP. The transceiver unit is further configured to send a second request message to the IAB-MT, the second request message requesting a root key, the root key being for generating a first key, the first key being different from the root key, the root key being a key generated by the IAB-MT in a procedure for registering with the network. The transceiver unit is further configured to receive a second response message from the IAB-MT, the second response message including the root key. The processing unit is configured to derive the first key based on the root key, the IP address of the IAB-DU, and the first IP address. The processing unit is further configured to establish a user plane secure transmission channel between the IAB-DU and the donor CU-UP based on the first key.

[0178] For example, in the procedure of establishing a user plane secure transmission channel by the donor CU-UP and the communication device, the first key is the authentication credential used by the donor CU-UP and the communication device.

[0179] For example, the first key is KIAB and the root key is K gNB is.

[0180] In relation to the fourteenth aspect, in some implementations of the fourteenth aspect, before sending the second request message to the IAB-MT, the transceiver unit is further configured to receive a user plane data request message from the terminal device, and the user plane secure transmission channel is for transmission of user plane data of the terminal device.

[0181] In relation to the fourteenth aspect, in some implementations of the fourteenth aspect, before sending the second request message to the IAB-MT, the transceiver unit is further configured to receive an authentication request message from the donor CU-UP, the authentication request message being for establishing a user plane secure transmission channel.

[0182] In relation to the fourteenth aspect, in some implementations of the fourteenth aspect, the processing unit is further configured to store a correspondence between the first key and a first IP address of the donor CU-UP.

[0183] According to a fifteenth aspect, there is provided a communications device, the communications device including a transceiver unit and a processing unit. The processing unit is configured to derive a first key based on a root key, an IP address of the IAB-DU, and a first IP address of the donor CU-UP, the first key being different from the root key, the root key being a key obtained by the donor CU-CP from the network in a procedure in which the integrated access and backhaul node registers with the network. The transceiver unit is configured to send a first message to the donor CU-UP, the first message including the first key.

[0184] For example, in the procedure of establishing a user plane secure transmission channel by the donor CU-UP and IAB-DU, the first key is the authentication credential used by the donor CU-UP and IAB-DU.

[0185] The first key is K IAB and the root key is K gNB is.

[0186] For example, the first message is a bearer context setup request message. For example, in a procedure in which a terminal device accesses a network via an IAB-DU, the transceiver unit sends a bearer context setup request message to a donor CU-UP, and the bearer context setup request message includes the first key.

[0187] In another example, the first message is a modify bearer context request message. For example, in a procedure in which a terminal device accesses a network via an IAB-DU, the transceiver unit sends a modify bearer context request message to a donor CU-UP, and the modify bearer context request message includes the first key.

[0188] Optionally, the first message further includes a first IP address of the donor CU-UP.

[0189] Optionally, the first message further includes the IP address of the IAB-DU.

[0190]

[0023] In relation to the fifteenth aspect, in some implementations of the fifteenth aspect, the transceiver unit is further configured to transmit first instruction information to the donor CU-UP, and the transceiver unit is further configured to receive one or more IP addresses from the donor CU-UP, the one or more IP addresses including the first IP address.

[0191] For example, the first indication information indicates that the IAB-DU belongs to the IAB node.

[0192] Related to the fifteenth aspect, in some implementations of the fifteenth aspect, when the one or more IP addresses further include a second IP address, the processing unit is further configured to derive a second key based on the root key, the IP address of the IAB-DU, and the second IP address, and the first message includes a correspondence between the first key and the first IP address and a correspondence between the second key and the second IP address.

[0193] For example, the first message is a bearer context setup request message. For example, in a procedure in which an IAB-MT accesses a network through a donor DU, the donor CU-CP sends a bearer context setup request message to the donor CU-UP, and the bearer context setup request message includes a one-to-one correspondence between multiple keys and multiple IP addresses of the donor CU-UP. It should be understood that the donor DU, donor CU-UP, and donor CU-CP belong to the same donor node, and the IAB-DU and IAB-MT belong to the same IAB node.

[0194] In relation to the fifteenth aspect, in some implementations of the fifteenth aspect, the processing unit is further configured to derive a third key based on the root key, the IP address of the IAB-DU, and the IP address of the communication device, and to establish a control plane secure transmission channel between the donor CU-CP and the IAB-DU based on the third key.

[0195] In relation to the fifteenth aspect, in some implementations of the fifteenth aspect, the processing unit is further configured to determine that the IAB-DU belongs to the IAB node based on the first identifier in the context of the IAB-DU.

[0196] In relation to the fifteenth aspect, in some implementations of the fifteenth aspect, the transceiver unit is further configured to transmit first indication information to the donor CU-UP, the first indication information indicating that the IAB-DU belongs to the IAB node.

[0197] According to a sixteenth aspect, there is provided a communication device, the communication device including a transceiver unit and a processing unit. The transceiver unit is configured to receive first information from a donor CU-CP. The processing unit is configured to determine a first key based on the first information, the first key being different from a root key, the root key being a key obtained by the donor CU-CP from a network in a procedure in which the IAB node registers with the network. The processing unit is further configured to establish a user plane secure transmission channel between the communication device and the IAB node based on the first key.

[0198] For example, in the procedure of establishing a user plane secure transmission channel between the communication device and the IAB-DU, the first key is an authentication credential used by the communication device and the IAB-DU.

[0199] For example, the first key is K IAB and the root key is K gNB is.

[0200] For example, the first information is carried in a bearer context modification request message. For example, in a procedure in which an IAB-MT accesses a network via a donor DU, the transceiver unit is configured to transmit a bearer context modification request message, and the bearer context modification message includes the first information.

[0201] In relation to the sixteenth aspect, in some implementations of the sixteenth aspect, the first information includes at least one of an intermediate key and a user plane key used between the donor node and the IAB node, and the intermediate key and the user plane key are for determining the first key.

[0202] In some implementations of the sixteenth aspect, the first information includes an intermediate key, the intermediate key including a random number and any one of a key determined based on a root key and a second parameter, the second parameter including one or more of a physical cell identifier, an absolute radio frequency channel number—downlink, a secondary node count, a constant, and a freshness parameter. The processing unit is specifically configured to derive the first key based on the intermediate key, the IP address of the IAB-DU, and the IP address of the communication device.

[0203] In relation to the sixteenth aspect, in some implementations of the sixteenth aspect, the first information includes a user plane key, and the processing unit is specifically configured to derive the first key based on the user plane key, the IP address of the IAB-DU, and the IP address of the communication device.

[0204] In relation to the sixteenth aspect, in some implementations of the sixteenth aspect, the first information includes a user plane key, and the processing unit is specifically configured to determine a fourth key based on the user plane key, and to derive the first key based on the fourth key, an IP address of the IAB-DU, and an IP address of the communication device.

[0205] With reference to the sixteenth aspect, in some implementations of the sixteenth aspect, the processing unit is further configured to store a correspondence between the first key and an IP address of the IAB-DU.

[0206]

[0023] In relation to the sixteenth aspect, in some implementations of the sixteenth aspect, the transceiver unit is further configured to receive first indication information.

[0207] For example, the first indication information indicates that the IAB-DU belongs to the IAB node.

[0208] According to a seventeenth aspect, a communication device is provided, the communication device including a transceiver unit and a processing unit. The transceiver unit is configured to receive a second message from the donor CU-CP, the second message including an IP address of the donor CU-UP. The transceiver unit is further configured to send a third request message to the IAB-MT, the third request message requesting the second information. The transceiver unit is further configured to receive a third response message from the IAB-MT, the third response message including the second information. The processing unit is configured to determine a first key based on the second information, the first key being different from a root key, the root key being a key generated by the IAB-MT in a procedure for registering with the network. The processing unit is further configured to establish a user plane secure transmission channel between the communication device and the donor CU-UP based on the first key.

[0209] For example, in the procedure of establishing a user plane secure transmission channel by the donor CU-UP and the communication device, the first key is an authentication credential used by the donor CU-UP and the communication device.

[0210] For example, the first key is K IAB and the root key is K gNB is.

[0211] Related to the seventeenth aspect, in some implementations of the seventeenth aspect, the second information includes at least one of an intermediate key, a root key, and a second parameter, and a user plane key used between the donor node and the IAB node, wherein the intermediate key and the user plane key are for determining the first key, and the second parameter is for determining the intermediate key, and the second parameter includes one or more of a physical cell identifier, an absolute radio frequency channel number - downlink, a secondary node count, a constant, and a freshness parameter.

[0212] In relation to the seventeenth aspect, in some implementations of the seventeenth aspect, the second information includes an intermediate key, and the intermediate key includes any one of a random number and a key determined based on the root key and the second parameter. The processing unit is specifically configured to derive the first key based on the intermediate key, an IP address of the communication device, and an IP address of the donor CU-UP.

[0213]

[0023] In relation to the seventeenth aspect, in some implementations of the seventeenth aspect, the second information includes a user plane key, and the processing unit is specifically configured to derive the first key based on the user plane key, an IP address of the communication device, and an IP address of the donor CU-UP.

[0214]

[0023] In relation to the seventeenth aspect, in some implementations of the seventeenth aspect, the second information includes a user plane key. The processing unit is specifically configured to determine a fourth key based on the user plane key, and to derive the first key based on the fourth key, an IP address of the communication device, and an IP address of the donor CU-UP.

[0215] In relation to the seventeenth aspect, in some implementations of the seventeenth aspect, before sending the third request message to the IAB-MT, the transceiver unit is further configured to receive a user plane data request message from the terminal device, and the user plane secure transmission channel is for transmission of user plane data of the terminal device.

[0216] In relation to the seventeenth aspect, in some implementations of the seventeenth aspect, before sending the third request message to the IAB-MT, the transceiver unit is further configured to receive an authentication request message from the donor CU-UP, the authentication request message being for establishing a user plane secure transmission channel.

[0217]

[0033] In relation to the seventeenth aspect, in some implementations of the seventeenth aspect, the processing unit is further configured to store a correspondence between the first key and an IP address of the donor CU-UP.

[0218] According to an eighteenth aspect, there is provided a communications device, the communications device including a transceiver unit configured to receive a third request message from the IAB-DU, the third request message requesting second information, the second information being for determining a first key, the first key being different from a root key, the root key being a key generated during a procedure in which the communications device registers with the network, and the transceiver unit further configured to send a third response message to the IAB-DU, the third response message including the second information.

[0219] For example, the first key is K IAB and the root key is K gNB is.

[0220] Related to the eighteenth aspect, in some implementations of the eighteenth aspect, the second information includes at least one of an intermediate key, a root key, and a second parameter, and a user plane key used between the donor node and the IAB node, wherein the intermediate key and the user plane key are for determining the first key, and the second parameter is for determining the intermediate key, and the second parameter includes one or more of a physical cell identifier, an absolute radio frequency channel number - downlink, a secondary node count, a constant, and a freshness parameter.

[0221] In some implementations of the eighteenth aspect, the intermediate key includes one of a random number and a key determined based on the root key of the donor node and the second parameter. The transceiver unit is further configured to receive a fourth message from the donor CU-CP, the fourth message including the intermediate key or the second parameter.

[0222] For example, if the second parameters for deriving the intermediate key include a parameter unknown to the communication device, the donor CU-CP sends a fourth message. Optionally, the fourth message includes the parameter unknown to the communication device among the second parameters for deriving the intermediate key.

[0223] In another example, if the intermediate key is a random number, the donor CU-CP sends a fourth message, where the fourth message includes the intermediate key.

[0224] For example, the fourth message is an RRC reconfiguration message sent by the donor CU-CP in a procedure in which the communication device accesses the network via the donor DU. It should be understood that the donor DU and the donor CU-CP belong to the same donor node.

[0225] According to a nineteenth aspect, a communication device is provided, the communication device including a transceiver unit and a processing unit. The transceiver unit is configured to receive a first request message from an IAB-DU, the first request message requesting a first key, the first key being different from a root key, the root key being a key generated by the communication device in a procedure for registering with a network, and the first request message including an IP address of a donor CU-UP. The processing unit is configured to derive the first key based on the intermediate key, the IP address of the IAB-DU, and the IP address of the donor CU-UP. The transceiver unit is further configured to send a first response message to the IAB-DU, the first response message including the first key.

[0226] For example, the first key is K IAB and the root key is K gNB is.

[0227] In relation to the 19th aspect, in some implementations of the 19th aspect, the intermediate key includes any one of a random number and a key determined based on the root key and a second parameter, and the second parameter includes one or more of a physical cell identifier, an absolute radio frequency channel number - downlink, a secondary node count, a constant, and a freshness parameter.

[0228] In some implementations of the nineteenth aspect, the intermediate key includes a key determined based on the root key and the second parameter. The transceiver unit is further configured to receive a fourth message from the donor CU-CP, the fourth message including the intermediate key or the second parameter.

[0229] For example, if the second parameters for deriving the intermediate key include parameters unknown to the communication device, the donor CU-CP sends a fourth message. Optionally, the fourth message includes the intermediate key or the second parameters for deriving the intermediate key that are unknown to the communication device.

[0230] For example, the fourth message is an RRC reconfiguration message sent by the donor CU-CP in a procedure in which the communication device accesses the network via the donor DU. It should be understood that the donor DU and the donor CU-CP belong to the same donor node.

[0231]

[0023] In some implementations of the nineteenth aspect, the intermediate key includes a random number. The transceiver unit is further configured to receive a fourth message from the donor CU-CP, the fourth message including the intermediate key.

[0232] According to a twentieth aspect, a communication device is provided, the communication device including a transceiver unit and a processing unit. The transceiver unit is configured to receive a first request message from an IAB-DU, the first request message requesting a first key, the first key being different from a root key, the root key being a key generated by the communication device in a procedure for registering with the network, and the first request message including an IP address of a donor CU-UP. The processing unit is configured to derive the first key based on a user plane key, the IP address of the IAB-DU, and the IP address of the donor CU-UP, the user plane key being a user plane key used between the donor node and the IAB node. The transceiver unit is further configured to send a first response message to the IAB-DU, the first response message including the first key.

[0233] For example, the first key is K IAB and the root key is K gNB is.

[0234] According to a twenty-first aspect, a communication device is provided, the communication device including a transceiver unit and a processing unit. The transceiver unit is configured to receive a first request message from an IAB-DU, the first request message requesting a first key, the first key being different from a root key, the root key being a key generated by the communication device in a procedure for registering with the network, and the first request message including an IP address of a donor CU-UP. The processing unit is configured to determine a fourth key based on the user plane key, the user plane key being a user plane key used between the donor node and the IAB node. The processing unit is further configured to derive a first key based on the fourth key, the IP address of the IAB-DU, and the IP address of the donor CU-UP. The transceiver unit is further configured to send a first response message to the IAB-DU, the first response message including the first key.

[0235] For example, the first key is K IABand the root key is K gNB is.

[0236] According to a twenty-second aspect, there is provided a communication device, the communication device including: a transceiver unit; and a processing unit. The processing unit is configured to determine first information, the first information being for determining a first key, the first key being different from a root key, the root key being a key obtained by the donor CU-CP from the network in a procedure in which the IAB node registers with the network. The transceiver unit is configured to transmit the first information to the donor CU-UP.

[0237] For example, the first key is K IAB and the root key is K gNB is.

[0238] For example, the first information is carried in a bearer context modification request message. For example, in a procedure in which an IAB-MT accesses a network through a donor DU, the transceiver unit is configured to send a bearer context modification request message to the donor CU-UP, and the bearer context modification message includes the first information.

[0239] In relation to the 22nd aspect, in some implementations of the 22nd aspect, the first information includes at least one of an intermediate key and a user plane key used between the donor node and the IAB node, and the intermediate key and the user plane key are for determining the first key.

[0240] In relation to the 22nd aspect, in some implementations of the 22nd aspect, the first information includes an intermediate key, the intermediate key including a key determined based on a root key and a second parameter, and the processing unit is specifically configured to derive the intermediate key based on the root key used as an input key and the second parameter, the second parameter including one or more of a physical cell identifier, an absolute radio frequency channel number—downlink, a secondary node count, a constant, and a freshness parameter.

[0241] In relation to the 22nd aspect, in some implementations of the 22nd aspect, the transceiver unit is further configured to transmit a fourth message to the IAB-MT, the fourth message including the intermediate key or the second parameter.

[0242] For example, if the second parameters for deriving the intermediate key include a parameter unknown to the IAB-MT, the transceiver unit is configured to send a fourth message to the IAB-MT. Optionally, the fourth message includes the parameter unknown to the IAB-MT among the second parameters for deriving the intermediate key.

[0243] For example, the fourth message is an RRC reconfiguration message sent by the transceiver unit to the IAB-MT in a procedure in which the IAB-MT accesses the network via the donor DU.

[0244] In relation to the twenty-second aspect, in some implementations of the twenty-second aspect, the first information includes an intermediate key, and the intermediate key includes a random number. The processing unit is specifically configured to generate the random number.

[0245]

[0023] In relation to the twenty-second aspect, in some implementations of the twenty-second aspect, the transceiver unit is further configured to transmit a fourth message to the IAB-MT, the fourth message including the intermediate key.

[0246] In relation to the 22nd aspect, in some implementations of the 22nd aspect, the first information includes a user plane key, and the processing unit is specifically configured to derive the user plane key based on the root key.

[0247]

[0033] In relation to the twenty-second aspect, in some implementations of the twenty-second aspect, the transceiver unit is further configured to receive second indication information.

[0248] For example, the second indication information indicates that the IAB-DU belongs to the IAB node.

[0249]

[0033] In relation to the twenty-second aspect, in some implementations of the twenty-second aspect, the transceiver unit is further configured to transmit first instruction information to the donor CU-UP.

[0250] For example, the first indication information indicates that the IAB-DU belongs to the IAB node.

[0251] According to a twenty-third aspect, the present application provides a communications device including a processor. The processor may be coupled to a memory and configured to execute instructions in the memory to implement a method according to the first aspect or any one of its possible implementations, or to implement a method according to the fifth aspect or any one of its possible implementations. The communications device further includes the memory. The communications device further includes a communications interface. The processor is coupled to the communications interface.

[0252] In some implementations, the communication device is a donor CU-UP. When the communication device is a donor CU-UP, the communication interface may be a transceiver or an input / output interface.

[0253] In another implementation, the communication device is a chip or chip system configured in the donor CU-UP. When the communication device is a chip or chip system configured in the donor CU-UP, the communication interface may be an input / output interface.

[0254] The transceiver may be a transceiver circuit. The input / output interface may be an input / output circuit.

[0255] According to a twenty-fourth aspect, the present application provides a communications device including a processor. The processor is coupled to a memory and may be configured to execute instructions in the memory to implement a method according to the second aspect or any one of its possible implementations, a method according to the third aspect or any one of its possible implementations, a method according to the fifth aspect or any one of its possible implementations, or a method according to the sixth aspect or any one of its possible implementations. The communications device further includes the memory. The communications device further includes a communications interface. The processor is coupled to the communications interface.

[0256] In some implementations, the communication device is an IAB-DU. When the communication device is an IAB-DU, the communication interface may be a transceiver or an input / output interface.

[0257] In another implementation, the communication device is a chip or chip system configured in the IAB-DU. When the communication device is a chip or chip system configured in the IAB-DU, the communication interface may be an input / output interface.

[0258] The transceiver may be a transceiver circuit. The input / output interface may be an input / output circuit.

[0259] According to a twenty-fifth aspect, the present application provides a communications device including a processor. The processor may be coupled to a memory and configured to execute instructions in the memory to implement a method according to the fourth aspect or any one of its possible implementations, or to implement a method according to the eleventh aspect or any one of its possible implementations. The communications device further includes the memory. The communications device further includes a communications interface. The processor is coupled to the communications interface.

[0260] In some implementations, the communication device is a donor CU-CP. When the communication device is a donor CU-CP, the communication interface may be a transceiver or an input / output interface.

[0261] In another implementation, the communication device is a chip or chip system configured in the donor CU-CP. When the communication device is a chip or chip system configured in the donor CU-CP, the communication interface may be an input / output interface.

[0262] The transceiver may be a transceiver circuit. The input / output interface may be an input / output circuit.

[0263] According to a twenty-sixth aspect, the present application provides a communications device including a processor. The processor may be coupled to a memory and configured to execute instructions in the memory to implement a method according to any one of the seventh to tenth aspects or possible implementations of the seventh to tenth aspects. The communications device further includes the memory. The communications device further includes a communications interface. The processor is coupled to the communications interface.

[0264] In some implementations, the communication device is an IAB-MT. When the communication device is an IAB-MT, the communication interface may be a transceiver or an input / output interface.

[0265] In another implementation, the communication device is a chip or chip system configured in the IAB-MT. When the communication device is a chip or chip system configured in the IAB-MT, the communication interface may be an input / output interface.

[0266] The transceiver may be a transceiver circuit. The input / output interface may be an input / output circuit.

[0267] According to a twenty-seventh aspect, the present application provides a processor including an input circuit, an output circuit, and a processing circuit configured to receive signals via the input circuit and transmit signals via the output circuit, thereby causing the processor to perform the methods of the previous aspects.

[0268] In a specific implementation procedure, the processor may be a chip, the input circuit may be an input pin, the output circuit may be an output pin, and the processing circuit may be a transistor, a gate circuit, a trigger, various logic circuits, etc. The input signal received by the input circuit may be received and input by, for example, but not limited to, a receiver, the signal output by the output circuit may be output to, for example, but not limited to, a transmitter and transmitted by the transmitter, and the input circuit and the output circuit may be the same circuit, which may be used as an input circuit and an output circuit at different moments. The specific implementation of the processor and various circuits is not limited in this embodiment of the present application.

[0269] According to a twenty-eighth aspect, the present application provides a processing device including a communication interface and a processor. The communication interface is coupled to the processor. The communication interface is configured to input and / or output information. The information includes at least one of instructions or data. The processor is configured to execute a computer program, thereby causing the processing device to perform the methods of the previous aspects.

[0270] According to a twenty-ninth aspect, the present application provides a processing device including a processor and a memory, wherein the processor is configured to read instructions stored in the memory, receive a signal by using the receiver, and transmit a signal by using the transmitter, such that the processing device performs the methods of the previous aspects.

[0271] Optionally, there are one or more processors. Where present, there may also be one or more memories.

[0272] Optionally, the memory and the processor may be integrated together, or the memory and the processor may be located separately.

[0273] In a specific implementation, the memory may be a non-transitory memory such as a read-only memory (ROM). The memory and the processor may be integrated on the same chip or may be separately located on different chips. The type of memory and the manner in which the memory and the processor are located are not limited in this embodiment of the present application.

[0274] It should be understood that in the related information exchange procedures, for example, transmitting instruction information may be a procedure of outputting instruction information from a processor, and receiving instruction information may be a procedure of inputting the received instruction information to a processor. Specifically, the information output by the processor may be output to a transmitter, and the input information received by the processor may be from a receiver. The transmitter and receiver may be collectively referred to as a transceiver.

[0275] The devices of the twenty-eighth and twenty-ninth aspects may each be a chip. The processor may be implemented using hardware or software. When the processor is implemented using hardware, it may be a logic circuit, an integrated circuit, or the like; or when the processor is implemented using software, it may be a general-purpose processor and is implemented by reading software code stored in memory. The memory may be integrated with the processor or may be located outside the processor and exist independently.

[0276] According to a thirtieth aspect, the present application provides a computer program product. The computer program product includes a computer program (which may also be referred to as code or instructions). When executed, the computer program enables a computer to perform the methods of the previous aspects.

[0277] According to a thirty-first aspect, the present application provides a computer-readable medium having stored thereon a computer program (which may also be referred to as code or instructions) that, when executed on a computer, enables the computer to perform the methods of the preceding aspects.

[0278] According to a thirty-second aspect, the present application provides a communication facility including the aforementioned donor CU-UP, donor CU-CP, IAB-MT, and IAB-DU. [Brief explanation of the drawings]

[0279] [Figure 1] 1 is a schematic diagram of the architecture of the separation between the next generation Node B central unit control plane entity and the next generation Node B central unit user plane entity.

[0280] [Figure 2] FIG. 1 is a diagram of the architecture of an IAB system used in the technical solution in the present application.

[0281] [Figure 3] An example of a user plane protocol stack architecture for a multi-hop IAB network is shown.

[0282] [Figure 4] An example of a control plane protocol stack architecture for a multi-hop IAB network is shown.

[0283] [Figure 5] 1 is a schematic flowchart of a method according to an embodiment of the present application; [Figure 6] 1 is a schematic flowchart of a method according to an embodiment of the present application; [Figure 7] 1 is a schematic flowchart of a method according to an embodiment of the present application; [Figure 8] 1 is a schematic flowchart of a method according to an embodiment of the present application; [Figure 9] 1 is a schematic flowchart of a method according to an embodiment of the present application; [Figure 10] 1 is a schematic flowchart of a method according to an embodiment of the present application; [Figure 11] 1 is a schematic flowchart of a method according to an embodiment of the present application;

[0284] [Figure 12] 1 is a schematic block diagram of a communication device according to an embodiment of the present application;

[0285] [Figure 13] 1 is a schematic block diagram of a communication device according to an embodiment of the present application; DETAILED DESCRIPTION OF THE INVENTION

[0286] The technical solutions in this application are described below with reference to the accompanying drawings.

[0287] Embodiments of the present application may be applied to various communication systems, such as wireless local area network (WLAN) systems, narrowband internet of things (NB-IoT) systems, global system for mobile communications (GSM), enhanced data rates for GSM evolution (EDGE) systems, wideband code division multiple access (WCDMA) systems, code division multiple access 2000 (CDMA2000) systems, time division-synchronous code division multiple access (TD-SCDMA) systems, long term evolution (LTE) systems, satellite communication systems, fifth generation (5G) systems, and new communication systems that will emerge in the future.

[0288] The terminal device in the present embodiment may include various handheld devices, vehicle-mounted devices, wearable devices, or computing devices with wireless communication capabilities or other processing devices connected to a wireless modem. The terminal may be a mobile station (MS), a subscriber unit, a user equipment (UE), a cellular phone, a smartphone, a wireless data card, a personal digital assistant (PDA) computer, a tablet computer, a wireless modem, a handset, a laptop computer, a machine type communication (MTC) terminal, etc.

[0289] The network device in the present embodiment may be a device configured to communicate with a terminal device. The network device may be a base transceiver station (BTS) in a global system for mobile communications (GSM) system or a code division multiple access (CDMA) system, a Node B (NB) in a wideband code division multiple access (WCDMA) system, an evolved Node B (eNB or eNodeB) in an LTE system, a new radio Node B (gNB), or a radio controller in a cloud radio access network (CRAN) scenario. Alternatively, the network device may be a relay station, an access point, a vehicle-mounted device, a wearable device, a network device in a future 5G network, a network device in a future evolved PLMN network, etc. This is not a limitation of the present embodiment.

[0290] In an embodiment of the present invention, a terminal device or network device includes a hardware layer, an operating system layer running above the hardware layer, and an application layer running above the operating system layer. The hardware layer includes hardware such as a central processing unit (CPU), a memory management unit (MMU), and memory (sometimes referred to as main memory). The operating system may be any one or more types of computer operating systems that perform service processing through processes, such as the Linux operating system, Unix operating system, Android operating system, iOS operating system, or Windows operating system. The application layer includes applications such as a browser, an address book, word processing software, and instant messaging software. In addition, the specific structure of the executing entity of the method provided in the embodiment of the present application is not particularly limited in the embodiment of the present application, as long as a program recording the code of the method provided in the embodiment of the present application can be executed to perform communication according to the method provided in the embodiment of the present application. For example, the executing entity of the method provided in the embodiment of the present application may be a terminal device or a network device, or a functional module within the terminal device or a network device that can call and execute a program.

[0291] Additionally, aspects or features of the present application may be implemented as a method, apparatus, or product using standard programming and / or engineering techniques. As used herein, the term "product" covers a computer program accessible from any computer-readable component, carrier, or medium. For example, computer-readable media may include, but are not limited to, magnetic storage components (e.g., hard disks, floppy disks, or magnetic tapes), optical disks (e.g., compact discs (CDs) and digital versatile discs (DVDs)), smart cards, and flash components (e.g., erasable programmable read-only memory (EPROM), cards, sticks, or key drives). Additionally, various storage media described herein may refer to one or more devices and / or other machine-readable media configured to store information. The term "machine-readable medium" may include, but is not limited to, wireless channels and various other media capable of storing, containing, and / or conveying instructions and / or data.

[0292] In NR technology, an access network device (e.g., gNB) may consist of one gNB central unit (CU) and one or more gNB distributed units (DUs). The gNB-CU and gNB-DU are different logical nodes and may be located on different physical devices or may be located on the same physical device.

[0293] When an architecture with separation between the control plane and the user plane is considered, the gNB-CU can be further divided into a central unit control plane (CU-CP) entity (sometimes referred to as the CU-CP node) and a central unit user plane (CU-UP) entity (sometimes referred to as the CU-UP node). The gNB-CU-CP is a control plane entity configured to provide signaling control. The gNB-CU-UP is a user plane entity configured to provide transmission of terminal device data. The gNB-CU-CP is connected to the gNB-CU-UP through an E1 interface, the gNB-CU-CP is connected to the gNB-DU through an F1-C interface, and the gNB-CU-UP is connected to the gNB-DU through an F1-U interface. The structure is shown in Figure 1.

[0294] The architecture shown in Figure 1 has the following additional features: One gNB includes one gNB-CU-CP, multiple gNB-CU-UPs, and multiple gNB-DUs; One DU can only connect to one gNB-CU-CP; One CU-UP can only connect to one gNB-CU-CP; One DU can connect to multiple gNB-CU-UPs under the control of the same CU-CP; One CU-UP can connect to multiple gNB-DUs under the control of the same CU-CP.

[0295] It should be understood that Figure 1 is merely an example and should not impose any limitations on the architecture of a gNB. For example, in a CU-DU split and CP-UP split architecture, a gNB may include only one gNB-CU-UP, one gNB-CU-CP, and one gNB-DU, or may include more gNB-CU-UPs and gNB-DUs. This is not a limitation in this application.

[0296] Compared with fourth-generation mobile communication systems, fifth-generation mobile networks (5G) have more stringent requirements for various network performance indicators in a comprehensive manner. For example, capacity indicators will increase by 1,000 times, wider coverage will be required, and ultra-high reliability and ultra-low latency are required. Given the abundant high-frequency carrier frequency resources, the use of high-frequency small cell networking is becoming increasingly widespread in hotspot areas to meet the ultra-high capacity requirements of 5G. High-frequency carriers have poor propagation characteristics, severe blocking attenuation, and narrow coverage. Therefore, a large number of small cells must be densely deployed. Therefore, providing optical fiber backhaul for a large number of densely deployed small cells is costly and difficult to build. Therefore, an economical and convenient backhaul solution is needed. In addition, due to the wide coverage requirement, deploying optical fiber to provide network coverage in some remote areas is difficult and costly. Therefore, flexible and convenient access and backhaul solutions also need to be designed.

[0297] Integrated access and backhaul (IAB) technology offers a solution to the aforementioned problems. To avoid the need for optical fiber deployment, IAB technology uses wireless transmission solutions for both the access link and the backhaul link. Figure 2 is a schematic diagram of a wireless relay scenario. In an IAB network, a relay node (RN), sometimes called an IAB node, can provide wireless access services for user equipment (UE). The service transmission for the UE is performed by an IAB donor node (RN), also called a donor base station (gNodeB) connected to the IAB node through a wireless backhaul link. The donor node can also be called a donor base station (DgNB). An IAB node can play two roles: mobile termination (MT) and DU. When an IAB node faces its parent node, it can be considered as a terminal device (MT), and the parent node can be a donor base station. When an IAB node faces its child node, the IAB node may be considered a network device, i.e., a DU. The child node may be another IAB node or a general UE. A donor base station may be an access network element with complete base station functionality, or it may be an access network element with a separation between a central unit and a distributed unit. The donor base station is connected to a core network element that serves UEs, for example, a 5G core network, and provides wireless backhaul functionality to the IAB node. For ease of explanation, the donor base station central unit is referred to as a donor CU for short, or directly as a CU, and the donor base station distributed unit is referred to as a donor DU for short, or directly as a DU. Alternatively, the donor CU may be a separation between the control plane (CP) and the user plane (UP).For example, a CU may consist of one CU-CP and one or more CU-UPs.

[0298] As shown in Figures 3 and 4, an F1 interface (also called an F1* interface; the F1 interface and the F1* interface may be collectively referred to as the F1 interface in this specification, but the name is not limited thereto) must be established between an IAB node (IAB-DU) and a donor node (IAB-Donor-CU). The interface supports user plane protocols (F1-U / F1*-U) and control plane protocols (F1-C / F1*-C). The user plane protocol includes one or more of the following protocol layers: general packet radio service tunneling protocol user plane (GTP-U), user datagram protocol (UDP), internet protocol (IP), layer 2 (L2), layer 1 (L1), radio link control (RLC), medium access control (MAC), physical (PHY), and backhaul adaptation protocol (BAP). The control plane protocol includes one or more of the following protocol layers: F1 application protocol (F1AP), stream control transport protocol (SCTP), IP, L2, L1, RLC, MAC, PHY, and BAP.

[0299] In Figures 3 and 4, the wireless backhaul links between IAB Node 2 and IAB Node 1, and between IAB Node 1 and the IAB Donor DU, may be referred to as wireless backhaul radio link control channels (BH RLC CHs).

[0300] Based on the control plane of the F1 interface, functions such as interface management, IAB-DU management, and UE context-related configuration may be performed between the IAB node and the IAB donor. Based on the user plane of the F1 interface, functions such as user plane data transmission and downlink transmission status feedback may be performed between the IAB node and the IAB donor.

[0301] To secure the F1 interface, an IP security (IPsec) secure connection may be established between the IAB node and the IAB donor.

[0302] When an architecture of separation between CU-UP and CU-CP is used for IAB donors, i.e., splitting an IAB donor into a donor CU-CP and a donor CU-UP, how to establish an IPsec secure connection between the donor CU-CP and the IAB nodes becomes an urgent problem to be solved.

[0303] In view of this, an embodiment of the present application provides a method for establishing a secure transmission channel, such as establishing a user plane secure transmission channel between a donor CU-UP and an IAB-DU.

[0304] In the following embodiments, it should be noted that the first key in the donor CU-UP is derived by the donor CU-UP or by the donor CU-CP and sent to the donor CU-UP; the first key in the IAB-DU is derived by the IAB-DU or by the IAB-MT and sent to the IAB-DU. Since the first key in the IAB-DU and the first key in the donor CU-UP are the same key, both the key in the IAB-DU and the key in the donor CU-UP are referred to as the first key in this application. However, it should not be understood that the key in the donor CU-UP is derived by the IAB-DU / IAB-MT, nor should it be understood that the key in the IAB-DU is derived by the donor CU-UP / donor CU-CP. Of course, alternatively, the key in the donor CU-UP may be referred to as the first key, and the key in the IAB-DU may be referred to as the fifth key, and the first key and the fifth key are the same key. This is not limited to the embodiments of the present application.

[0305] 5 shows a method for establishing a secure transmission channel according to an embodiment of the present application. As shown in FIG. 5, the method 500 includes steps S510 to S550. Each step will be described in detail below.

[0306] S510: The donor CU-CP sends a third message, so that in S510, the donor CU-UP receives the third message.

[0307] The third message contains the root key of the donor node (hereafter referred to as K gNB (K) gNBis obtained by the donor CU-CP from the network during the procedure in which the IAB-MT of an IAB node registers with the network. For example, during the procedure in which the IAB-MT of an IAB node accesses the network via a donor DU and a donor CU-CP, or via another IAB node and the donor CU-CP, after the core network performs authentication with the IAB-MT, the access and mobility management function (AMF) network element sends an initial context setup request message to the donor CU-CP, and the initial context setup request message is gNB After receiving the Initial Context Setup Request message, the donor CU-CP gNB It should be understood that the IAB-MT and IAB-DU belong to the same IAB node, and the Donor DU, Donor CU-UP, and Donor CU-CP belong to the same IAB Donor node.

[0308] K gNB is for deriving the first key. The first key is an authentication credential used when the donor CU-UP and IAB-DU establish a user plane secure transmission channel, and the user plane secure transmission channel is for transmitting user plane data of the terminal device. The user plane secure transmission channel established by the donor CU-UP and IAB-DU can be a secure transmission channel established by using an IPsec mechanism. The first key is K gNB Note that this is different from

[0309] The third message is not limited in this embodiment of the present application.

[0310] In one example, the third message is a bearer context setup request message. For example, the bearer context setup request message is sent by a donor CU-CP to a donor CU-UP when an IAB-MT accesses the network via a donor DU and a donor CU-CP, or via another IAB node and the donor CU-CP. In another example, the bearer context setup request message is sent by a donor CU-CP to a donor CU-UP when a terminal device accesses the network via an IAB-DU. The IAB-MT and IAB-DU belong to the same IAB node, and the donor DU, donor CU-CP, and donor CU-UP belong to the same IAB donor node.

[0311] In another example, the third message is a bearer context modification request message. For example, the bearer context modification request message is sent by a donor CU-CP to a donor CU-UP when an IAB-MT accesses the network via a donor DU and a donor CU-CP, or via another IAB node and the donor CU-CP. In another example, the bearer context modification request message is sent by a donor CU-CP to a donor CU-UP when a terminal device accesses the network via an IAB-DU.

[0312] Optionally, the third message further includes first indication information, where the first indication information indicates that the IAB-DU belongs to the IAB node.

[0313] For example, the first indication information may be an independent information element. For example, the first indication information may be an "IAB indicator" information element. As another example, the first indication information may be an IP address or K gNB That is, the IP address of the IAB-DU or gNBmay further indicate that the IAB-DU belongs to the IAB node.

[0314] S520: The donor CU-UP derives the first key.

[0315] Donor CU-UP is K gNB , deriving a first key based on the IP address of the IAB-DU and the first IP address of the donor CU-UP.

[0316] For example, the donor CU-UP uses K as the input key. gNB and by using the IP address of the IAB-DU and the first IP address of the donor CU-UP as input parameters.

[0317] The first IP address of the donor CU-UP is an IP address used by the donor CU-UP to establish a user plane safety transmission channel. It should be understood that the donor CU-UP may have multiple IP addresses. Before establishing the user plane safety transmission channel, the donor CU-UP determines one of the multiple IP addresses as the first IP address, and the first IP address is used to establish the user plane safety transmission channel. For example, in a procedure in which a terminal device accesses a network via IAB-DU, after receiving a bearer context setup request message from the donor CU-CP, the donor CU-UP determines the first IP address of the donor CU-UP as the first IP address to establish the user plane safety transmission channel.

[0318] The IP address of the IAB-DU is obtained by the donor CU-UP from the donor CU-CP. For example, in the procedure in which a terminal device accesses the network via the IAB-DU, the Modify Bearer Context Request message sent by the donor CU-CP to the donor CU-UP includes the IP address of the IAB-DU.

[0319] The conditions for triggering the donor CU-UP to derive the first key are not limited in this embodiment of the present application.

[0320] In one example, the donor CU-UP receives the IP address and K gNB The first key may be derived when obtaining the

[0321] In another example, the donor CU-UP derives the first key upon receiving the first instruction information.

[0322] Optionally, after deriving the first key, the donor CU-UP stores the correspondence between the first key and the IP address of the IAB-DU in the context of the donor CU-UP.

[0323] S530: The donor CU-CP sends a second message, so that the IAB-DU receives the second message at S530.

[0324] The second message includes a first IP address of the donor CU-UP. For example, the second message is a UE context setup request message. For example, the UE context setup request message is sent by the donor CU-CP to the IAB-DU when the terminal device accesses the network via the IAB-DU.

[0325] S540: The IAB-DU determines the first key.

[0326] See the description of method 600 below for how the IAB-DU determines the first key.

[0327] S550: The donor CU-UP and IAB-DU establish a user plane secure transmission channel by using the first key.

[0328] For example, the donor CU-UP and IAB node establish a user-plane secure transmission channel by using a pre-shared secret key (PSK) supported in the Internet Key Exchange (IKE) v2 protocol. In the first message exchange, the IAB node and donor CU-UP complete IKE security association (SA) parameter negotiation in plaintext, including negotiation, encryption, and authentication algorithms, temporary random number exchange, and Diffie-Hellman (DH) exchange. In the second message exchange, the IAB node and donor CU-UP separately generate authentication parameters by using the first key and send the authentication parameters to the peer end to complete identity authentication.

[0329] It can be understood that when the IAB-DU and the donor CU-UP establish a user plane secure transmission channel by using the IKEv2 PSK protocol, the IAB-DU determines, based on the correspondence between the first key and the first IP address of the donor CU-UP stored in the context of the IAB-DU, to use the first key as the authentication credential to be used when the user plane secure transmission channel is established, and the donor CU-UP determines, based on the correspondence between the first key and the IP address of the IAB-DU stored in the context of the donor CU-UP, to use the first key as the authentication credential to be used when the user plane secure transmission channel is established.

[0330] It should be further understood that the procedure for establishing a user plane safety transmission channel, performed by the IAB-DU and the donor CU-UP, may be triggered by the IAB-DU or the donor CU-UP. For example, when the IAB-DU receives a user plane data request from a terminal device, if the user plane safety transmission channel between the IAB-DU and the donor CU-UP has not been established, the IAB-DU triggers the procedure for establishing the user plane safety transmission channel. In another example, when the donor CU-UP receives downlink data from a terminal device, if the user plane safety transmission channel between the IAB-DU and the donor CU-UP has not been established, the donor CU-UP triggers the procedure for establishing the user plane safety transmission channel.

[0331] In this embodiment of the present application, the donor CU-CP is transferred to the donor CU-UP. gNB The donor CU-UP transmits K gNB The first key can be derived by using the input key, and the IAB-DU can obtain the same first key. When the donor CU-UP and IAB-DU have the same first key, the donor CU-UP and IAB-DU can establish a user plane secure transmission channel based on the first key, effectively avoiding the problem of authentication errors generated when the donor node and IAB-DU establish a secure transmission channel of the F1-U interface.

[0332] As described above, in the procedure in which the IAB-MT accesses the network via the donor DU, the initial context setup request message that the donor CU-CP receives from the AMF is gNB Includes: K gNB After obtaining the donor CU-CP, gNB Therefore, according to the method 500, the donor CU-CP may derive a key related to the control plane based on K gNB After sending the donor CU-UP, the donor CU-UP will gNBNot only can we derive the first key based on gNB Once the donor CU-UP has K gNB If the key related to the control plane is derived based on the above, the transmission security of the control plane will be affected and the requirements of key isolation and least privilege will not be met. In addition, the deployment method of the donor CU-UP may be distributed. That is, one donor CU-CP may manage multiple donor CU-UPs. If the donor CU-CP assigns K to multiple donor CU-UPs, gNB When transmitting a key, there is an additional risk of the key being compromised.

[0333] Therefore, although a user plane secure transmission channel between the donor CU-UP and IAB-DU can be established according to the method 500, the method 500 carries the risk of key leakage.

[0334] 6 shows a method for establishing a secure transmission channel according to an embodiment of the present application. As shown in FIG. 6, the method 600 includes steps S610 to S640. Each step will be described in detail below.

[0335] S610: The donor CU-CP sends a first message, and thus, in S610, the donor CU-UP receives the first message.

[0336] In one possible implementation, the first message includes a first key, which is an authentication credential used when the donor CU-UP and IAB-DU establish a user plane secure transmission channel, the user plane secure transmission channel being for transmitting user plane data of the terminal device. The user plane secure transmission channel established by the donor CU-UP and IAB-DU may be a user plane secure transmission channel established by using an IPsec mechanism.

[0337] The first key is the root key of the donor node (hereafter referred to as K gNBUnlike the gNB Note that K is the key obtained by the donor CU-CP from the network in the procedure of an IAB node registering to the network. For example, in the procedure in which an IAB-MT of an IAB node accesses the network via a donor DU and a donor CU-CP, or via another IAB node and the donor CU-CP, after the core network performs authentication to the IAB-MT, the AMF sends an initial context setup request message to the donor CU-CP, and the initial context setup request message contains K gNB After receiving the Initial Context Setup Request message, the donor CU-CP gNB It should be understood that the IAB-MT and IAB-DU belong to the same IAB node, and the Donor DU and Donor CU-CP belong to the same IAB Donor node.

[0338] Optionally, the first message further includes a first IP address of the donor CU-UP. Thus, after receiving the first message and determining to establish a user plane secure transmission channel between the donor CU-UP and the IAB-DU based on the first IP address, the donor CU-UP determines, based on the first IP address, to use a first key when establishing the user plane secure transmission channel.

[0339] Optionally, the first message further includes an IP address of the IAB-DU. Thus, after receiving the first message and determining to establish a user plane secure transmission channel between the donor CU-UP and the IAB-DU based on the first IP address, the donor CU-UP determines, based on the first IP address and the IP address of the IAB-DU, to use the first key when establishing the user plane secure transmission channel.

[0340] When the first message includes a first key, the method 600 further includes S611a: the donor CU-CP determines the first key.

[0341] Donor CU-CP is K gNB , derive a first key based on the first IP address of the donor CU-UP and the IP address of the IAB-DU.

[0342] For example, donor CU-CP is K gNB as an input key, and derive a first key by using the first IP address of donor CU-UP and the IP address of IAB-DU as input parameters. gNB It should be understood that is a key shared by the IAB-MT and the IAB donor.

[0343] K gNB is obtained by the donor CU-CP from the locally stored context of the IAB node.

[0344] The first IP address of the donor CU-UP is an IP address used by the donor CU-UP to establish a user plane secure transmission channel. It should be understood that the donor CU-UP may have multiple IP addresses. Before establishing the user plane secure transmission channel, the donor CU-UP determines one first IP address among the multiple IP addresses, and the first IP address is for establishing the user plane secure transmission channel. For example, in a procedure in which a terminal device accesses a network via IAB-DU, the donor CU-CP receives a bearer context setup response message from the donor CU-UP, and the bearer context setup response message includes the first IP address of the donor CU-UP.

[0345] The IP address of the IAB-DU may be assigned by the donor CU-CP or may be assigned to the IAB-DU by the operation, administration, and maintenance (OAM). When the OAM assigns the IP address to the IAB-DU, the donor CU-CP may obtain the IP address of the IAB-DU from the OAM.

[0346] The conditions for triggering the donor CU-CP to determine the first key are not limited in this embodiment of the present application.

[0347] In one example, the donor CU-CP may determine the first key when it obtains the first IP address of the donor CU-UP. In other words, once the donor CU-CP receives a bearer context setup response message from the donor CU-UP, the donor CU-CP may determine the first key based on the first IP address of the donor CU-UP, which is carried in the bearer context setup response message.

[0348] In another example, the donor CU-CP determines the first key when it determines that the IAB-DU belongs to the IAB node. For example, the donor CU-CP determines whether the IAB-DU belongs to the IAB node depending on whether the locally stored context of the IAB node includes a first identifier, where the first identifier indicates that the IAB-DU belongs to the IAB node. If the context of the IAB node includes the first identifier, the donor CU-CP determines that the IAB-DU belongs to the IAB node, or if the context of the IAB node does not include the first identifier, the donor CU-CP determines that the IAB-DU does not belong to the IAB node. For example, the first identifier is the IP address of the IAB-DU.

[0349] In another possible implementation, the first message includes a one-to-one correspondence between multiple IP addresses of the donor CU-UP and multiple keys, where the multiple keys include a first key, and the first key corresponds to the first IP address of the donor CU-UP.

[0350] Optionally, the first message further includes an IP address of the IAB-DU, and all of the multiple keys correspond to the IP addresses of the IAB-DU. In other words, each of the multiple keys corresponds to one IP address of the donor CU-UP and the IP address of the IAB-DU.

[0351] When the first message includes a one-to-one correspondence between a plurality of IP addresses of the donor CU-UP and a plurality of keys, the method 600 further includes S611b: the donor CU-CP receives K gNB , derive multiple keys based on the IP address of IAB-DU and multiple IP addresses of donor CU-UP.

[0352] For example, the multiple IP addresses of the donor CU-UP include a first IP address and a second IP address. In this case, the donor CU-CP gNB derive a first key based on the IP address of the IAB-DU, the IP address of the IAB-DU, and the first IP address; gNB The IAB-DU then derives a second key based on the IP address of the IAB-DU and the second IP address. The correspondence between the first IP address and the first key and the correspondence between the second IP address and the second key are then sent to the donor CU-UP via a first message.

[0353] Optionally, before the donor CU-CP determines the multiple keys, the method further includes: the donor CU-CP sends first instruction information to the donor CU-UP; and the donor CU-CP receives multiple IP addresses of the donor CU-UP from the donor CU-UP. Thus, after receiving the first instruction information, the donor CU-UP sends the multiple IP addresses of the donor CU-UP to the donor CU-CP based on the first instruction information.

[0354] Specifically, the multiple IP addresses of the donor CU-UP are all IP addresses of the donor CU-UP. In other words, after receiving the first instruction information, the donor CU-UP sends all IP addresses of the donor CU-UP to the donor CU-CP according to the first instruction information.

[0355] For example, the first indication information indicates that the IAB-DU belongs to the IAB node.

[0356] For example, if donor CU-UP has three IP addresses, denoted as CU-UP IP 1, CU-UP IP 2, and CU-UP IP 3, donor CU-UP will send the three IP addresses to donor CU-CP. Thus, after receiving the three IP addresses from donor CU-UP, donor CU-CP will gNB , derive three keys based on the IP address of IAB-DU, and the three IP addresses of donor CU-UP.

[0357] Specifically, the donor CU-CP uses K as the input key. gNB and generate the key (K IAB-UP1 The donor CU-CP derives the input key K gNB and generate the key (K IAB-UP2 The donor CU-CP derives the input key K gNB and obtains the key (K IAB-UP3) to the donor CU-UP. Further, the donor CU-CP sends the three derived keys and the IP address of the donor CU-UP corresponding to the three keys, respectively, to the donor CU-UP. Optionally, the donor CU-UP sends the three derived keys and three groups of first parameters corresponding to the three keys, respectively, to the donor CU-UP, where the first parameters corresponding to each key are input parameters for deriving the keys. For example, the three keys and the three groups of first parameters corresponding to the three keys, respectively, are {K IAB-UP1 , CU-UP IP 1, and IAB-DU IP}, {K IAB-UP2 , CU-UP IP 2, and IAB-DU IP}, and {K IAB-UP3 , CU-UP IP 3, and IAB-DU IP}.

[0358] When the first message includes multiple keys, method 600 further includes S612: the donor CU-UP determines to establish a user plane secure transmission channel between the donor CU-UP and the IAB-DU based on the first IP address; and determines a first key based on the first IP address.

[0359] For example, the donor CU-UP determines a key from the plurality of keys that corresponds to a first IP address as the first key, or alternatively, the donor CU-UP determines a key from the plurality of keys that corresponds to the first IP address and the IP address of the IAB-DU as the first key.

[0360] For example, in a procedure in which a terminal device accesses a network via an IAB-DU, after receiving a bearer context setup request message from a donor CU-CP, the donor CU-UP determines that the IP address of the donor CU-UP is the first IP address for establishing a user plane secure transmission channel. Furthermore, the donor CU-UP receives a bearer context modification request message from the donor CU-CP, where the bearer context modification request message includes the IP address of the IAB-DU for establishing a user plane secure transmission channel. Furthermore, the donor CU-UP determines, as the first key, a key corresponding to the first IP address of the donor CU-UP and the IP address of the IAB-DU for establishing the user plane secure transmission channel, among the multiple keys. For example, if the IP address for establishing the user plane secure transmission channel determined by the donor CU-UP is the aforementioned CU-UP IP 2, the donor CU-UP determines, as the first key, a key corresponding to the CU-UP IP 2 and the IAB-DU IP. IAB-UP2 Determine.

[0361] Optionally, after obtaining the first key from the first message or determining the first key among the multiple keys included in the first message, the donor CU-UP stores a correspondence between the first key and the IP address of the IAB-DU.

[0362] For example, the donor CU-UP stores the correspondence between the first key and the IP address of the IAB-DU in the context of the donor CU-UP.

[0363] The IP address of the IAB-DU is obtained by the donor CU-UP from the donor CU-CP. For example, the donor CU-CP sends the IP address of the IAB-DU to the donor CU-UP via a first message. For example, in a procedure in which a terminal device accesses a network via the IAB-DU, a bearer context modification request message sent by the donor CU-CP to the donor CU-UP includes the first key and the IP address of the IAB-DU. In another example, the donor CU-CP sends the IP address of the IAB-DU to the donor CU-UP via a message different from the first message. For example, in a procedure in which a terminal device accesses a network via the IAB-DU, the donor CU-CP sends a bearer context setup request message to the donor CU-UP, where the bearer context setup request message includes the first key. Furthermore, the donor CU-CP sends a bearer context modification request message to the donor CU-UP, where the bearer context modification request message includes the IP address of the IAB-DU.

[0364] The first message sent by the donor CU-CP to the donor CU-UP is not limited in this embodiment of the present application.

[0365] In one example, when the first message includes the first key, the first message may be a modify bearer context request message. Specifically, the modify bearer context request message is sent by the donor CU-CP to the donor CU-UP during a procedure in which the terminal device accesses the network via the IAB-DU. For example, the first key may be carried in security information included in the modify bearer context request message. Alternatively, the first key may be carried in a newly defined information element in the modify bearer context request message.

[0366] In another example, when the first message includes the first key, the first message may be a bearer context setup request message sent by the donor CU-CP to the donor CU-UP in a procedure in which the terminal device accesses the network via the IAB-DU.

[0367] For example, the donor CU-UP has only one IP address. When establishing different user plane safety transmission channels, the donor CU-UP sets up the user plane safety transmission channel by using the IP address. It is assumed that before S710, the donor CU-UP and one IAB-DU have established one user plane safety transmission channel (denoted as user plane safety transmission channel 1). In the procedure of establishing user plane safety transmission channel 1, the donor CU-CP may obtain the IP address of the donor CU-UP. Then, in the procedure of establishing another user plane secure transmission channel (referred to as user plane secure transmission channel 2), since the donor CU-CP has obtained the IP address of the donor CU-UP in the procedure of establishing user plane secure transmission channel 1, before the donor CU-CP sends a bearer context setup request message to the donor CU-UP in the procedure of the terminal device accessing the network via IAB-DU, the donor CU-CP can determine a first key based on the IP address of the donor CU-UP and send the first key to the donor CU-UP via the bearer context setup request message.

[0368] In yet another example, when the first message includes multiple keys and multiple groups of first parameters, the first message may be a bearer context modification request message. Specifically, the bearer context modification request message is sent by a donor CU-CP to a donor CU-UP in a procedure in which an IAB-MT accesses a network via a donor DU and a donor CU-CP or via another IAB node and the donor CU-CP.

[0369] For example, Table 1 shows some information elements included in the security information: Table 2 shows the IEs / groups included in the "IAB Pre-Shared Key" information element.

[0370] The one-to-one correspondence between the first key or keys and the IP addresses of the donor CU-UP may be included in a "security info" information element. [Table 1] [Table 2]

[0371] For example, Table 3 shows some information elements included in a Bearer Context Setup Request message. Table 4 shows the IEs / groups included in the "IAB Pre-Shared Key" information element. Table 5 shows the IEs / groups included in the "IAB Credentials" information element.

[0372] The first key or multiple groups of multiple keys and first parameters may be included in an "IAB pre-shared key" information element. Specifically, the first key or multiple groups of multiple keys and first parameters may be included in an "IAB credential" information element within the "IAB pre-shared key" information element. [Table 3] [Table 4] [Table 5]

[0373] Optionally, method 600 further comprises S613: determining whether the donor CU-CP is K gNB derive a third key based on the IP address of the donor CU-CP and the IP address of the IAB-DU. The third key is an authentication credential used when the donor CU-CP and the IAB-DU establish a control plane secure transmission channel. The control plane secure transmission channel established by the donor CU-CP and the IAB-DU may be a secure transmission channel established by using an IPsec mechanism.

[0374] For example, the donor CU-CP uses K as the input key. gNB and derive the third key by using the IP address of the donor CU-CP and the IP address of the IAB-DU as input parameters.

[0375] Optionally, the first message further includes first instruction information, so that the donor CU-UP uses the first key as an authentication credential based on the first instruction information when the donor CU-UP and the IAB-DU establish a user plane secure transmission channel. Otherwise, the manner in which the donor CU-UP and the IAB-DU establish a user plane secure transmission channel does not depend on the first key as an authentication credential.

[0376] For example, the first indication information indicates that the IAB-DU belongs to the IAB node.

[0377] For example, the first indication information may be an independent information element. For example, the first indication information may be an "IAB indicator" information element. In another example, the first indication information may be an IP address or a first key of an IAB-DU. That is, the IP address or the first key of the IAB-DU may further indicate that the IAB-DU belongs to an IAB node.

[0378] S620: The donor CU-CP sends a second message, so that the IAB-DU receives the second message at S620.

[0379] The second message includes a first IP address of the donor CU-UP. For example, the second message is a UE context setup request message. For example, the UE context setup request message is sent by the donor CU-CP to the IAB-DU when the terminal device accesses the network via the IAB-DU.

[0380] S630: The IAB-DU determines the first key.

[0381] For example, S630 includes S631a to S633a.

[0382] S631a: The IAB-DU sends a first request message to the IAB-MT.

[0383] The first request message includes a first IP address of the donor CU-UP, and the first request message requests a first key.

[0384] After receiving the first request message from the IAB-DU, the IAB-MT gNB , derive a first key based on the IP address of the IAB-DU and the first IP address of the donor CU-UP, and then send the first key to the IAB-DU. It can be understood that the IP address of the IAB-DU is obtained from the OAM or the donor CU-CP after the IAB-MT completes registration.

[0385] For example, IAB-MT uses K as the input key. gNB and derive the first key by using the IP address of the IAB-DU and the first IP address of the donor CU-UP as input parameters.

[0386] S632a: The IAB-MT sends a first response message to the IAB-DU.

[0387] The first response message includes the first key.

[0388] Thus, after receiving the first key, the IAB-DU stores the correspondence between the first key and the first IP address of the donor CU-UP. For example, the IAB-DU stores the correspondence between the first key and the first IP address of the donor CU-UP in the context of the IAB-DU.

[0389] IAB-MT is K gNB , and the IAB-DU obtains the first IP address of the donor CU-UP. Thus, in the above manner, the IAB-MT interacts with the IAB-DU to solve the problem of obtaining the first key by the IAB-DU. In addition, the first key is stored as K gNB Key isolation and least privilege requirements are met, and key exposure is avoided.

[0390] In another example, S630 includes S631b to S633b.

[0391] S631b: The IAB-DU sends a second request message to the IAB-MT.

[0392] The second request message is gNB request.

[0393] S632b: The IAB-MT sends a second response message to the IAB-DU.

[0394] The second response message is gNB Includes:

[0395] It should be understood that S631b and S632b are optional steps. gNB If the IAB-DU locally stores K, S630 includes only S633b. gNBis obtained from the IAB-MT after the IAB-DU is started. For example, after the IAB-DU is started, the IAB-MT sends the IP address of the IAB-DU to the IAB-DU. gNB to IAB-DU.

[0396] S633b: IAB-DU derives the first key.

[0397] IAB-DU is a gNB , deriving a first key based on the IP address of the IAB-DU and the first IP address of the donor CU-UP.

[0398] For example, IAB-DU uses K as the input key. gNB and derive the first key by using the IP address of the IAB-DU and the first IP address of the donor CU-UP as input parameters. It can be understood that the IP address of the IAB-DU is obtained from the IAB-MT after the IAB-DU is started.

[0399] IAB-MT is K gNB , and the IAB-DU obtains the first IP address of the donor CU-UP. Thus, in the above manner, the IAB-MT interacts with the IAB-DU to solve the problem of obtaining the first key by the IAB-DU. In addition, K gNB After obtaining the IP address, IAB-DU will check the IP address of the donor CU-UP when it changes. gNB There is no need to repeatedly request the first key, so that the first key is calculated locally on demand.

[0400] Furthermore, after deriving the first key, the IAB-DU stores a correspondence between the first key and the first IP address of the donor CU-UP. For example, the IAB-DU stores the correspondence between the first key and the first IP address of the donor CU-UP in the IAB-DU's context.

[0401] It should be understood that the opportunity to obtain the first key by the IAB-DU is not limited in this embodiment of the present application.

[0402] In one example, the IAB-DU obtains the first key when obtaining the first IP address of the donor CU-UP. For example, if S630 includes S631a to S633a, the IAB-DU sends a first request message to the IAB-MT when obtaining the first IP address of the donor CU-UP. As another example, if S630 includes S631b to S633b, the IAB-DU sends a second request message to the IAB-MT or derives the first key when obtaining the first IP address of the donor CU-UP.

[0403] In another example, the IAB-DU derives the first key before initiating the user plane secure transmission channel setup procedure to the donor CU-UP. For example, if S630 includes S631a to S633a, the IAB-DU sends a first request message to the IAB-MT before initiating the user plane secure transmission channel setup procedure to the donor CU-UP. As another example, if S630 includes S631b to S633b, the IAB-DU sends a second request message to the IAB-MT or derives the first key before initiating the user plane secure transmission channel setup procedure to the donor CU-UP.

[0404] In yet another example, the IAB-DU obtains the first key after receiving an authentication request message from the donor CU-UP, where the authentication request message is for establishing a user plane secure transmission channel. For example, if S630 includes S631a to S633a, the IAB-DU sends a first request message to the IAB-MT after receiving the authentication request message from the donor CU-UP. As another example, if S630 includes S631b to S633b, the IAB-DU sends a second request message to the IAB-MT or derives the first key after receiving the authentication request message from the donor CU-UP.

[0405] In yet another example, the IAB-DU derives the first key after receiving a user plane data request message from the terminal device. For example, if S630 includes S631a to S633a, the IAB-DU sends a first request message to the IAB-MT after receiving the user plane data request message from the terminal device. In another example, if S630 includes S631b to S633b, the IAB-DU sends a second request message to the IAB-MT or derives the first key after receiving the user plane data request message from the terminal device.

[0406] S640: The donor CU-UP and IAB-DU establish a user plane secure transmission channel by using the first key.

[0407] For example, the donor CU-UP and the IAB node establish a user-plane secure transmission channel by using a PSK supported in the IKEv2 PSK protocol. In the first message exchange, the IAB node and the donor CU-UP complete IKE SA parameter negotiation in the clear, including negotiation, encryption, and authentication algorithms, temporary random number exchange, and DH exchange. In the second message exchange, the IAB node and the donor CU-UP separately generate authentication parameters by using the first key and send the authentication parameters to the peer end to complete identity authentication.

[0408] It can be understood that when the IAB-DU and the donor CU-UP establish a user plane secure transmission channel by using the IKEv2 PSK protocol, the IAB-DU determines, based on the correspondence between the first key and the first IP address of the donor CU-UP stored in the context of the IAB-DU, to use the first key as the authentication credential to be used when the user plane secure transmission channel is established, and the donor CU-UP determines, based on the correspondence between the first key and the IP address of the IAB-DU stored in the context of the donor CU-UP, to use the first key as the authentication credential to be used when the user plane secure transmission channel is established.

[0409] It should be further understood that the IKEv2 PSK procedure performed by the IAB-DU and donor CU-UP may be triggered by the IAB-DU or by the donor CU-UP. For example, when the IAB-DU receives a user plane data request from a terminal device, if the user plane secure transmission channel between the IAB-DU and donor CU-UP has not been established, the IAB-DU triggers the IKEv2 PSK procedure. As another example, when the donor CU-UP receives downlink data from a terminal device, if the user plane secure transmission channel between the IAB-DU and donor CU-UP has not been established, the donor CU-UP triggers the IKEv2 PSK procedure.

[0410] In this embodiment of the present application, the donor CU-CP is K gNB , derive a first key based on the first IP address of the donor CU-UP and the IP address of the IAB-DU, and send the first key to the donor CU-UP. In addition, the IAB node determines the first key in the same manner, so that the same first key exists in the donor CU-UP and the IAB node, effectively avoiding the problem of authentication errors generated when the donor node and the IAB-DU establish a secure transmission channel of the F1-U interface. In addition, the first key is K gNB, thereby meeting key isolation and least privilege requirements and avoiding key compromise.

[0411] Optionally, after the IAB-DU and donor CU-UP establish a user plane secure transmission channel, re-authentication between the IAB-MT and the core network may be performed.

[0412] The AMF sends an initial context setup request message to the donor CU-CP after re-authentication between the IAB-MT and the core network is performed, and the initial context setup request message is sent to the donor CU-CP with the new K gNB It can be understood that the IAB-MT also includes a new K gNB Generate.

[0413] In addition, the donor CU-CP uses a new K gNB A new second key can be derived using the IP address of the IAB-DU and the IP address of the donor CU-CP as input parameters.

[0414] In addition, donor CU-CP is a new K gNB For example, the donor CU-UP may send the new first key to the donor CU-UP via a Modify Bearer Context Request message.

[0415] Therefore, the new K gNB After receiving the donor CU-UP, the new K gNB The donor CU-UP may alternatively generate a new first key based on the new K and update the user plane secure transmission channel established in S640 based on the new first key. gNB A new first key may be established based on the new K gNB is different.

[0416] 7 shows a method for establishing a secure transmission channel according to another embodiment of the present application. As shown in FIG. 7, the method 700 includes steps S710 to S760. Each step will be described in detail below.

[0417] S710: Donor CU-CP transmits first information. Thus, in S710, donor CU-UP receives the first information.

[0418] The first information is for determining a first key, and the first key is an authentication credential used by the donor CU-UP and IAB-DU to establish a user plane secure transmission channel, where the user plane secure transmission channel is for transmitting user plane data of the terminal device. The user plane secure transmission channel established by the donor CU-UP and IAB-DU may be a secure transmission channel established by using an IPsec mechanism.

[0419] The first key is the root key of the donor node (hereafter referred to as K gNB Unlike the gNB Note that K is the key obtained by the donor CU-CP from the network in the procedure of an IAB node registering to the network. For example, in the procedure in which an IAB-MT of an IAB node accesses the network via a donor DU and a donor CU-CP, or via another IAB node and the donor CU-CP, after the core network performs authentication to the IAB-MT, the AMF sends an initial context setup request message to the donor CU-CP, and the initial context setup request message contains K gNB After receiving the Initial Context Setup Request message, the donor CU-CP gNB It should be understood that the IAB-MT and IAB-DU belong to the same IAB node, and the Donor DU and Donor CU-CP belong to the same IAB Donor node.

[0420] For example, the first information includes at least one of an intermediate key and a user plane key.

[0421] An intermediate key is an intermediate key for generating a first key. For example, an intermediate key is K gNB and a second parameter. In another example, the intermediate key is a random number.

[0422] The user plane key is a user plane key used between the IAB node and the IAB donor node. The second parameter includes one or more of a physical cell identifier (PCI), an absolute frequency channel number-downlink (ARFCN-DL), a secondary node count (counter), a constant, and a freshness parameter.

[0423] In one possible implementation, the first information includes an intermediate key.

[0424] Thus, the donor CU-CP sending the first information to the donor CU-UP includes the donor CU-CP generating an intermediate key and the donor CU-CP sending the intermediate key to the donor CU-UP.

[0425] In one example, the donor CU-CP generates an intermediate key by gNB and deriving an intermediate key based on the second parameter.

[0426] Optionally, in this example, the method 700 further includes S750: the donor CU-CP sends a fourth message to the IAB-MT, where the fourth message includes the intermediate key or the second parameter.

[0427] Specifically, the fourth message includes the intermediate key or the second parameters for generating the intermediate key that are unknown to the IAB-MT. In other words, if the second parameters used by the donor CU-CP to generate the intermediate key include parameters that are unknown to the IAB-MT, the donor CU-CP sends the intermediate key or the second parameters for generating the intermediate key that are unknown to the IAB-MT to the IAB-MT.

[0428] Note that the second parameters PCI, ARFCN-DL, and secondary node counter are known to IAB-MT.

[0429] For example, the fourth message may be an RRC reconfiguration message sent by a donor CU-CP to an IAB-MT in a procedure where the IAB-MT accesses the network via a donor DU and a donor CU-CP, or via another IAB node and the donor CU-CP, where the donor DU and the donor CU-CP belong to the same IAB donor node.

[0430] In another example, the donor CU-CP generating the intermediate key includes the donor CU-CP generating a random number and using the random number as the intermediate key.

[0431] In this example, the method 700 further includes S750: the donor CU-CP sends a fourth message to the IAB-MT, where the fourth message includes the intermediate key.

[0432] In another possible implementation, the first information includes a user plane key.

[0433] Thus, the donor CU-CP sending the first information to the donor CU-UP includes the donor CU-CP generating a user plane key and the donor CU-CP sending the user plane key to the donor CU-UP.

[0434] The donor CU-CP generating the user plane key means that the donor CU-CP gNB deriving a user plane key based on the

[0435] For example, in a procedure in which an IAB-MT accesses the network via a donor DU and a donor CU-CP, or via another IAB node and the donor CU-CP, after the authentication between the IAB-MT and the core network is completed, the initial context setup request message sent by the AMF to the donor CU-CP is K gNB Furthermore, the donor CU-CP contains K gNB and transmits the user plane keys to the donor CU-UP. The user plane keys include a user plane integrity protection key (denoted as Kupenc) and / or a user plane encryption protection key (denoted as Kupint).

[0436] The conditions for triggering the donor CU-CP to generate the first information are not limited in this embodiment of the present application.

[0437] In one possible implementation, the donor CU-CP generates the first information upon receiving the second indication information, where the second indication information indicates that the IAB-DU belongs to the IAB node.

[0438] For example, the donor CU-CP receives second instruction information from the IAB-MT, and the second instruction information is an "IAB instruction" information element. In a procedure in which the IAB-MT accesses the network via the donor DU and the donor CU-CP, or via the other IAB node and the donor CU-CP, the IAB-MT sends an "IAB instruction" information element to the donor CU-UP via the donor DU or the other IAB node.

[0439] In another example, the donor CU-CP receives second indication information from the core network element, where the second indication information is an "IAB Authorization" information element. In a procedure in which an IAB-MT accesses the network via a donor DU and a donor CU-CP, or via another IAB node and the donor CU-CP, after authentication between the IAB-MT and the core network is completed, the Initial Context Setup Request message sent by the AMF to the donor CU-CP includes an "IAB Authorization" information element.

[0440] The manner in which the donor CU-CP transmits the first information to the donor CU-UP is not limited in this embodiment of the present application.

[0441] For example, in a procedure in which an IAB-MT accesses a network via a donor DU, the donor CU-CP sends first information to the donor CU-UP via a bearer context setup request message.

[0442] Optionally, the method further includes: the donor CU-CP sends first indication information to the donor CU-UP, where the first indication information indicates that the IAB-DU belongs to an IAB node; the first indication information and the second indication information may be the same or different; this is not limited in this embodiment of the present application; for example, the first indication information is an "IAB indicator"; in another example, the first indication information is first information; that is, the first information further indicates that the IAB-DU belongs to an IAB node.

[0443] S720: The donor CU-UP determines a first key based on the first information.

[0444] After receiving the first information from the donor CU-CP, the donor CU-UP determines a first key based on the first information. Specifically, in the procedure in which the terminal device accesses the network through the donor DU, the donor CU-UP determines a first key based on the first information.

[0445] As described above, the first information may include different parameters. It should be understood that when the first information includes different parameters, the donor CU-UP still determines the first key based on the first information in a different manner.

[0446] In one possible implementation, the first information includes an intermediate key.

[0447] Thus, after receiving the first information, the donor CU-UP derives a first key based on the intermediate key, the IP address of the IAB-DU, and the first IP address of the donor CU-UP.

[0448] For example, the donor CU-UP derives the first key by using the intermediate key as an input key and the IP address of the IAB-DU and the first IP address of the donor CU-UP as input parameters.

[0449] In another possible implementation, the first information includes a user plane key.

[0450] Therefore, after receiving the first information, the donor CU-UP derives a first key based on the user plane key, the IP address of the IAB-DU, and the first IP address of the donor CU-UP.

[0451] For example, the donor CU-UP derives the first key by using the user plane key as an input key and the IP address of the IAB-DU and the first IP address of the donor CU-UP as input parameters.

[0452] Alternatively, the donor CU-UP first derives a fourth key based on the user plane key, and then derives a first key based on the fourth key, the IP address of the IAB-DU, and the first IP address of the donor CU-UP.

[0453] For example, the donor CU-UP derives the first key by using the fourth key as an input key and the IP address of the IAB-DU and the first IP address of the donor CU-UP as input parameters.

[0454] The first IP address of the donor CU-UP used by the donor CU-UP to derive the first key is an IP address for establishing a user plane secure transmission channel. It should be understood that the donor CU-UP may have multiple IP addresses. Before establishing the user plane secure transmission channel, the donor CU-UP determines one first IP address among the multiple IP addresses, and the first IP address is for establishing the user plane secure transmission channel. For example, in a procedure in which a terminal device accesses a network via IAB-DU, after receiving a bearer context setup request message from the donor CU-CP, the donor CU-UP determines the first IP address of the donor CU-UP, which is for establishing a user plane secure transmission channel.

[0455] The IP address of the IAB-DU is obtained by the donor CU-UP from the donor CU-CP. For example, in the procedure in which a terminal device accesses the network via the IAB-DU, the Modify Bearer Context Request message sent by the donor CU-CP to the donor CU-UP includes the IP address of the IAB-DU.

[0456] The condition for triggering the donor CU-UP to determine the first key based on the first information is not limited in this embodiment of the present application.

[0457] In one example, the donor CU-UP may derive the first key when obtaining the IP address and the first information of the IAB-DU.

[0458] In another example, the donor CU-UP derives the first key upon receiving the first instruction information.

[0459] Optionally, after determining the first key, the donor CU-UP stores a correspondence between the first key and the IP address of the IAB-DU, for example, the correspondence between the first key and the IP address of the IAB-DU is stored in a context of the donor CU-UP.

[0460] S730: The donor CU-CP sends a second message, so that the IAB-DU receives the second message at S730.

[0461] The second message includes a first IP address of the donor CU-UP. For example, the second message is a UE context setup request message. For example, the UE context setup request message is sent by the donor CU-CP to the IAB-DU when the terminal device accesses the network via the IAB-DU.

[0462] S740: The IAB-DU obtains the first key.

[0463] For example, S740 includes S741a to S743a.

[0464] S741a: The IAB-DU sends a first request message to the IAB-MT.

[0465] The first request message includes a first IP address of the donor CU-UP, and the first request message requests a first key.

[0466] After receiving the first request message from the IAB-DU, the IAB-MT derives a first key based on the intermediate key, the IP address of the IAB-DU, and the first IP address of the donor CU-UP.

[0467] For example, the IAB-MT derives the first key by using the intermediate key as the input key and the IP address of the IAB-DU and the first IP address of the donor CU-UP as input parameters.

[0468] Alternatively, the IAB-MT derives a first key based on the user plane key, the IP address of the IAB-DU, and the first IP address of the donor CU-UP.

[0469] For example, the IAB-MT derives the first key by using the user plane key as an input key and the IP address of the IAB-DU and the first IP address of the donor CU-UP as input parameters.

[0470] Alternatively, the IAB-MT first derives a fourth key based on the user plane key, and then derives a first key based on the fourth key, the IP address of the IAB-DU, and the first IP address of the donor CU-UP.

[0471] For example, the IAB-MT derives the first key by using the fourth key as an input key and the IP address of the IAB-DU and the first IP address of the donor CU-UP as input parameters.

[0472] It can be understood that the IP address of the IAB-DU is obtained from the OAM or the donor CU-CP after the IAB-MT completes registration.

[0473] S742a: The IAB-MT sends a first response message to the IAB-DU.

[0474] The first response message includes the first key.

[0475] Thus, after receiving the first key, the IAB-DU stores the correspondence between the first key and the first IP address of the donor CU-UP. For example, the IAB-DU stores the correspondence between the first key and the first IP address of the donor CU-UP in the context of the IAB-DU.

[0476] In another example, S740 includes S741b to S743b.

[0477] S741b: The IAB-DU sends a third request message to the IAB-MT.

[0478] The third request message requests the second information, which is the intermediate key, K gNB and the second parameter, and any one of the user plane key.

[0479] S742b: The IAB-MT sends a third response message to the IAB-DU.

[0480] The third response message includes the second information.

[0481] S743b: The IAB-DU derives the first key.

[0482] If the second information includes an intermediate key, the IAB-DU derives a first key based on the intermediate key, the IP address of the IAB-DU, and the first IP address of the donor CU-UP.

[0483] For example, the IAB-DU derives the first key by using the intermediate key as an input key and the IP address of the IAB-DU and the first IP address of the donor CU-UP as input parameters.

[0484] The second information is K gNB and the second parameter, IAB-DU first calculates K gNB and the second parameter, and then derive a first key based on the intermediate key as an input key, the IP address of the IAB-DU, and the first IP address of the donor CU-UP.

[0485] If the second information includes a user plane key, the IAB-DU derives a first key based on the user plane key, the IP address of the IAB-DU, and the first IP address of the donor CU-UP, or the IAB-DU first derives a fourth key based on the user plane key, and then derives a first key based on the fourth key, the IP address of the IAB-DU, and the first IP address of the donor CU-UP.

[0486] For example, the IAB-DU derives the first key by using the user plane key as an input key and the IP address of the IAB-DU and the first IP address of the donor CU-UP as input parameters, or uses the fourth key as an input key and derives the first key by using the IP address of the IAB-DU and the first IP address of the donor CU-UP as input parameters.

[0487] It can be understood that the IP address of the IAB-DU is obtained from the IAB-MT after the IAB-DU is initiated.

[0488] Furthermore, after deriving the first key, the IAB-DU stores a correspondence between the first key and the first IP address of the donor CU-UP. For example, the IAB-DU stores the correspondence between the first key and the first IP address of the donor CU-UP in the IAB-DU's context.

[0489] It should be understood that the opportunity to obtain the first key by the IAB-DU is not limited in this embodiment of the present application.

[0490] In one example, the IAB-DU obtains the first key when it obtains the first IP address of the donor CU-UP.

[0491] In another example, the IAB-DU obtains the first key before initiating the user plane secure transmission channel setup procedure to the donor CU-UP.

[0492] In yet another example, the IAB-DU obtains the first key after receiving an authentication request message from the donor CU-UP.

[0493] In yet another example, the IAB-DU obtains the first key after receiving a user plane data request message from the terminal device.

[0494] S760: The donor CU-UP and IAB nodes establish a user plane secure transmission channel by using the first key.

[0495] Specifically, S760 is the same as S640 in the above-described method 600. For the sake of brevity, the details will not be described again here.

[0496] In this embodiment of the present application, the donor CU-CP sends first information for generating a first key to the donor CU-UP, so that the donor CU-UP can generate the first key based on the first information. In addition, the IAB node also determines the first key in the same manner. When the donor CU-UP and the IAB-DU have the same first key, the donor CU-UP and the IAB-DU can establish a user plane secure transmission channel based on the first key, effectively avoiding the problem of authentication error generated when the donor node and the IAB-DU establish a user plane secure transmission channel. In addition, the first key is K gNB , thereby meeting key isolation and least privilege requirements and avoiding key compromise.

[0497] In addition, when the donor CU-UP and IAB-DU use the intermediate key as the input key for deriving the first key, the user plane key, the signaling plane key, and the input key for deriving the first key can be kept independent of each other, ensuring data transmission security.

[0498] Alternatively, when the donor CU-UP and IAB-DU use the user plane key as the input key to derive the first key, no additional signaling transmission is required, and the management and implementation of the first key is simplified.

[0499] Alternatively, when the donor CU-UP and IAB-DU use a fourth key derived based on the user plane key as an input key for deriving the first key, no additional signaling transmission is required, and the management and implementation of the first key is simplified.

[0500] 8 to 11 are used as examples to describe the method for establishing a secure transmission channel according to the embodiment of the present application. Note that in the following embodiment, the first key is K IAB-CP and the intermediate key is denoted as Km.

[0501] 8 is a schematic flowchart of a method for establishing a secure transmission channel according to an embodiment of the present application. As shown in FIG. 8, the method 800 includes steps S801 to S821. Each step will be described in detail below.

[0502] S801: Perform the IAB-MT registration procedure.

[0503] For example, the IAB-MT registration procedure includes the following steps:

[0504] Step 1: The IAB-MT sends an RRC setup request message to the donor DU.

[0505] Step 2: The donor DU sends an initial uplink (UL) RRC message transfer to the donor CU-CP.

[0506] Step 3: The donor CU-CP sends a downlink (DL) message transfer to the donor DU.

[0507] Step 4: The donor DU sends an RRC setup message to the IAB-MT.

[0508] In steps 1 to 4, the IAB node (the IAB-MT portion in the IAB node) has some or all of the functions of the UE. After the IAB node is powered on, the IAB-MT selects a donor that supports the IAB service, accesses the donor, and sets up air interface resources.

[0509] Step 5: The IAB-MT sends an RRC setup complete message to the donor DU.

[0510] The RRC Setup Complete message carries an IAB indication, which indicates that the current UE is an IAB node.

[0511] Step 6: The donor DU sends an RRC message transfer to the donor CU-CP.

[0512] The RRC message transfer carries an "IAB indication" information element. The donor CU-CP selects an AMF network element that supports the IAB service based on the "IAB indication" information element.

[0513] Step 7: The donor CU-CP sends an initial UE message to the AMF.

[0514] The initial UE message carries an "IAB indication" information element.

[0515] Step 8: The AMF sends an initial context setup request message to the donor CU-CP.

[0516] The Initial Context Setup Request message carries an “IAB Authorization” indication and further contains the first root key (K 1 gNB After receiving the Initial Context Setup Request message, the donor CU-CP assigns the K 1 gNB Store.

[0517] In steps 7 and 8, an authentication procedure is performed between the core network and the IAB-MT. After the authentication is successful, the core network checks the subscription data to determine whether the IAB-MT belongs to an IAB node. If the IAB-MT belongs to an IAB node, an "IAB Authorized" indication is sent to the donor CU-CP, which indicates that the core network has authorized the IAB-MT to be an IAB node. Therefore, after the authentication between the core network and the IAB-MT is completed, the IAB-MT becomes K 1 gNB Generate.

[0518] Step 9: The donor CU-CP sends a bearer context setup request message to the donor CU-UP.

[0519] The Bearer Context Setup Request message carries User Plane Key #1.

[0520] After receiving the Initial Context Setup Request message from the AMF, the donor CU-CP selects a user plane algorithm and 1 gNB where the user plane key #1 is for establishing a bearer context. The user plane key #1 includes a user plane integrity protection key (denoted Kupenc) and / or a user plane encryption protection key (denoted Kupint).

[0521] User plane key #1 is K 1 gNB This procedure is irreversible. Therefore, after receiving the user plane key #1, the donor CU-UP derives K based on the user plane key #1. 1 gNB In other words, the donor CU-UP does not have K 1 gNB There is no.

[0522] Step 10: The donor CU-UP sends a bearer context setup response message to the donor CU-CP.

[0523] Step 11: The donor CU-CP sends a UE context setup request message to the donor DU.

[0524] Step 12: The donor DU sends a security mode command to the IAB-MT.

[0525] Step 13: The donor DU sends a UE context setup response message to the donor CU-CP.

[0526] Step 14: The donor CU-CP sends a bearer context modification request message to the donor CU-UP.

[0527] Step 15: The donor CU-UP sends a bearer context modification response message to the donor CU-CP.

[0528] Step 16: The IAB-MT sends a security mode complete to the donor DU.

[0529] Step 17: The donor DU sends an uplink RRC message transfer to the donor CU-CP.

[0530] In steps 11-17, the donor CU-CP and IAB-MT perform a Security Mode Command procedure to negotiate the security algorithms and security keys to be used.

[0531] Step 18: The donor CU-CP sends a downlink RRC message transfer to the donor DU.

[0532] Step 19: The donor DU sends an RRC reconfiguration message to the IAB-MT.

[0533] Step 20: The IAB-MT sends an RRC reconfiguration complete message to the donor DU.

[0534] Step 21: The donor DU sends an uplink RRC message transfer to the donor CU-CP.

[0535] In steps 18 to 21, the donor CU-CP and IAB-MT perform the RRC reconfiguration procedure and complete the initial context setup procedure.

[0536] Step 22: The donor CU-CP sends an initial context setup response message to the AMF.

[0537] S802: The IAB-DU is initiated to set up F1-C interface security with the donor CU-CP.

[0538] For example, after the IAB-MT completes registration, the IAB-MT obtains the IP address of the IAB-DU and the IP address of the donor CU-CP.

[0539] In one example, after establishing a PDU session with the OAM through the core network, the IAB-MT obtains the IP address of the IAB-DU and the IP address of the donor CU-CP from the OAM by using the user plane.

[0540] In another example, the IAB-MT obtains the IP address of the IAB-DU and the IP address of the donor CU-CP from the donor CU-CP. Specifically, after establishing an IP connection to the OAM, the donor CU-CP obtains the IP address of the IAB-DU and the IP address of the donor CU-CP from the OAM. Furthermore, the donor CU-CP sends an RRC message to the IAB-MT, where the RRC message includes the IP address of the IAB-DU and the IP address of the donor CU-CP.

[0541] After obtaining the IP address of the IAB-DU and the IP address of the donor CU-CP, the IAB-MT sends the IP address of the IAB-DU and the IP address of the donor CU-CP to the IAB-DU for use.

[0542] Optionally, the IAB-MT further comprises K 1 gNB as the input key, and the IP address of the IAB-DU and the IP address of the donor CU-CP are used as input parameters. IAB-CP Derive K IAB-CP to IAB-DU.

[0543] Optionally, IAB-MT 1 gNB IAB-DU sends K 1 gNBas the input key, and the IP address of the IAB-DU and the IP address of the donor CU-CP are used as input parameters. IAB-CP is derived.

[0544] Therefore, donor CU-CP and K 1 gNB as the input key, and the IP address of the IAB-DU and the IP address of the donor CU-CP are used as input parameters. IAB-CP is derived.

[0545] The IAB-DU and the donor CU-CP establish an F1-C interface and negotiate the establishment of a secure transmission channel for the F1-C. The authentication credentials used in the procedure in which the IAB-DU and the donor CU-CP negotiate to establish a secure transmission channel for the F1-C interface are K IAB-CP is.

[0546] After the IAB-DU and donor CU-CP establish a secure transmission channel over the F1-C interface, the donor CU-CP can configure parameters for the IAB-DU over the F1-C interface. After the donor CU-CP configures parameters for the IAB-DU over the F1-C interface, the IAB-DU can provide mobile network services for the general UE.

[0547] After the donor CU-CP and the IAB-DU establish a secure transmission channel of the F1-C interface, the donor CU-CP marks the IAB-DU as an IAB node by using a first identifier, and stores the first identifier as a context of the IAB node, for example, the IP address of the IAB-DU.

[0548] S803: The UE accesses the network via the IAB-DU and performs authentication.

[0549] For example, S803 includes the following steps:

[0550] Step 1: The UE sends an RRC Setup Request message to the IAB-DU.

[0551] Step 2: The IAB-DU sends an initial uplink RRC message transfer to the donor CU-CP.

[0552] Step 3: The IAB-CU-CP sends a downlink message transfer to the donor DU.

[0553] Step 4: The IAB-DU sends an RRC setup message to the UE.

[0554] In steps 1 to 4, after the UE is powered on, the UE selects a base station to access the base station and sets up air interface resources. The base station selected by the UE is the IAB-DU.

[0555] Step 5: The UE sends an RRC Setup Complete message to the IAB-DU.

[0556] Step 6: The IAB-DU sends an RRC message transfer to the donor CU-CP.

[0557] Step 7: The donor CU-CP sends an initial UE message to the AMF.

[0558] Step 8: The AMF sends an initial context setup request message to the donor CU-CP.

[0559] In steps 5 to 8, the UE initiates the registration procedure, sets up a connection to the core network via IAB-DU, and completes the authentication procedure. After the authentication is completed, the AMF sends an initial context setup request message to the donor CU-CP, and the initial context setup request message includes the second root key (K2 gNB (marked with "") is transported.

[0560] S804: The donor CU-CP sends a bearer context setup request message to the donor CU-UP.

[0561] After the donor CU-CP receives the Initial Context Setup Request message from the AMF, the donor CU-CP is triggered to establish a bearer context. The donor CU-CP sends a Bearer Context Setup Request message to the donor CU-UP, which carries User Plane Key #2 for air interface user plane security protection between the donor CU-UP and the UE.

[0562] S805: The donor CU-UP sends a bearer context setup response message to the donor CU-CP.

[0563] The Bearer Context Setup Response message carries the first IP address of the donor CU-UP, which is used to establish a secure transmission channel of the F1-U interface between the IAB-DU and the donor CU-UP for transferring user plane data.

[0564] S806: The donor CU-CP sends a UE context setup request message to the IAB-DU.

[0565] The UE Context Setup Request message includes the first IP address of the donor CU-UP.

[0566] S807: The IAB-DU sends a security mode command to the UE.

[0567] S808: The IAB-DU sends a UE context setup response to the donor CU-CP.

[0568] S809:IAB-DU is K IAB_UP Get.

[0569] For example, S809 includes S8091a to S8093a.

[0570] S8091a: The IAB-DU sends a first request message to the IAB-MT.

[0571] The first request message includes a first IP address of the donor CU-UP, and the first request message includes a first IP address of the donor CU-UP. IAB_UP request.

[0572] S8092a:IAB-MT is K IAB_UP is derived.

[0573] After receiving the first request message from the IAB-DU, the IAB-MT IAB-UP as an input key, and the IP address of IAB-DU and the first IP address of donor CU-UP are used as input parameters to generate K IAB-UP and K is derived for IAB-DU. IAB-UP It can be understood that the IP address of the IAB-DU is obtained from the OAM or the donor CU-CP after the IAB-MT completes registration.

[0574] S8093a: The IAB-MT sends a first response message to the IAB-DU.

[0575] The first response message is IAB_UP Includes:

[0576] Therefore, K IAB_UP After receiving the IAB_UP For example, IAB-DU stores K IAB_UPand the first IP address of the donor CU-UP.

[0577] In another example, S809 includes S8091b to S8093b.

[0578] S8091b: The IAB-DU sends a second request message to the IAB-MT.

[0579] The second request message is K 1 gNB request.

[0580] S8092b: The IAB-MT sends a second response message to the IAB-DU.

[0581] The second response message is K 1 gNB Includes:

[0582] It should be understood that S8091b and S8092b are optional steps. 1 gNB If S809 stores K locally stored by the IAB-DU, S809 includes only S8093b. 1 gNB is obtained from the IAB-MT before S809 is executed. For example, after the IAB-DU is started, the IAB-MT sends the IP address of the IAB-DU to the IAB-DU. 1 gNB to IAB-DU.

[0583] S8093b:IAB-DU is K IAB_UP is derived.

[0584] IAB-DU is a 1 gNB as an input key, and the IP address of IAB-DU and the first IP address of donor CU-UP are used as input parameters to generate K IAB-UPIt can be seen that the IP address of the IAB-DU is obtained from the IAB-MT after the IAB-DU is started.

[0585] Furthermore, K IAB_UP After deriving, IAB-DU IAB_UP For example, IAB-DU stores K IAB_UP and the first IP address of the donor CU-UP.

[0586] K by IAB-DU IAB_UP It should be understood that the opportunity to obtain is not limited in this embodiment of the present application.

[0587] In one example, when the IAB-DU obtains the first IP address of the donor CU-UP, IAB_UP For example, if S809 includes S8091a to S8093a, the IAB-DU sends a first request message to the IAB-MT when acquiring the first IP address of the donor CU-UP. As another example, if S809 includes S8091b to S8093b, the IAB-DU sends a second request message to the IAB-MT when acquiring the first IP address of the donor CU-UP, or IAB_UP is derived.

[0588] In another example, IAB-DU may request K before initiating the IPsec setup procedure with donor CU-UP. IAB_UP For example, if S809 includes S8091a to S8093a, the IAB-DU sends a first request message to the IAB-MT before starting the IPsec setup procedure to the donor CU-UP. As another example, if S809 includes S8091b to S8093b, the IAB-DU sends a second request message to the IAB-MT before starting the IPsec setup procedure to the donor CU-UP, or IAB_UP is derived.

[0589] In yet another example, the IAB-DU may request the K after receiving an IPsec authentication request from the donor CU-UP. IAB_UP For example, if S809 includes S8091a to S8093a, the IAB-DU sends a first request message to the IAB-MT after receiving an IPsec authentication request from the donor CU-UP. As another example, if S809 includes S8091b to S8093b, the IAB-DU sends a second request message to the IAB-MT after receiving an IPsec authentication request from the donor CU-UP, or IAB_UP is derived.

[0590] In yet another example, the IAB-DU may send a user plane data request to the K IAB_UP For example, if S809 includes S8091a to S8093a, the IAB-DU sends a first request message to the IAB-MT after receiving a user plane data request from the UE. As another example, if S809 includes S8091b to S8093b, the IAB-DU sends a second request message to the IAB-MT after receiving a user plane data request from the UE, or IAB_UP is derived.

[0591] S810: Donor CU-CP is K IAB_UP is derived.

[0592] IAB-DU is a 1 gNB as an input key, and the IP address of IAB-DU and the first IP address of donor CU-UP are used as input parameters. IAB-UP is derived.

[0593] For example, after receiving a Bearer Context Setup Response message from a donor CU-UP, the donor CU-CP may select the K based on the first IP address of the donor CU-UP included in the Bearer Context Setup Response message. IAB_UPThat is, S810 may be executed after S805. Specifically, S810 may be executed after S805 and before S811.

[0594] In another example, the donor CU-UP determines that the IAB-DU belongs to the IAB node and then IAB_UP As described in S802, the donor CU-CP may use the first identifier to mark the IAB-DU as belonging to the IAB node and store the first identifier in the context of the IAB-DU. Based on this, the donor CU-CP derives K IAB_UP Before deriving K, the donor CU-CP can inquire whether the context of the IAB node includes a first identifier. If the context of the IAB node includes the first identifier, the donor CU-CP determines that the IAB-DU belongs to the IAB node; or if the context of the IAB node does not include the first identifier, the donor CU-CP determines that the IAB-DU does not belong to the IAB node. Furthermore, the donor CU-CP derives K after determining that the IAB-DU belongs to the IAB node. IAB_UP is derived.

[0595] S811: The donor CU-CP sends a bearer context modification request message to the donor CU-UP.

[0596] The Modify Bearer Context Request message specifies the IP address of the IAB-DU and the IAB_UP Includes:

[0597] For example, K IAB_UP may be carried in a security information information element included in the Modify Bearer Context Request message. IAB_UP MAY be carried in a newly defined information element within the Modify Bearer Context Request message.

[0598] Optionally, the modify bearer context request message further includes first indication information, where the first indication information indicates that the IAB-DU belongs to the IAB node. For example, the first indication information may be an independent information element. For example, the first indication information may be an "IAB indicator" information element. As another example, the first indication information may be an IP address or a K address of the IAB-DU. IAB_UP That is, the IP address of the IAB-DU or IAB_UP may further indicate that the IAB-DU belongs to the IAB node.

[0599] In this embodiment of the present application, the donor CU-CP sends the K IAB_UP Donor CU-UP to K IAB_UP It should be understood that sending K is used as an example for illustration purposes only and should not constitute any limitation to this embodiment of the present application. For example, the donor CU-CP may alternatively send K via a newly defined message. IAB_UP As another example, if the donor CU-CP predicts the IP address of the donor CU-UP before the donor CU-CP sends a Bearer Context Setup Request message to the donor CU-UP, the donor CU-UP may use the K IAB_UP and sends K via the Bearer Context Setup Request message. IAB_UP can be sent to the donor CU-UP.

[0600] S812: Donor CU-UP is K IAB_UP Remember.

[0601] Donor CU-UP will receive the IP address and K IAB_UP The correspondence between the donor and the CU-UP is stored in the context of the donor.

[0602] For example, donor CU-UP is IAB_UP When receiving K IAB_UP Remember.

[0603] In another example, the donor CU-UP includes first instruction information and K IAB_UP When receiving K IAB_UP Remember.

[0604] S813: The donor CU-UP sends a bearer context modification response message to the donor CU-CP.

[0605] S814: The UE sends a security mode completion to the IAB-DU.

[0606] S815: The IAB-DU sends an uplink RRC message transfer to the donor CU-CP.

[0607] S816: The donor CU-CP sends a downlink RRC message transfer to the IAB-DU.

[0608] S817: The IAB-DU sends an RRC reconfiguration message to the UE.

[0609] S818: The UE sends an RRC reconfiguration complete message to the IAB-DU.

[0610] S819: The IAB-DU sends an uplink RRC message transfer to the donor CU-CP.

[0611] S820: The donor CU-CP sends an initial context setup response message to the AMF.

[0612] S821: IAB-DU and donor CU-UP perform the IKEv2 PSK procedure.

[0613] Specifically, an F1-U interface bearer is established between the IAB-DU and the donor CU-UP, and the IAB-DU and the donor CU-UP negotiate and establish a secure transmission channel for the F1-U interface. For example, the IAB-DU and the donor CU-UP establish an IPsec secure transmission channel by using the IKEv2 PSK protocol. In the first message exchange, the IAB-DU and the donor CU-UP complete the IKE SA parameter negotiation in the clear, including negotiation, encryption, and authentication algorithms, temporary random number exchange, and DH exchange. In the second message exchange, the IAB-DU and the donor CU-UP negotiate and establish a secure transmission channel for the F1-U interface. IAB_UP and then sends the authentication parameters to the peer end to complete the identity authentication.

[0614] When the IAB-DU and the donor CU-UP establish an IPsec secure transmission channel by using the IKEv2 PSK protocol, the IAB-DU sends the K IAB_UP and the first IP address of the donor CU-UP, and based on the correspondence between K and the first IP address of the donor CU-UP, K is used as the authentication credential to be used when the IPsec secure transmission channel is established. IAB_UP The Donor CU-UP is stored in the context of the Donor CU-UP, K IAB_UP Based on the correspondence between the IP address of the IAB-DU and the IP address of the IAB-DU, K is used as the authentication credential to be used when the IPsec secure transmission channel is established. IAB_UP It can be seen that the decision to use

[0615] It should be further understood that the IKEv2 PSK procedure performed by the IAB-DU and donor CU-UP may be triggered by the IAB-DU or by the donor CU-UP. For example, when the IAB-DU receives a user plane data request from a UE, if the F1-U interface bearer between the IAB-DU and donor CU-UP is not established, the IAB-DU triggers the IKEv2 PSK procedure. As another example, when the donor CU-UP receives downlink data for the UE, if the F1-U interface bearer between the IAB-DU and donor CU-UP is not established, the donor CU-UP triggers the IKEv2 PSK procedure.

[0616] It should be further understood that whether S821 is executed before or after the UE completes registration is not limited in this embodiment of the present application. For example, S821 may be executed after S812. That is, S821 is executed when the IAB-DU and the donor CU-UP are registered. IAB_UP As another example, S821 may be performed after S820. For example, S821 is performed after the UE completes registration and there is user plane data for the UE to transmit.

[0617] 9 is a schematic flowchart of a method for establishing a secure transmission channel according to an embodiment of the present application. As shown in FIG. 9, the method 900 includes steps S901 to S925. Each step will be described in detail below.

[0618] S901: IAB-MT registers with the core network.

[0619] Specifically, in S901, steps 1 to 7 included in S801 of the above-described method 800 are executed.

[0620] S902: The AMF sends an initial context setup request message to the donor CU-CP.

[0621] The Initial Context Setup Request message carries an “IAB Authorization” indication and further contains the first root key (K 1 gNB After receiving the Initial Context Setup Request message, the donor CU-CP assigns the K 1 gNB The donor CU-CP may further determine that the IAB-MT belongs to the IAB node based on the "IAB authorization."

[0622] The core network checks the subscription data to determine whether the IAB-MT belongs to an IAB node. If the IAB-MT belongs to an IAB node, an "IAB Authorization" indication is sent to the donor CU-CP, indicating that the core network has authorized the IAB-MT to be an IAB node. Therefore, after the authentication between the core network and the IAB-MT is completed, the IAB-MT can 1 gNB Generate.

[0623] S903: The donor CU-CP sends a bearer context setup request message to the donor CU-UP.

[0624] The Bearer Context Setup Request message carries User Plane Key #1.

[0625] After receiving the Initial Context Setup Request message from the AMF, the donor CU-CP selects a user plane algorithm and 1 gNB where the user plane key #1 is for establishing a bearer context. The user plane key #1 includes a user plane integrity protection key (denoted Kupenc) and / or a user plane encryption protection key (denoted Kupint).

[0626] User plane key #1 is K 1 gNB This procedure is irreversible. Therefore, after receiving the user plane key #1, the donor CU-UP derives K based on the user plane key #1. 1 gNB In other words, the donor CU-UP does not have K 1 gNB There is no.

[0627] The bearer context setup request message further includes first indication information, where the first indication information indicates that the IAB-MT belongs to the IAB node. For example, the indication information may be an independent information element. For example, the first indication information is an "IAB indicator" information element.

[0628] Specifically, when it determines that the IAB-MT belongs to the IAB node, the donor CU-CP carries first indication information in the bearer context setup request message. For example, if the initial context setup request message received by the donor CU-CP from the AMF includes an "IAB Authorization" indication, the donor CU-CP determines that the IAB-MT belongs to the IAB node. As another example, if the RRC message transfer received by the donor CU-CP from the donor DU in S901 includes an "IAB Indication," the donor CU-CP determines that the IAB-MT belongs to the IAB node.

[0629] S904: The donor CU-UP sends a bearer context setup response message to the donor CU-CP.

[0630] The Bearer Context Setup Response message includes all possible IP addresses of the donor CU-UP, which are reported to the donor CU-CP based on the first indication information included in the Bearer Context Setup Request message.

[0631] For example, if donor CU-UP has three IP addresses, namely CU-UP IP 1, CU-UP IP 2, and CU-UP IP 3, donor CU-UP reports the three IP addresses to donor CU-CP.

[0632] S905: The donor CU-CP sends a UE context setup request message to the donor DU.

[0633] S906: The donor DU sends a security mode command to the IAB-MT.

[0634] S907: The donor DU sends a UE context setup response message to the donor CU-CP.

[0635] S908: Donor CU-CP is possible K IAB_UP is derived.

[0636] As described above, in S904, the donor CU-UP reports all possible IP addresses to the donor CU-CP based on the instruction information. Then, in S908, the donor CU-CP calculates the K IP addresses corresponding to each IP address of the donor CU-UP based on the received first IP address of the donor CU-UP. IAB_UP is derived.

[0637] For example, donor CU-CP is K 1 gNB as the input key, and the IP address of IAB-DU and CU-UP IP 1 are used as input parameters to obtain K corresponding to CU-UP IP 1. IAB-UP1 Derive; donor CU-CP, K 1 gNB as an input key, and the IP address of IAB-DU and CU-UP IP 2 are used as input parameters to obtain K corresponding to CU-UP IP 2. IAB-UP2 Derive; donor CU-CP, K 1 gNBas an input key, and the IP address of IAB-DU and CU-UP IP 3 are used as input parameters to obtain K corresponding to CU-UP IP 3. IAB-UP3 is derived.

[0638] It should be understood that S908 may be performed after S904, may be performed after S905, may be performed after S906, or may be performed after S907.

[0639] S909: The donor CU-CP sends a bearer context modification request message to the donor CU-UP.

[0640] The Modify Bearer Context Request message contains multiple keys K derived by the donor CU-CP. IAB-UP and the multiple keys K IAB-UP and a plurality of groups of first parameters corresponding to each key K IAB-UP The first group of parameters corresponds to K IAB-UP Contains input parameters for deriving

[0641] For example, the Modify Bearer Context Request message contains the IAB-UP1 , CU-UP 1, and IAB-DU IP}, {K IAB-UP2 , CU-UP 2, and IAB-DU IP}, and {K IAB-UP3 , CU-UP 3, and IAB-DU IP}.

[0642] {K IAB-UP1 , CU-UP 1, IAB-DU IP} is the IP address of IAB-DU and CU-UP IP 1 and K IAB-UP1 indicates the correspondence between {K IAB-UP2 , CU-UP 2, IAB-DU IP} is the IP address of IAB-DU and CU-UP IP 2 and K IAB-UP2 and {K IAB-UP3 , CU-UP 3, IAB-DU IP} is IAB-DU IP and CU-UP IP 3 and K IAB-UP3This shows the correspondence between

[0643] S910: Donor CU-UP is K IAB-UP Remember.

[0644] Specifically, the donor CU-UP may, in the context of the donor CU-UP, IAB-UP and stores a correspondence between the first parameter group and the plurality of groups of the first parameter included in the modify bearer context request message.

[0645] S911: The donor CU-UP sends a bearer context modification response message to the donor CU-CP.

[0646] S912: IAB-MT completes the registration procedure.

[0647] Specifically, in S912, steps 16 to 22 included in S801 of the above-described method 800 are executed.

[0648] S913: IAB-DU is initiated to set up F1-C interface security with donor CU-CP.

[0649] Specifically, S913 is the same as S802 in the above-described method 800. For the sake of brevity, the details will not be described again here.

[0650] S914: The UE accesses the network via the IAB-DU and performs authentication.

[0651] Specifically, S914 is the same as S803 in the above-described method 800. For the sake of brevity, the details will not be described again here.

[0652] S915: The donor CU-CP sends a bearer context setup request message to the donor CU-UP.

[0653] Specifically, S915 is the same as S804 in the above-described method 800. For the sake of brevity, the details will not be described again here.

[0654] S916: The donor CU-UP sends a bearer context setup response message to the donor CU-CP.

[0655] The Bearer Context Setup Response message carries the first IP address of the donor CU-UP, which is used to establish a secure transmission channel of the F1-U interface between the IAB-DU and the donor CU-UP for transferring user plane data. For example, the first IP address of the donor CU-UP is CU-UP IP 3 in S904.

[0656] S917: The donor CU-CP sends a UE context setup request message to the IAB-DU.

[0657] The UE context setup request message includes the first IP address of the donor CU-UP, for example, the first IP address of the donor CU-UP is CU-UP IP 3 in S904.

[0658] S918: The IAB-DU sends a security mode command to the UE.

[0659] S919: The IAB-DU sends a UE context setup response to the donor CU-CP.

[0660] S920:IAB-DU is K IAB_UP Get.

[0661] Specifically, IAB-DU is IAB_UPFor the manner of obtaining the IP address, please refer to the description of S809 in the method 800 above. As described in S917, the first IP address of the donor CU-UP received by the IAB-DU is CU-UP IP 3. In this case, in S920, the IP address of the donor CU-UP received by the IAB-DU is CU-UP IP 3. IAB_UP is K 1 gNB as the input key, and the IP address of the IAB-DU and the CU-UP IP 3 as input parameters. IAB_UP is K in S908 IAB_UP3 is.

[0662] S921: The donor CU-CP sends a bearer context modification request message to the donor CU-UP.

[0663] The Modify Bearer Context Request message contains the IP address of the IAB-DU.

[0664] S922: The donor CU-UP sends a bearer context modification response message to the donor CU-CP.

[0665] S923: Donor CU-UP is K IAB_UP Search for.

[0666] Specifically, the donor CU-UP determines the corresponding K based on the first IP address of the donor CU-UP determined in S916 and the IP address of the IAB-DU received in S921 to establish a secure transmission channel of the F1-U interface between the IAB-DU and the donor CU-UP. IAB_UP For example, if the first IP address for establishing a secure transmission channel of the F1-U interface determined by the donor CU-UP in S916 is CU-UP IP 3, the donor CU-UP may search the locally stored context of the donor CU-UP for the first IP address, K IAB_UPand the plurality of groups of first parameters based on the stored correspondence between K IAB_UP3 corresponds to the address of IAB-DU and CU-UP IP 3.

[0667] K IAB_UP3 After determining the IP address of the IAB-DU, the donor CU-UP will IAB_UP3 The correspondence between the two is stored in the context of the donor CU-UP.

[0668] S924: The UE completes the registration procedure.

[0669] Specifically, in S924, steps S814 to S820 in the method 800 described above are performed.

[0670] S925: IAB-DU and donor CU-UP perform the IKEv2 PSK procedure.

[0671] Specifically, S925 is the same as S821 in the above-described method 800. For the sake of brevity, the details will not be described again here.

[0672] 10 is a schematic flowchart of a method for establishing a secure transmission channel according to an embodiment of the present application. As shown in FIG. 10, the method 1000 includes steps S1001 to S1023. Each step will be described in detail below.

[0673] S1001: IAB-MT registers with the core network.

[0674] Specifically, in S1001, steps 1 to 7 included in S801 of the above-described method 800 are executed.

[0675] S1002: The AMF sends an initial context setup request message to the donor CU-CP.

[0676] Specifically, S1002 is the same as S902 in the above-described method 900. For the sake of brevity, the details will not be described again here.

[0677] S1003: The donor CU-CP sends a bearer context setup request message to the donor CU-UP.

[0678] The Bearer Context Setup Request message carries User Plane Key #1 and an intermediate key (denoted as Km).

[0679] After receiving the Initial Context Setup Request message from the AMF, the donor CU-CP selects a user plane algorithm and 1 gNB where the user plane key #1 is for establishing a bearer context. The user plane key #1 includes a user plane integrity protection key (denoted Kupenc) and / or a user plane encryption protection key (denoted Kupint).

[0680] User plane key #1 is K 1 gNB This procedure is irreversible. Therefore, after receiving the user plane key #1, the donor CU-UP derives K based on the user plane key #1. 1 gNB In other words, the donor CU-UP does not have K 1 gNB There is no.

[0681] Km is K IAB_UP is used as the input key to generate K IAB_UP For example, Km is the 1 gNBand a second parameter. The second parameter includes one or more of PCI, ARFCN-DL, a secondary node counter, a constant, and a freshness parameter. In another example, Km is a random number generated by the donor CU-UP.

[0682] Optionally, when it determines that the IAB-MT belongs to the IAB node, the donor CU-CP generates Km or sends Km to the donor CU-UP. For example, if the initial context setup request message received by the donor CU-CP from the AMF includes an "IAB Authorization" indication, the donor CU-CP determines that the IAB-MT belongs to the IAB node. As another example, if the RRC message transfer received by the donor CU-CP from the donor DU in S901 includes an IAB indication, the donor CU-CP determines that the IAB-MT belongs to the IAB node.

[0683] Optionally, the bearer context setup request message further includes first indication information, where the first indication information indicates that the IAB-MT belongs to the IAB node. For example, the first indication information may be an independent information element. For example, the first indication information is an "IAB indicator" information element. In another example, the first indication information is Km. That is, Km further indicates that the IAB-MT belongs to the IAB node.

[0684] Specifically, when determining that the IAB-MT belongs to the IAB node, the donor CU-CP carries first indication information in the bearer context setup request message.

[0685] S1004: Donor CU-UP stores Km.

[0686] For example, the donor CU-UP stores Km in the context of the donor CU-UP.

[0687] Optionally, if the bearer context setup request message further includes first indication information, in S1004, the donor CU-UP further stores the first indication information.

[0688] S1005: The donor CU-UP sends a bearer context setup response message to the donor CU-CP.

[0689] S1006: IAB-MT completes AS security activation.

[0690] Specifically, in S1006, steps 11 to 17 included in S801 of the above-described method 800 are executed.

[0691] S1007: The donor CU-CP sends a downlink RRC message transmission to the donor DU.

[0692] The RRC message transmission includes an RRC reconfiguration message. Optionally, in S1003, if the Km generated by the donor CU-CP is a random number, the RRC reconfiguration message includes Km.

[0693] Alternatively, in S1003, if the second parameters used by the donor CU-CP to generate Km include a parameter unknown to the IAB-MT, the RRC reconfiguration message includes Km or the parameter unknown to the IAB-MT among the second parameters for generating Km. For example, the second parameters used by the donor CU-CP to generate Km include a random number and a PCI, where the random number is a parameter unknown to the IAB-MT and the PCI is a parameter known to the IAB-MT. In this case, the donor CU-CP conveys Km or the random number included in the second parameters in the RRC reconfiguration message.

[0694] S1008: The donor DU sends an RRC reconfiguration message to the IAB-MT.

[0695] The donor DU sends an RRC reconfiguration message included in the downlink RRC message transfer to the IAB-MT.

[0696] S1009: The IAB-MT stores Km or a parameter unknown to the IAB-MT among the second parameters for generating Km.

[0697] If the RRC reconfiguration information received by the IAB-MT includes Km or a parameter among the second parameters for generating Km that is unknown to the IAB-MT, the IAB-MT stores Km or a parameter among the second parameters for generating Km that is unknown to the IAB-MT.

[0698] S1010:IAB-MT completes registration.

[0699] Specifically, in S1010, steps 20 to 22 included in S801 of the above-described method 800 are executed.

[0700] S1011: IAB-DU is initiated to set up F1-C interface security with donor CU-CP.

[0701] Specifically, S913 is the same as S802 in the above-described method 800. For the sake of brevity, the details will not be described again here.

[0702] S1012: The UE accesses the network via the IAB-DU and performs authentication.

[0703] Specifically, S1012 is the same as S803 in the above-described method 800. For the sake of brevity, the details will not be described again here.

[0704] S1013: The donor CU-CP sends a bearer context setup request message to the donor CU-UP.

[0705] Specifically, S1013 is the same as S804 in the above-described method 800. For the sake of brevity, the details will not be described again here.

[0706] S1014: The donor CU-UP sends a bearer context setup response message to the donor CU-CP.

[0707] The Bearer Context Setup Response message carries the first IP address of the donor CU-UP, which is used to establish a secure transmission channel of the F1-U interface between the IAB-DU and the donor CU-UP for transferring user plane data.

[0708] S1015: The donor CU-CP sends a UE context setup request message to the IAB-DU.

[0709] The UE Context Setup Request message includes the first IP address of the donor CU-UP.

[0710] S1016: The IAB-DU sends a security mode command to the UE.

[0711] S1017: The IAB-DU sends a UE context setup response message to the donor CU-CP.

[0712] S1018:IAB-DU is K IAB_UP Get.

[0713] For example, S1018 includes S10181a to S10183a.

[0714] S10181a: The IAB-DU sends a first request message to the IAB-MT.

[0715] The first request message includes a first IP address of the donor CU-UP, and the first request message includes a first IP address of the donor CU-UP.IAB_UP request.

[0716] S10182a:IAB-MT is K IAB_UP is derived.

[0717] After receiving the first request message from the IAB-DU, the IAB-MT uses Km as an input key and the IP address of the IAB-DU and the first IP address of the donor CU-UP as input parameters to calculate Km. IAB-UP Then, K IAB-UP to the IAB-DU. It can be understood that the IP address of the IAB-DU is obtained from the OAM or the donor CU-CP after the IAB-MT completes registration.

[0718] S10183a: The IAB-MT sends a first response message to the IAB-DU.

[0719] The first response message is IAB_UP Includes:

[0720] Therefore, K IAB_UP After receiving the IAB_UP For example, IAB-DU stores K IAB_UP and the first IP address of the donor CU-UP.

[0721] In another example, S1018 includes S10181b to S10183b.

[0722] S10181b: The IAB-DU sends a third request message to the IAB-MT.

[0723] The third request message requests Km or K 1 gNB and requires a second parameter.

[0724] S10182b: The IAB-MT sends a third response message to the IAB-DU.

[0725] The third response message contains Km or K 1 gNB and a second parameter.

[0726] S10183b:IAB-DU is K IAB_UP is derived.

[0727] If the third response message includes Km, the IAB-DU derives Km by using Km as an input key and the IP address of the IAB-DU and the first IP address of the donor CU-UP as input parameters. IAB-UP It can be seen that the IP address of the IAB-DU is obtained from the IAB-MT after the IAB-DU is initiated.

[0728] The third response message is K 1 gNB and the second parameter, IAB-DU first calculates K 1 gNB and the second parameter, and then derive Km by using Km as an input key and the IP address of IAB-DU and the first IP address of donor CU-UP as input parameters. IAB-UP is derived.

[0729] Furthermore, K IAB_UP After deriving, IAB-DU IAB_UP For example, IAB-DU stores K IAB_UP and the first IP address of the donor CU-UP.

[0730] K by IAB-DU IAB_UP It should be understood that the opportunity to obtain is not limited in this embodiment of the present application.

[0731] In one example, when the IAB-DU obtains the first IP address of the donor CU-UP, IAB_UP Get.

[0732] In another example, IAB-DU may request K before initiating the IPsec setup procedure with donor CU-UP. IAB_UP Get.

[0733] In yet another example, the IAB-DU may request the K after receiving an IPsec authentication request from the donor CU-UP. IAB_UP Get.

[0734] In yet another example, the IAB-DU may send a user plane data request to the K IAB_UP Get.

[0735] S1019: The donor CU-CP sends a bearer context modification request message to the donor CU-UP.

[0736] The Modify Bearer Context Request message contains the IP address of the IAB-DU.

[0737] S1020: The donor CU-UP sends a bearer context modification response message to the donor CU-CP.

[0738] S1021: Donor CU-UP is K IAB_UP is derived.

[0739] The donor CU-UP uses Km as an input key and the IP address of the IAB-DU and the first IP address of the donor CU-UP as input parameters to calculate K IAB-UP is derived.

[0740] Km is obtained from the donor CU-UP's locally stored context. The first IP address of the donor CU-UP is determined in S1014.

[0741] K IAB_UP After deriving the IP address of the IAB-DU, the donor CU-UP IAB_UPThe correspondence between the two is stored in the context of the donor CU-UP.

[0742] S1022: The UE completes the registration procedure.

[0743] Specifically, in S1022, S814 to S820 in the method 800 described above are performed.

[0744] S1023: IAB-DU and donor CU-UP perform the IKEv2 PSK procedure.

[0745] Specifically, S1023 is the same as S821 in the above-described method 800. For the sake of brevity, the details will not be described again here.

[0746] 11 is a schematic flowchart of a method for establishing a secure transmission channel according to an embodiment of the present application. As shown in FIG. 11, the method 1100 includes steps S1101 to S1114. Each step will be described in detail below.

[0747] S1101: The IAB-MT registration procedure is executed.

[0748] Specifically, S1101 is the same as S801 of method 800. For brevity, the details will not be described again here.

[0749] In S1001, after the authentication between the IAB-MT and the core network is completed, the initial context setup request message sent by the AMF to the donor CU-CP includes the first root key (K 1 gNB Furthermore, the donor CU-CP contains K 1 gNBand sends the User Plane Key #1 to the donor CU-UP. The User Plane Key #1 is for establishing a bearer context. The User Plane Key #1 includes a User Plane Integrity Protection Key (denoted Kupenc) and / or a User Plane Encryption Protection Key (denoted Kupint).

[0750] Therefore, after the authentication between IAB-MT and the core network is completed, IAB-MT will 1 gNB IAM-MT generates K 1 gNB User Plane Key #1 may be derived based on

[0751] S1102: IAB-DU is initiated to set up F1-C interface security with donor CU-CP.

[0752] Specifically, S1102 is the same as S802 of method 800. For brevity, the details will not be described again here.

[0753] Note that after the donor CU-CP and the IAB-DU establish a secure transmission channel of the F1-C interface, the donor CU-CP marks the IAB-DU as an IAB node by using a first identifier, and stores the first identifier as the context of the IAB node. For example, the first identifier is the IP address of the IAB-DU.

[0754] S1103: The UE accesses the network via the IAB-DU and performs authentication.

[0755] Specifically, S1103 is the same as S803 of method 800. For the sake of brevity, the details will not be described again here.

[0756] S1104: The donor CU-CP sends a bearer context setup request message to the donor CU-UP.

[0757] S1105: The donor CU-UP sends a bearer context setup response message to the donor CU-CP.

[0758] The Bearer Context Setup Response message carries the first IP address of the donor CU-UP, which is used to establish a secure transmission channel of the F1-U interface between the IAB-DU and the donor CU-UP for transferring user plane data.

[0759] S1106: The donor CU-CP sends a UE context setup request message to the IAB-DU.

[0760] The UE Context Setup Request message includes the first IP address of the donor CU-UP.

[0761] S1107: The IAB-DU sends a security mode command to the UE.

[0762] S1108: The IAB-DU sends a UE context setup response to the donor CU-CP.

[0763] S1109:IAB-DU is K IAB_UP Get.

[0764] For example, S1109 includes S11091a to S11093a.

[0765] S11091a: The IAB-DU sends a first request message to the IAB-MT.

[0766] The first request message includes a first IP address of the donor CU-UP, and the first request message includes a first IP address of the donor CU-UP. IAB_UP request.

[0767] S11092a:IAB-MT is K IAB_UP is derived.

[0768] After receiving the first request message from the IAB-DU, the IAB-MT uses the User Plane Key #1 as the input key and the IP address of the IAB-DU and the first IP address of the donor CU-UP as input parameters to calculate K IAB-UP Then, K IAB-UP to the IAB-DU. It can be understood that the IP address of the IAB-DU is obtained from the OAM or the donor CU-CP after the IAB-MT completes registration.

[0769] Alternatively, the IAB-MT may use a key derived from User Plane Key #1 as an input key and the IP address of the IAB-DU and the first IP address of the donor CU-UP as input parameters to generate K IAB-UP is derived.

[0770] S11093a: The IAB-MT sends a first response message to the IAB-DU.

[0771] The first response message is IAB_UP Includes:

[0772] Therefore, K IAB_UP After receiving the IAB_UP For example, IAB-DU stores K IAB_UP and the first IP address of the donor CU-UP.

[0773] In another example, S1109 includes S11091b to S11093b.

[0774] S11091b: The IAB-DU sends a third request message to the IAB-MT.

[0775] The third request message requests User Plane Key #1.

[0776] S11092b: The IAB-MT sends a third response message to the IAB-DU.

[0777] The third response message includes User Plane Key #1.

[0778] It should be understood that S11091b and S11092b are optional steps. 1 gNB In other words, if IAB-DU stores the locally stored K 1 gNB Based on the K stored locally by the IAB-DU, 1 gNB is obtained from the IAB-MT before S1109 is executed. For example, after the IAB-DU is started, the IAB-MT sends the IP address of the IAB-DU to the IAB-DU. 1 gNB to IAB-DU.

[0779] S11093b:IAB-DU is K IAB_UP is derived.

[0780] The IAB-DU derives K by using User Plane Key #1 as the input key and the IP address of the IAB-DU and the first IP address of the donor CU-UP as input parameters. IAB-UP It can be seen that the IP address of the IAB-DU is obtained from the IAB-MT after the IAB-DU is initiated.

[0781] The IAB-DU derives K by using the key derived from User Plane Key #1 as the input key and the IP address of the IAB-DU and the first IP address of the donor CU-UP as input parameters. IAB-UP is derived.

[0782] Furthermore, K IAB_UP After deriving, IAB-DUIAB_UP For example, IAB-DU stores K IAB_UP and the first IP address of the donor CU-UP.

[0783] K by IAB-DU IAB_UP It should be understood that the opportunity to obtain is not limited in this embodiment of the present application.

[0784] In one example, when the IAB-DU obtains the first IP address of the donor CU-UP, IAB_UP Get.

[0785] In another example, IAB-DU may request K before initiating the IPsec setup procedure with donor CU-UP. IAB_UP Get.

[0786] In yet another example, the IAB-DU may request the K after receiving an IPsec authentication request from the donor CU-UP. IAB_UP Get.

[0787] In yet another example, the IAB-DU may send a user plane data request to the K IAB_UP Get.

[0788] S1110: The donor CU-CP sends a bearer context modification request message to the donor CU-UP.

[0789] The Modify Bearer Context Request message contains the IP address of the IAB-DU.

[0790] Optionally, the modify bearer context request message further includes first indication information, where the first indication information indicates that the IAB-DU belongs to the IAB node. For example, the first indication information may be an independent information element. For example, the first indication information may be an "IAB indicator" information element. In another example, the first indication information may be an IP address of the IAB-DU. That is, the IP address of the IAB-DU may further indicate that the IAB-DU belongs to the IAB node.

[0791] Specifically, after determining that the IAB-DU belongs to the IAB node, the donor CU-CP carries first indication information in the modify bearer context request message. As described in S1102, the donor CU-CP may mark the IAB-DU as belonging to the IAB node by using the first identifier and store the first identifier in the IAB-DU's context. Based on this, the donor CU-CP can inquire whether the IAB node's context includes the first identifier. If the IAB node's context includes the first identifier, the donor CU-CP determines that the IAB-DU belongs to the IAB node. If the IAB node's context does not include the first identifier, the donor CU-CP determines that the IAB-DU does not belong to the IAB node.

[0792] S1111: Donor CU-UP is K IAB_UP is derived.

[0793] The donor CU-UP derives K by using the user plane key as an input key and the IP address of the IAB-DU and the first IP address of the donor CU-UP as input parameters. IAB-UP is derived.

[0794] Alternatively, the donor CU-UP may use a key derived from the user plane key as an input key and the IP address of the IAB-DU and the first IP address of the donor CU-UP as input parameters to generate K IAB-UP is derived.

[0795] For example, after receiving a Bearer Context Setup Request message from a Donor CU-CP, the Donor CU-UP may select the K based on the first IP address of the Donor CU-UP included in the Bearer Context Setup Response message. IAB-UP is derived.

[0796] In another example, if the bearer context setup request message includes first indication information, the donor CU-UP may select the K based on the first IP address of the donor CU-UP included in the bearer context setup response message. IAB-UP In other words, after determining that the IAB-DU belongs to the IAB node based on the first indication information, the donor CU-UP derives K IAB-UP is derived.

[0797] K IAB_UP After deriving the IP address of the IAB-DU, the donor CU-UP IAB_UP The correspondence between the two is stored in the context of the donor CU-UP.

[0798] S1112: The donor CU-UP sends a bearer context modification response message to the donor CU-CP.

[0799] S1113: The UE completes the registration procedure.

[0800] Specifically, in S1113, steps S814 to S820 in the method 800 described above are performed.

[0801] S1114: IAB-DU and donor CU-UP perform the IKEv2 PSK procedure.

[0802] Specifically, S1114 is the same as S821 in the above-described method 800. For the sake of brevity, the details will not be described again here.

[0803] With reference to Figures 5 to 11, the above describes in detail the method provided in the embodiment of the present application. With reference to Figures 12 and 13, the following describes in detail the communication device provided in the embodiment of the present application. It should be understood that the description of the device embodiment corresponds to the description of the method embodiment. Therefore, for the contents not described in detail, please refer to the above method embodiment. For the sake of brevity, the details will not be described again here.

[0804] In the embodiment of the present application, the division of the sending device or the receiving device may be divided into functional modules based on the above-mentioned example method. For example, each functional module may be obtained through division corresponding to each function, or two or more functions may be integrated into one processing module. The integrated module may be implemented in the form of hardware or in the form of a software functional module. It should be noted that in the embodiment of the present application, the division into modules is an example and is merely a logical division of functions. In actual implementation, other division methods may be used. In the following, an explanation is provided by using an example in which each functional module is obtained through division corresponding to each function.

[0805] 12 is a schematic block diagram of a communication device 1200 according to an embodiment of the present application. As shown, the communication device 1200 may include a transceiver unit 1210 and a processing unit 1220.

[0806] In one possible design, the communication device 1200 may be a donor CU-UP in the aforementioned method embodiments, or may be a chip configured to implement the functionality of the donor CU-UP in the aforementioned method embodiments.

[0807] It should be understood that the communication device 1200 may correspond to the session management network element in methods 500 to 1100 according to the embodiments of the present application. The communication device 1200 may include units configured to perform the methods performed by the donor CU-UP in method 500 of FIG. 5, method 600 of FIG. 6, method 700 of FIG. 7, method 800 of FIG. 8, method 900 of FIG. 9, method 1000 of FIG. 10, and method 1100 of FIG. 11. In addition, the units in the communication device 1200 and other operations and / or functions described above are separately for implementing corresponding procedures in method 500 of FIG. 5, method 600 of FIG. 6, method 700 of FIG. 7, method 800 of FIG. 8, method 900 of FIG. 9, method 1000 of FIG. 10, and method 1100 of FIG. 11. It should be understood that the specific processes by which the units perform the corresponding steps described above have been described in detail in the above method embodiments. For the sake of brevity, the details will not be described again here.

[0808] In another possible design, the communication device 1200 may be the donor CU-CP in the aforementioned method embodiments, or may be a chip configured to implement the functionality of the donor CU-CP in the aforementioned method embodiments.

[0809] It should be understood that the communication device 1200 may correspond to the donor CU-CP in methods 500 to 1100 according to the embodiments of the present application. The communication device 1200 may include units configured to perform the methods performed by the donor CU-CP in method 500 of FIG. 5, method 600 of FIG. 6, method 700 of FIG. 7, method 800 of FIG. 8, method 900 of FIG. 9, method 1000 of FIG. 10, and method 1100 of FIG. 11. In addition, the units in the communication device 1200 and other operations and / or functions described above are separately for implementing corresponding procedures in method 500 of FIG. 5, method 600 of FIG. 6, method 700 of FIG. 7, method 800 of FIG. 8, method 900 of FIG. 9, method 1000 of FIG. 10, and method 1100 of FIG. 11. It should be understood that the specific processes by which the units perform the corresponding steps described above have been described in detail in the above method embodiments. For the sake of brevity, the details will not be described again here.

[0810] In another possible design, the communication device 1200 may be the IAB-DU in the aforementioned method embodiments, or may be a chip configured to implement the functionality of the IAB-DU in the aforementioned method embodiments.

[0811] It should be understood that the communication device 1200 may correspond to the IAB-DU in methods 500 to 1100 according to the embodiments of the present application. The communication device 1200 may include units configured to perform the methods performed by the IAB-DU in method 500 of FIG. 5, method 600 of FIG. 6, method 700 of FIG. 7, method 800 of FIG. 8, method 900 of FIG. 9, method 1000 of FIG. 10, and method 1100 of FIG. 11. In addition, the units in the communication device 1200 and other operations and / or functions described above are separately for implementing corresponding procedures in method 500 of FIG. 5, method 600 of FIG. 6, method 700 of FIG. 7, method 800 of FIG. 8, method 900 of FIG. 9, method 1000 of FIG. 10, and method 1100 of FIG. 11. It should be understood that the specific processes by which the units perform the corresponding steps described above have been described in detail in the above method embodiments. For the sake of brevity, the details will not be described again here.

[0812] In another possible design, the communication device 1200 may be the IAB-MT in the aforementioned method embodiments, or may be a chip configured to implement the functionality of the IAB-MT in the aforementioned method embodiments.

[0813] It should be understood that the communication device 1200 may correspond to the IAB-MT in methods 500 to 1100 according to the embodiments of the present application. The communication device 1200 may include units configured to perform the methods performed by the IAB-MT in method 500 of FIG. 5, method 600 of FIG. 6, method 700 of FIG. 7, method 800 of FIG. 8, method 900 of FIG. 9, method 1000 of FIG. 10, and method 1100 of FIG. 11. In addition, the units in the communication device 1200 and other operations and / or functions described above are separately for implementing corresponding procedures in method 500 of FIG. 5, method 600 of FIG. 6, method 700 of FIG. 7, method 800 of FIG. 8, method 900 of FIG. 9, method 1000 of FIG. 10, and method 1100 of FIG. 11. It should be understood that the specific processes by which the units perform the corresponding steps described above have been described in detail in the above method embodiments. For the sake of brevity, the details will not be described again here.

[0814] It should be further understood that the transceiver unit 1210 in the communication device 1200 may correspond to the transceiver 1320 in the communication device 1300 shown in FIG. 13, and the processing unit 1220 in the communication device 1200 may correspond to the processor 1310 in the communication device 1300 shown in FIG. 13.

[0815] It should be further understood that when the communication device 1200 is a chip, the chip includes a transceiver unit and a processing unit. The transceiver unit may be an input / output circuit or a communication interface. The processing unit may be a processor, a microprocessor, or an integrated circuit integrated on the chip.

[0816] The transceiver unit 1210 is configured to implement signal reception and transmission operations of the communication device 1200 , and the processing unit 1220 is configured to implement signal processing operations of the communication device 1200 .

[0817] Optionally, the communication device 1200 further includes a storage unit 1230, which is configured to store instructions.

[0818] 13 is a schematic block diagram of a communication device 1300 according to an embodiment of the present application. As shown in the figure, the communication device 1300 includes at least one processor 1310 and a transceiver 1320. The processor 1310 is coupled to a memory and configured to execute instructions stored in the memory to control the transceiver 1320 to transmit signals and / or receive signals. Optionally, the communication device 1300 further includes a memory 1330 configured to store instructions.

[0819] It should be understood that the processor 1310 and the memory 1330 may be integrated into a single processing unit. The processor 1310 is configured to execute program code stored in the memory 1330 to perform the functions described above. During a particular implementation, the memory 1330 may alternatively be integrated into the processor 1310 or may be separate from the processor 1310.

[0820] It should be further understood that the transceiver 1320 may include a receiver (also called a receiver) and a transmitter (also called a transmitter). The transceiver 1320 may further include an antenna. There may be one or more antennas. The transceiver 1320 may be a communications interface or interface circuit.

[0821] When the communication device 1300 is a chip, the chip includes a transceiver unit and a processing unit. The transceiver unit may be an input / output circuit or a communication interface. The processing unit may be a processor, a microprocessor, or an integrated circuit integrated on the chip. Some embodiments of the present application further provide a processing device including a processor and an interface. The processor may be configured to perform the method in the above-described method embodiments.

[0822] It should be understood that the processing device may be a chip, for example, a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), a system on chip (SoC), a central processing unit (CPU), a network processor (NP), a digital signal processor (DSP), a microcontroller unit (MCU), a programmable logic device (PLD), or another integrated chip.

[0823] In some implementation processes, the steps in the aforementioned methods may be completed by using integrated logic circuits of hardware in a processor or by using instructions in the form of software. The steps in the methods disclosed with reference to the embodiments of the present application may be directly executed and completed by a hardware processor, or may be executed and completed by using a combination of hardware and software modules in a processor. The software modules may be located in a storage medium that is mature in the art, such as a random access memory, flash, read-only memory, programmable read-only memory, electrically erasable programmable memory, or register. The storage medium is located in the memory, and the processor reads information in the memory and completes the steps in the aforementioned methods in combination with the hardware of the processor. To avoid repetition, details will not be described again here.

[0824] It should be noted that the processor in the embodiments of the present application may be an integrated circuit chip and have signal processing capabilities. In some implementation processes, the steps in the aforementioned method embodiments may be completed by using integrated logic circuitry in a hardware within the processor or by using instructions in the form of software. The processor may be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic device, a discrete gate or transistor logic device, or a discrete hardware component. The processor may implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of the present application. The general-purpose processor may be a microprocessor, or the processor may be any conventional processor, etc. The steps in the methods disclosed with reference to the embodiments of the present application may be directly executed and completed by a hardware decode processor, or may be executed and completed by using a combination of hardware and software modules in the decode processor. The software modules may be located in a storage medium mature in the art, such as a random access memory, flash, read-only memory, programmable read-only memory, electrically erasable programmable memory, or register. The storage medium is located in the memory, and the processor reads the information in the memory and completes the steps in the aforementioned method in combination with the processor's hardware.

[0825] It will be understood that the memory in the embodiments of the present application may be volatile memory or nonvolatile memory, or may include volatile memory and nonvolatile memory. Nonvolatile memory may be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash. Volatile memory may be random access memory (RAM) used as an external cache. By way of example and not limitation, many forms of RAM may be used, such as static random access memory (static RAM, SRAM), dynamic random access memory (dynamic RAM, DRAM), synchronous dynamic random access memory (synchronous DRAM, SDRAM), double data rate synchronous dynamic random access memory (double data rate SDRAM, DDR SDRAM), enhanced synchronous dynamic random access memory (enhanced SDRAM, ESDRAM), synchlink dynamic random access memory (synchlink DRAM, SLDRAM), and direct rambus random access memory (direct rambus RAM, DR RAM). Note that memory in the systems and methods herein is intended to include, but is not limited to, these and any other suitable types of memory.

[0826] In accordance with the method provided in the embodiments of the present application, the present application further provides a computer program product, which includes computer program code, which, when executed on a computer, enables the computer to perform the method in any one of the embodiments shown in Figures 5 to 11.

[0827] In accordance with the method provided in the embodiments of the present application, the present application further provides a computer-readable medium storing program code, which, when executed on a computer, enables the computer to perform the method in any one of the embodiments shown in Figures 5 to 11.

[0828] According to the methods provided in the embodiments of the present application, the present application further provides a system including the aforementioned donor CU-CP, donor CU-UP, IAB-DU, and IAB-MT.

[0829] All or part of the above-described embodiments may be implemented using software, hardware, firmware, or any combination thereof. When software is used to implement an embodiment, all or part of the embodiment may be implemented in the form of a computer program product. A computer program product includes one or more computer instructions. When the computer instructions are loaded into a computer and executed, the procedures or functions according to the embodiments of the present application are generated, in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or another programmable device. The computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions may be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wire (e.g., coaxial cable, fiber optics, or digital subscriber line (DSL)) or wireless (e.g., infrared, radio, or microwave) methods. A computer-readable storage medium may be any available medium that can be accessed by a computer, or a data storage device that integrates one or more available media, such as a server or a data center. The available medium may be magnetic media (e.g., floppy disks, hard disk drives, or magnetic tapes), optical media (e.g., digital video discs (DVDs)), semiconductor media (e.g., solid-state drives (SSDs)), etc.

[0830] The network side device and the terminal device in the above-mentioned apparatus embodiments correspond to the network side device or the terminal device in the method embodiments. Corresponding modules or units perform corresponding steps. For example, a communication unit (transceiver) performs the receiving step or the transmitting step in the method embodiments, and steps other than the transmitting step and the receiving step may be performed by a processing unit (processor). For the functions of specific units, please refer to the corresponding method embodiments. There may be one or more processors.

[0831] As used herein, terms such as “component,” “module,” and “system” refer to computer-related entities, hardware, firmware, a combination of hardware and software, software, or software being executed. For example, a component may be, but is not limited to, a process running on a processor, a processor, an object, an executable, a thread of execution, a program, and / or a computer. As illustrated using the figures, both computing devices and applications running on computing devices may be components. One or more components may reside within a process and / or thread of execution, and a component may be located on one computer and / or distributed between two or more computers. Additionally, these components may be executed by various computer-readable media that store various data structures. For example, components may communicate using local and / or remote processes based on signals having one or more data packets (e.g., data from two components interacting with another component using signals within a local system, within a distributed system, and / or across a network such as the Internet).

[0832] Those skilled in the art may recognize that, in combination with the examples described in the embodiments disclosed herein, the units and algorithm steps may be implemented by electronic hardware or a combination of computer software and electronic hardware. Whether a function is performed by hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art may use different methods to implement functions for each specific application, but such implementations should not be considered to go beyond the scope of this application.

[0833] For the sake of convenience, those skilled in the art can clearly understand that the detailed operation processes of the aforementioned systems, devices and units may refer to the corresponding processes in the aforementioned method embodiments, and the details will not be described again here.

[0834] In some embodiments provided herein, it should be understood that the disclosed systems, devices, and methods may be implemented in other manners. For example, the device embodiments described above are merely examples. For example, the division into units is merely a logical division of function, and other divisions may be used in actual implementation. For example, multiple units or components may be combined or integrated into another system, or some features may be omitted or not implemented. In addition, the shown or discussed mutual couplings or direct couplings or communication connections may be implemented by using some interfaces. Indirect couplings or communication connections between devices or units may be implemented electrically, mechanically, or in other ways.

[0835] The units described as separate parts may or may not be physically separate, and the parts shown as units may or may not be physical units, i.e., they may be located in one location or distributed over multiple network units. Some or all of the units may be selected based on actual requirements to achieve the objectives of the solutions of the embodiments.

[0836] In addition, the functional units in the embodiments of the present application may be integrated into one processing unit, and each of the units may exist physically alone, or two or more units may be integrated into one unit.

[0837] When a function is implemented in the form of a software functional unit and sold or used as an independent product, the function may be stored in a computer-readable storage medium. Based on this understanding, the technical solution in this application, or a portion of the technical solution, may essentially be implemented in the form of a software product. The computer software product is stored in a storage medium and includes instructions for instructing a computer device (which may be a personal computer, a server, a network device, etc.) to execute all or part of the steps of the method in the embodiments of this application. The aforementioned storage medium includes any medium capable of storing program code, such as a USB flash drive, a removable hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0838] The above description is merely a specific implementation of the present application, and the scope of protection of the present application is not limited thereto. Any modifications or replacements that can be easily conceived by those skilled in the art within the technical scope disclosed in the present application fall within the scope of protection of the present application. Therefore, the scope of protection of the present application is subject to the scope of protection of the claims.

Claims

1. 1. A key determination method, the method being applied to a control plane entity of a donor node central unit, the donor node central unit further including a user plane entity, the method comprising: deriving a first key based on a root key, an Internet Protocol IP address of a distribution unit of an integrated access and backhaul node, and a first IP address of the user plane entity, wherein the first key is different from the root key, the root key being a key obtained by the control plane entity from the network in a procedure in which the integrated access and backhaul node registers with the network; sending a first message to the user plane entity, the first message including a one-to-one correspondence between the first key and the first IP address, the first key and the first IP address for establishing a user plane secure transmission channel between the user plane entity and the distributed unit; method.

2. The method comprises: sending first indication information to the user plane entity; receiving one or more IP addresses from the user plane entity, the one or more IP addresses including the first IP address; The method of claim 1.

3. When the one or more IP addresses further include a second IP address, the method further comprises: deriving a second key based on the root key, the IP address of the distributed unit, and the second IP address; the first message further includes a one-to-one correspondence between the second key and the second IP address; The method of claim 2.

4. The first key is K IAB and the root key is K gNB The method of claim 1, wherein

5. The method comprises: deriving a third key based on the root key, the IP address of the distributed unit, and the IP address of the control plane entity; establishing a control plane secure transmission channel between the control plane entity and the distributed unit based on the third key; The method of claim 1.

6. 1. A method for establishing a secure transmission channel, the method being applied to a user plane entity of a donor node central unit, the donor node central unit further including a control plane entity, the method comprising: receiving a first message from the control plane entity, the first message including a one-to-one correspondence between a first key and a first IP address of the user plane entity, the first key being different from a root key, the root key being a key obtained by the control plane entity from a network in a procedure in which an integrated access and backhaul node registers with the network; establishing a user plane secure transmission channel between the user plane entity and a distributed unit of the integrated access and backhaul node based on the first key and the first IP address; method.

7. the first message includes a one-to-one correspondence between a plurality of IP addresses of the user plane entity and a plurality of keys, the plurality of keys including the first key, the first key corresponding to the first IP address; The method comprises: determining to establish the user plane secure transmission channel by using the first IP address of the user plane entity; and determining, based on the one-to-one correspondence, that the key corresponding to the first IP address is the first key. The method of claim 6.

8. The method comprises: receiving a first indication from the control plane entity; and transmitting the plurality of IP addresses of the user plane entity to the control plane entity based on the first indication. The method of claim 7.

9. The first key is K IAB and the root key is K gNB The method of claim 6, wherein

10. 1. A method for establishing a secure transmission channel, the method being applied to a donor node central unit, the donor node central unit including a control plane entity and a user plane entity, the method comprising: deriving, by the control plane entity, a first key based on a root key, an Internet Protocol IP address of a distribution unit of the integrated access and backhaul node, and a first IP address of the user plane entity, wherein the first key is different from the root key, the root key being a key obtained by the control plane entity from a network in a procedure in which the integrated access and backhaul node registers with the network; sending, by the control plane entity, a first message to the user plane entity, the first message including a one-to-one correspondence between the first key and the first IP address; receiving, by the user plane entity, the first message; establishing, by the user plane entity, a user plane secure transmission channel between the user plane entity and the distributed unit based on the first key and the first IP address; method.

11. the first message includes a one-to-one correspondence between a plurality of IP addresses of the user plane entity and a plurality of keys, the plurality of keys including the first key, the first key corresponding to the first IP address; The method comprises: determining, by the user plane entity, to establish the user plane secure transmission channel by using the first IP address of the user plane entity; and determining, by the user plane entity, based on the one-to-one correspondence, that the key corresponding to the first IP address is the first key. The method of claim 10.

12. sending, by the control plane entity, first indication information to the user plane entity; receiving, by the user plane entity, the first indication information from the control plane entity; sending, by the user plane entity, one or more IP addresses of the user plane entity to the user plane entity, the one or more IP addresses including the first IP address; receiving, by the control plane entity, the one or more IP addresses from the user plane entity. The method of claim 11.

13. When the one or more IP addresses further include a second IP address, the method further comprises: deriving, by the control plane entity, a second key based on the root key, the IP address of the distributed unit, and the second IP address; the first message further includes a one-to-one correspondence between the second key and the second IP address; The method of claim 12.

14. The first key is K IAB and the root key is K gNB The method of claim 10, wherein

15. The method comprises: deriving a third key based on the root key, the IP address of the distributed unit, and the IP address of the control plane entity; establishing a control plane secure transmission channel between the control plane entity and the distributed unit based on the third key; The method of claim 10.

16. A control plane entity of a donor node central unit, said donor node central unit further comprising a user plane entity, said control plane entity comprising: deriving a first key based on a root key, an Internet Protocol IP address of a distribution unit of an integrated access and backhaul node, and a first IP address of a user plane entity, the first key being different from the root key, the root key being a key obtained by the control plane entity from a network in a procedure in which the integrated access and backhaul node registers with the network; sending a first message to the user plane entity, the first message including a one-to-one correspondence between the first key and the first IP address, the first key and the first IP address for establishing a user plane secure transmission channel between the user plane entity and the distributed unit. Control plane entities.

17. A user plane entity of a donor node central unit, the donor node central unit further comprising a control plane entity, the user plane entity comprising: receiving a first message from a control plane entity, the first message including a one-to-one correspondence between a first key and a first IP address of the user plane entity, the first key being different from a root key, the root key being a key obtained by the control plane entity from a network in a procedure in which an integrated access and backhaul node registers with the network; establishing a user plane secure transmission channel between the user plane entity and a distributed unit of the integrated access and backhaul node based on the first key and the first IP address. User plane entities.

18. A control plane entity of a donor node central unit, said donor node central entity further comprising a user plane entity, said control plane entity comprising: a memory configured to store a computer program; a processor that retrieves the computer program from the memory and executes the computer program to cause the control plane entity to: deriving a first key based on a root key, an Internet Protocol IP address of a distribution unit of an integrated access and backhaul node, and a first IP address of the user plane entity, wherein the first key is different from the root key, the root key being a key obtained by the control plane entity from the network in a procedure in which the integrated access and backhaul node registers with the network; sending a first message to the user plane entity, the first message including a one-to-one correspondence between the first key and the first IP address, the first key and the first IP address for establishing a user plane secure transmission channel between the user plane entity and the distributed unit; Control plane entities.

19. A user plane entity of a donor node central unit, the donor node central unit further comprising a control plane entity, the user plane entity comprising: a memory configured to store a computer program; a processor that retrieves the computer program from the memory and executes the computer program to cause the user plane entity to: receiving a first message from the control plane entity, the first message including a one-to-one correspondence between a first key and a first IP address of the user plane entity, the first key being different from a root key, the root key being a key obtained by the control plane entity from a network in a procedure in which an integrated access and backhaul node registers with the network; establishing a user plane secure transmission channel between the user plane entity and a distributed unit of the integrated access and backhaul node based on the first key and the first IP address. User plane entities.

20. A computer-readable storage medium storing a computer program, the computer program being executed on a computer to cause the computer to: deriving a first key based on a root key, an Internet Protocol IP address of a distributed unit of an integrated access and backhaul node, and a first IP address of a user plane entity of a donor node central unit, wherein the first key is different from the root key, and the root key is a key obtained from a network in a procedure in which the integrated access and backhaul node registers with the network; sending a first message to the user plane entity, the first message including a one-to-one correspondence between the first key and the first IP address, the first key and the first IP address for establishing a user plane secure transmission channel between the user plane entity and the distributed unit; A computer-readable storage medium.

21. A computer-readable storage medium storing a computer program, the computer program being executed on a computer to cause the computer to: receiving a first message from a control plane entity of a donor node central unit, the first message including a one-to-one correspondence between a first key and a first IP address of a user plane entity of the donor node central unit, the first key being different from a root key, the root key being a key obtained by the control plane entity from a network in a procedure in which an integrated access and backhaul node registers with the network; establishing a user plane secure transmission channel with a distributed unit of the integrated access and backhaul node based on the first key and the first IP address; A computer-readable storage medium.

22. A communication system comprising a user plane entity of a donor node central unit and a control plane entity of said donor node central unit, The control plane entity: deriving a first key based on a root key, an Internet Protocol (IP) address of a distribution unit of an integrated access and backhaul node, and a first IP address of the user plane entity, the first key being different from the root key, the root key being a key obtained by the control plane entity from a network in a procedure in which the integrated access and backhaul node registers with the network; sending a first message to the user plane entity, the first message including a one-to-one correspondence between the first key and the first IP address; The user plane entity: receiving the first message from a control plane entity; establishing a user plane secure transmission channel between the user plane entity and the distributed unit based on the first key and the first IP address. Communication system.

Images