Secure communication method and apparatus

Abstract

The present application relates to the technical field of wireless communications. Provided are a secure communication method and apparatus, which are used for synchronizing random seeds of a receiving end and a sending end. The method comprises: a terminal device receiving downlink control information, which is used for indicating whether k-th data transmitted by means of an iHARQ process is newly transmitted data; and if the k-th data is newly transmitted data, updating a random seed, wherein the updated random seed is used for secure processing of the k-th data. On the basis of the solution, a network device indicates, to a terminal device and by means of downlink control information, whether scheduled k-th data is newly transmitted data, and when the k-th data is newly transmitted data, the terminal device can update a random seed to realize random-seed synchronization with the network device, thereby improving the security of data transmission, and making a key-free transmission method more feasible in a protocol framework of a cellular network.

Description

A secure communication method and device Technical Field

[0001] The present application relates to the field of wireless communication technology, and in particular to a secure communication method and device. Background Art

[0002] Secure transmission is the foundation of communication. Most secure transmission solutions are key-based and can be categorized as symmetric or asymmetric. Symmetric encryption involves a shared key between two parties, while asymmetric encryption requires one party to pass a public key to the other. The sender uses the public key for encryption, while the receiver uses the private key for decryption. Both methods require key maintenance and management, which requires complex protocols. Vulnerabilities in these protocols are often exploited by adversaries. Furthermore, these complex protocols incur additional communication overhead and latency, making them unsuitable for the highly dynamic nature of future communication networks.

[0003] Currently, physical layer security transmission technologies, such as secure coding, secure waveform modulation, or the introduction of artificial noise into the channel, can be used to achieve information transmission and provide basic security capabilities. However, the security capabilities provided by physical layer security transmission technologies are limited, and non-intended receivers still have a high possibility of obtaining transmitted information.

[0004] Summary of the Invention

[0005] The present application provides a secure communication method and apparatus for synchronizing random seeds between a receiving end and a sending end.

[0006] In a first aspect, a secure communication method is provided. The method can be executed by a terminal device, or by a chip / chip system. In the method, the terminal device receives downlink control information, where the downlink control information is used to indicate whether the k-th data transmitted by the i-th hybrid automatic repeat request (HARQ) process is new data. Wherein, i identifies the HARQ process number. If the k-th data is new data, the terminal device updates a random seed. Wherein, the updated random seed is used for secure processing of the k-th data.

[0007] Based on this solution, the network device and the terminal device securely process the data through a random seed, so that each bit in the data can obtain provable security strength. Not only that, the network device indicates to the terminal device through downlink control information whether the scheduled k-th data is newly transmitted data. When the k-th data is newly transmitted data, the terminal device can update the random seed to synchronize the random seed with the network device, which can improve the security of data transmission and make the keyless transmission method feasible within the protocol framework of the cellular network.

[0008] In one possible implementation, the identifier of the i-th HARQ process is associated with the i-th security module, which is used to update and / or generate a random seed and securely process the k-th data. Based on this solution, each HARQ process number is associated with a different security module. This allows data from different HARQ processes to be securely processed in parallel by the associated security modules, thereby improving data transmission efficiency.

[0009] In one possible implementation, the terminal device obtains an updated random seed based on the k-1th data and the first random seed, wherein the first random seed is used for secure processing of the k-1th data, which is data successfully transmitted in the i-th HARQ process.

[0010] Based on this solution, when the kth data is newly transmitted data, the terminal device can obtain an updated random seed based on the k-1th data and the first random seed. Since the k-1th data is successfully transmitted data, both the network device and the terminal device can obtain it, thereby realizing the synchronization of random seeds between the terminal device and the network device.

[0011] In a possible implementation, the downlink control information includes a new data indicator (NDI). If the NDI is flipped, it indicates that the k-th data is newly transmitted data; if the NDI is not flipped, it indicates that the k-th data is retransmitted data.

[0012] Based on this solution, whether the kth data is retransmitted data or newly transmitted data is indicated by whether the NDI is flipped, so that the application can be applied to both uplink HARQ scenarios and downlink HARQ scenarios. The uplink HARQ process and the downlink HARQ process are processed separately and independently.

[0013] In one possible implementation, a terminal device receives the k-1th data transmitted by the i-th HARQ process. The terminal device performs a secure inverse process on the k-1th data based on a first random seed. If decryption of the k-1th data is successful, the terminal device transmits response information for the k-1th data, indicating successful transmission of the k-1th data. The updated random seed is updated based on the first random seed.

[0014] Based on this solution, in a downlink HARQ scenario, the terminal device can securely reverse process the k-1th data based on the first random seed. If the reverse process is successful, the terminal device can send a response message for the k-1th data to the network device, thereby instructing the network device to send newly transmitted data, that is, the kth data. If the received downlink control information indicates that the transmitted kth data is newly transmitted data, the terminal device updates the random seed based on the first random seed and the successfully transmitted k-1th data, and securely reverse processes the kth data based on the updated random seed.

[0015] In a possible implementation, if the downlink control information indicates that the kth data is newly transmitted data, security processing is performed on the kth data based on the updated random seed, and the kth data after security processing is sent.

[0016] Based on the above solution, in the uplink HARQ scenario, when the downlink control information indicates that the kth data is newly transmitted data, the terminal device can securely process the kth data based on the updated random seed and send the securely processed kth data to the network device.

[0017] In a possible implementation, some or all fields included in the downlink control information are encrypted, and the downlink control information is decrypted based on the first random seed, wherein the updated random seed is updated based on the first random seed.

[0018] Based on this solution, the downlink control information of the i-th HARQ process is encrypted by using a random seed, which can improve the security of the downlink control information.

[0019] In one possible implementation, the HARQ process number of the i-th HARQ process included in the downlink control information is not encrypted. Based on this solution, when the HARQ process number is not encrypted, the terminal device can obtain the HARQ process number without decrypting the downlink control information, thereby determining the HARQ process number corresponding to the downlink control information.

[0020] In one possible implementation, if the number of retransmissions of a transport block in the i-th HARQ process is greater than or equal to a preset threshold and the k-th data is newly transmitted data, the terminal device receives an initialization random number. The terminal device updates a random seed based on the initialization random number. The terminal device resets the number of retransmissions of the transport block in the i-th HARQ process to a set value, such as 0.

[0021] Based on this solution, when the number of retransmissions of the transmission block of the i-th HARQ process is large, in order to prevent non-target receivers from obtaining enough information, the terminal device and the network device can reset the random seed based on the initialization random number, which can improve the security of data transmission.

[0022] In one possible implementation, the number of retransmissions of a transport block in the i-th HARQ process includes the accumulation of the number of retransmissions of all transport blocks corresponding to the i-th HARQ process. Alternatively, the number of retransmissions of a transport block in the i-th HARQ process includes the accumulation of the number of retransmissions of a particular transport block in the i-th HARQ process.

[0023] In a second aspect, a secure communication method is provided. This method can be performed by a network device, or a chip / chip system. In this method, the network device receives response information for the k-1th data transmitted by the i-th Hybrid Automatic Repeat Request (HARQ) process, where the response information indicates that the k-1th data was successfully transmitted. Alternatively, the network device receives the k-1th data transmitted by the i-th HARQ process and successfully decodes the k-1th data. The network device updates a random seed. The updated random seed is used for secure processing of the kth data transmitted by the i-th HARQ process. The network device sends downlink control information, where the downlink control information indicates that the kth data is newly transmitted data.

[0024] In a possible implementation, the identifier of the i-th HARQ process is associated with the i-th security module, and the i-th security module is used to update and / or generate a random seed and perform security processing on the k-th data.

[0025] In one possible implementation, the network device obtains an updated random seed based on the k-1th data and the first random seed of the i-th HARQ process, wherein the first random seed is used for secure processing of the k-1th data. The k-1th data is data that has been successfully transmitted.

[0026] In a possible implementation, the downlink control information includes a new data indication NDI, and if the NDI is flipped, it indicates that the kth data is newly transmitted data, and if the NDI is not flipped, it indicates that the kth data is retransmitted data.

[0027] In one possible implementation, the network device performs security processing on the k-1th data of the i-th HARQ process based on a first random seed, wherein the updated random seed is updated based on the first random seed, and the network device sends the k-1th data after the security processing.

[0028] In one possible implementation, if the downlink control information indicates that the kth data is newly transmitted data, the network device may receive the kth data after security processing and perform security inverse processing on the kth data after security processing based on the updated random seed.

[0029] In a possible implementation, some or all fields included in the downlink control information are encrypted, and the network device encrypts the downlink control information based on a first random seed, wherein the updated random seed is updated based on the first random seed.

[0030] In a possible implementation, the HARQ process number of the i-th HARQ process included in the downlink control information is not encrypted.

[0031] In one possible implementation, if the number of retransmissions of a transport block in the i-th HARQ process is greater than or equal to a preset threshold, the network device updates a random seed based on an initialization random number. The network device sends the initialization random number and resets the number of retransmissions of the transport block in the i-th HARQ process to a set value, such as 0.

[0032] In one possible implementation, the number of retransmissions of a transport block in the i-th HARQ process includes the accumulation of the number of retransmissions of all transport blocks corresponding to the i-th HARQ process. Alternatively, the number of retransmissions of a transport block in the i-th HARQ process includes the accumulation of the number of retransmissions of a particular transport block in the i-th HARQ process.

[0033] According to a third aspect, a communication device is provided, comprising: a processing unit and a transceiver unit.

[0034] The transceiver unit is configured to receive downlink control information indicating whether the kth data transmitted by the i-th hybrid automatic repeat request (HARQ) process is new data. Where i identifies the HARQ process number, if the kth data is new data, the processing unit is configured to update a random seed. The updated random seed is used for secure processing of the kth data.

[0035] In a possible implementation, the identifier of the i-th HARQ process is associated with the i-th security module, and the i-th security module is used to update and / or generate a random seed and perform security processing on the k-th data.

[0036] In one possible implementation, the processing unit is specifically configured to obtain an updated random seed based on the k-1th data and the first random seed, wherein the first random seed is used for secure processing of the k-1th data, where the k-1th data is data successfully transmitted in the i-th HARQ process.

[0037] In a possible implementation, the downlink control information includes a new data indicator (NDI). If the NDI is flipped, it indicates that the k-th data is newly transmitted data; if the NDI is not flipped, it indicates that the k-th data is retransmitted data.

[0038] In one possible implementation, the transceiver unit is further configured to receive the k-1th data transmitted by the i-th HARQ process. The processing unit is further configured to perform secure inverse processing on the k-1th data based on the first random seed. The updated random seed is updated based on the first random seed. The transceiver unit is further configured to send response information for the k-1th data, the response information indicating successful transmission of the k-1th data.

[0039] In one possible implementation, the processing unit is further configured to perform security processing on the kth data based on the updated random seed when the downlink control information indicates that the kth data is newly transmitted data. The transceiver unit is further configured to send the securely processed kth data to the network device.

[0040] In a possible implementation, some or all fields included in the downlink control information are encrypted, and the processing unit is further configured to decrypt the downlink control information based on the first random seed, wherein the updated random seed is updated based on the first random seed.

[0041] In a possible implementation, the HARQ process number of the i-th HARQ process included in the downlink control information is not encrypted.

[0042] In one possible implementation, if the number of retransmissions of a transport block in the i-th HARQ process is greater than or equal to a preset threshold and the k-th data is newly transmitted data, the transceiver unit is further configured to receive an initialization random number. The processing unit is specifically configured to update a random seed based on the initialization random number. The processing unit is further configured to reset the number of retransmissions of the transport block in the i-th HARQ process to a set value, such as 0.

[0043] In one possible implementation, the number of retransmissions of a transport block in the i-th HARQ process includes the accumulation of the number of retransmissions of all transport blocks corresponding to the i-th HARQ process. Alternatively, the number of retransmissions of a transport block in the i-th HARQ process includes the accumulation of the number of retransmissions of a particular transport block in the i-th HARQ process.

[0044] In a fourth aspect, a communication device is provided, comprising: a processing unit and a transceiver unit.

[0045] The transceiver unit is configured to receive response information for the k-1th data transmitted by the i-th hybrid automatic repeat request (HARQ) process, the response information indicating that the k-1th data was successfully transmitted. Alternatively, the transceiver unit is configured to receive the k-1th data transmitted by the i-th HARQ process and successfully decode the k-1th data. The processing unit is configured to update a random seed. The updated random seed is used for secure processing of the k-th data transmitted by the i-th HARQ process. The transceiver unit is further configured to send downlink control information indicating that the k-th data is newly transmitted data.

[0046] In a possible implementation, the identifier of the i-th HARQ process is associated with the i-th security module, and the i-th security module is used to update and / or generate a random seed and perform security processing on the k-th data.

[0047] In one possible implementation, the processing unit is specifically configured to obtain an updated random seed based on the k-1th data and the first random seed of the i-th HARQ process, wherein the first random seed is used for secure processing of the k-1th data. The k-1th data is data that has been successfully transmitted.

[0048] In a possible implementation, the downlink control information includes a new data indication NDI, and if the NDI is flipped, it indicates that the kth data is newly transmitted data, and if the NDI is not flipped, it indicates that the kth data is retransmitted data.

[0049] In one possible implementation, the processing unit is further configured to perform security processing on the k-1th data of the i-th HARQ process based on the first random seed, wherein the updated random seed is updated based on the first random seed, and the network device sends the k-1th data after security processing.

[0050] In one possible implementation, if the downlink control information indicates that the kth data is newly transmitted data, the transceiver unit is further configured to receive the kth data after security processing. The processing unit is further configured to perform security inverse processing on the kth data after security processing based on the updated random seed.

[0051] In a possible implementation, some or all fields included in the downlink control information are encrypted, and the processing unit is further configured to encrypt the downlink control information based on the first random seed, wherein the updated random seed is updated based on the first random seed.

[0052] In a possible implementation, the HARQ process number of the i-th HARQ process included in the downlink control information is not encrypted.

[0053] In one possible implementation, if the number of retransmissions of the transport block in the i-th HARQ process is greater than or equal to a preset threshold, the processing unit is specifically configured to update a random seed based on the initialization random number and reset the number of retransmissions of the transport block in the i-th HARQ process to a set value, such as 0. The transceiver unit is further configured to send the initialization random number.

[0054] In one possible implementation, the number of retransmissions of a transport block in the i-th HARQ process includes the accumulation of the number of retransmissions of all transport blocks corresponding to the i-th HARQ process. Alternatively, the number of retransmissions of a transport block in the i-th HARQ process includes the accumulation of the number of retransmissions of a particular transport block in the i-th HARQ process.

[0055] In a fifth aspect, a communication device is provided. The communication device may be the communication device in any possible implementation of the second to fourth aspects of the above embodiments, or a chip provided in the communication device in any of the second to fourth aspects. The communication device includes a communication interface and a processor, and optionally, a memory. The memory is used to store computer programs, instructions, or data. The processor is coupled to the memory and the communication interface. When the processor reads the computer program, instructions, or data, the communication device executes the method executed by the terminal device or network device in any possible implementation of the first to second aspects.

[0056] It should be understood that the communication interface can be implemented by an antenna, a feeder, a codec, etc. in the communication device, or, if the communication device is a chip provided in a terminal device or a network device, the communication interface can be an input / output interface of the chip, such as an input / output pin, etc. The communication device may further include a transceiver for communicating with other devices.

[0057] In a sixth aspect, an embodiment of the present application provides a chip system, which includes a processor and may also include a memory, for implementing the method executed by a terminal device or a network device in any possible implementation of the first to second aspects. In one possible implementation, the chip system also includes a memory for storing program instructions and / or data. The chip system can be composed of a chip, or it can include a chip and other discrete devices.

[0058] In a seventh aspect, the present application provides a computer-readable storage medium, which stores a computer program or instruction. When the computer program or instruction is executed, the method performed by the terminal device or network device in the above aspects is implemented.

[0059] In an eighth aspect, a computer program product is provided, comprising: computer program code or instructions, which, when executed, causes the methods performed by the terminal device or network device in the above aspects to be executed.

[0060] In a ninth aspect, a communication device is provided, which includes a unit or module for executing the above-mentioned methods.

[0061] In a tenth aspect, a chip system is provided, comprising a logic circuit and an input / output interface. The logic circuit is configured to execute the method executed by the terminal device or network device described above. The input / output interface is configured to communicate with other devices.

[0062] In an eleventh aspect, a system is provided, comprising at least one communication device that performs any possible implementation of the first aspect and at least one communication device that performs any possible implementation of the second aspect.

[0063] The beneficial effects of the above-mentioned second to eleventh aspects and their implementation methods can refer to the description of the beneficial effects of the method of the first aspect and its implementation method. BRIEF DESCRIPTION OF THE DRAWINGS

[0064] FIG1 is a schematic diagram of a communication system provided in an embodiment of the present application;

[0065] FIG2 is a schematic diagram of a keyless secure transmission architecture;

[0066] FIG3 is a schematic diagram of a security module;

[0067] FIG4A is a schematic diagram of a submodule of a security module provided in an embodiment of the present application;

[0068] FIG4B is a schematic diagram of a submodule of another security module provided in an embodiment of the present application;

[0069] FIG5 is a schematic diagram of a multiple HARQ process;

[0070] FIG6 is an exemplary flow chart of a secure communication method provided in an embodiment of the present application;

[0071] FIG7 is an exemplary flow chart of another secure communication method provided in an embodiment of the present application;

[0072] FIG8 is an exemplary flow chart of another secure communication method provided in an embodiment of the present application;

[0073] FIG9 is an exemplary flow chart of another secure communication method provided in an embodiment of the present application;

[0074] FIG10A is a schematic diagram showing the relationship between a security module and a HARQ process according to an embodiment of the present application;

[0075] FIG10B is a schematic diagram of updating a random seed for a security module associated with a HARQ process according to an embodiment of the present application;

[0076] FIG10C is a schematic diagram of a DCI transmission process provided in an embodiment of the present application;

[0077] FIG11 is a schematic diagram of a communication device provided in an embodiment of the present application;

[0078] FIG12 is a schematic diagram of another communication device provided in an embodiment of the present application;

[0079] FIG13 is a schematic diagram of another communication device provided in an embodiment of the present application;

[0080] FIG14 is a schematic diagram of another communication device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0081] In order to facilitate understanding of the technical solutions provided by the embodiments of the present application, the technical terms involved in the embodiments of the present application are explained and illustrated below.

[0082] 1) Random seed, also known as random entropy or state information, refers to information used for secure processing of transport blocks. For example, it is used for encryption or integrity protection of transport blocks. Alternatively, the random seed can be used directly for secure processing of transport blocks or derived through algorithms such as hashing algorithms to generate a key for secure processing of transport blocks.

[0083] Optionally, the random seed can be used as the input and output of the security module. The random seed output by the security module can be a function of the random seed input by the security module and the message input by the security module. There are many ways to implement this function, such as the output random seed Seed out =HASH(Seed in ,M out ), namely Seed i =HASH(Seed i-1 ,EXT(M i-1 ,Seed i-1 )). HASH is a hash operation, EXT is a random extraction operation, and Seed in is the random seed input to the security module, M out Is the message input by the security module. EXT(M i-1 ,Seed i-1 ) refers to the randomness extraction operation on the i-1th random seed and the i-1th message.

[0084] The embodiments of the present application are described in detail below with reference to the accompanying drawings.

[0085] The technical solutions of the embodiments of the present application can be applied to New Radio (NR) systems, Global System of Mobile communication (GSM) systems, Code Division Multiple Access (CDMA) systems, Wideband Code Division Multiple Access (WCDMA) systems, General Packet Radio Service (GPRS), Long Term Evolution (LTE) systems, LTE Frequency Division Duplex (FDD) systems, LTE Time Division Duplex (TDD) systems, Universal Mobile Telecommunication System (UMTS), Worldwide Interoperability for Microwave Access (WiMAX) communication systems, etc., without limitation herein.

[0086] FIG1 is a schematic diagram of the architecture of a communication system 1000 used in an embodiment of the present application. As shown in FIG1 , the communication system includes a wireless access network 100. The wireless access network 100 may include at least one network device (such as 110a and / or 110b in FIG1 ) and may also include at least one terminal device (such as at least one of 120a-120j in FIG1 ). The terminal device is connected to the network device wirelessly, and the network device is connected to the core network device wirelessly or by wire. Terminal devices and network devices may be connected to each other by wire or by wireless. FIG1 is only a schematic diagram, and the communication system may also include other network devices, such as wireless relay devices and wireless backhaul devices, which are not shown in FIG1 .

[0087] A network device is a network-side device with wireless transceiver capabilities. A network device can be a device in a radio access network (RAN) that provides wireless communication capabilities for terminal devices, and is called a RAN device. For example, a network device can be a base station, an evolved NodeB (eNodeB), a transmission reception point (TRP), a next-generation NodeB (gNB) in a fifth-generation (5G) mobile communication system, a next-generation base station in a sixth-generation (6G) mobile communication system, a base station in a future mobile communication system, or an access node in a WiFi system. It can also be a module or unit that performs some of the functions of a base station, such as a centralized unit (CU) or a distributed unit (DU). The CU here completes the functions of the radio resource control protocol and the packet data convergence protocol (PDCP) of the base station, and can also complete the function of the service data adaptation protocol (SDAP); the DU completes the functions of the radio link control layer and the medium access control (MAC) layer of the base station, and can also complete the functions of part of the physical layer or all of the physical layer. For the specific description of the above-mentioned various protocol layers, please refer to the relevant technical specifications of the 3rd Generation Partnership Project (3GPP). The network device can be a macro base station (such as 110a in Figure 1), a micro base station or an indoor station (such as 110b in Figure 1), a relay node or a donor node, etc. The embodiments of the present application do not limit the specific technology and specific device form adopted by the network device. In the embodiments of the present application, the base station is used as an example for explanation.

[0088] In another possible scenario, multiple RAN nodes collaborate to assist the terminal in achieving wireless access, and different RAN nodes implement part of the functions of the base station respectively. For example, the RAN node can be a CU, DU, CU-control plane (CP), CU-user plane (UP), or radio unit (RU). The CU and DU can be set separately, or they can be included in the same network element, such as a baseband unit (BBU). The RU can be included in a radio frequency device or radio frequency unit, such as a remote radio unit (RRU), an active antenna unit (AAU), or a remote radio head (RRH).

[0089] In different systems, CU (or CU-CP and CU-UP), DU or RU may also have different names, but those skilled in the art can understand their meanings. For example, in the ORAN system, CU may also be called O-CU (Open CU), DU may also be called O-DU, CU-CP may also be called O-CU-CP, CU-UP may also be called O-CU-UP, and RU may also be called O-RU. For the convenience of description, this application uses CU, CU-CP, CU-UP, DU and RU as examples for description. Any unit of CU (or CU-CP, CU-UP), DU and RU in this application may be implemented by a software module, a hardware module, or a combination of a software module and a hardware module. Optionally, the operations of updating the random seed and securely processing the data in the secure communication method provided in the embodiment of the present application may be performed by the RU, and the sending and receiving operations may be performed by the DU.

[0090] A terminal device is a user-side device with wireless transceiver capabilities. A terminal device may also be referred to as user equipment (UE), a mobile station, a mobile terminal, etc. Terminal devices can be widely used in various scenarios, such as device-to-device (D2D), vehicle-to-everything (V2X) communication, machine-type communication (MTC), the Internet of Things (IoT), virtual reality, augmented reality, industrial control, autonomous driving, telemedicine, smart grids, smart furniture, smart offices, smart wearables, smart transportation, smart cities, etc. The terminal device may be a mobile phone, a tablet computer, a computer with wireless transceiver capabilities, a wearable device, a vehicle, a drone, a helicopter, an airplane, a ship, a robot, a robotic arm, a smart home appliance, etc. The embodiments of this application do not limit the specific technology and specific device form adopted by the terminal device. The embodiments of this application are described by taking the terminal as an example.

[0091] Network devices and terminal devices can be fixed or mobile. They can be deployed on land, including indoors or outdoors, handheld or vehicle-mounted; on water; and in the air on aircraft, balloons, and satellites. The embodiments of this application do not limit the application scenarios of network devices and terminal devices.

[0092] The roles of network devices and terminal devices can be relative. For example, the helicopter or drone 120i in Figure 1 can be configured as a mobile network device. To terminal devices 120j accessing the wireless access network 100 via 120i, terminal device 120i is a network device. However, to network device 110a, 120i is a terminal device, meaning that communication between 110a and 120i occurs via a wireless air interface protocol. Of course, communication between 110a and 120i can also occur via an interface protocol between network devices. In this case, 120i is also a network device relative to 110a. Therefore, both network devices and terminal devices can be collectively referred to as communication devices. 110a and 110b in Figure 1 can be referred to as communication devices with network device functionality, while 120a-120j in Figure 1 can be referred to as communication devices with terminal device functionality.

[0093] In the embodiments of the present application, the functions of the network device may also be performed by a module (such as a chip) in the network device, or by a control subsystem that includes the network device functions. The control subsystem that includes the network device functions here may be a control center in the above-mentioned application scenarios such as smart grid, industrial control, smart transportation, and smart city. The functions of the terminal device may also be performed by a module (such as a chip or a modem) in the terminal device, or by a device that includes the terminal device functions.

[0094] Secure transmission is the foundation of communication. Most secure transmission solutions are key-based and can be categorized as symmetric or asymmetric. Symmetric encryption involves sharing a key between two parties, while asymmetric encryption requires one party to pass a public key to the other. The sender uses the public key for encryption, while the receiver uses the private key for decryption. Both methods require key maintenance and management, which requires complex protocols. Vulnerabilities in these protocols are often exploited by adversaries. Furthermore, complex protocols incur additional communication overhead and latency, making them unsuitable for the highly dynamic nature of future communication networks.

[0095] In current wireless communication protocols, control signaling at the physical and media access control (MAC) layers is unencrypted. Adversaries can exploit this signaling to launch distributed denial-of-service (DDoS) attacks, tampering, and eavesdropping. Of the 21 wireless network threats published by the International Telecommunication Union (ITU), 14 originate from the access side, specifically vulnerabilities in air interface signaling. Some signaling occurs before key negotiation, making it impossible to employ key-based secure communication methods.

[0096] The keyless secure transmission architecture, shown in Figure 2, consists of a communication module and a security module. The communication module utilizes physical layer security transmission technologies, such as secure coding, secure waveform modulation, or artificial noise, to achieve information transmission and provide basic security capabilities. The security module is constructed using cryptographic primitives, enabling the system to achieve provable security strength.

[0097] The keyless secure transmission architecture shown in Figure 2 integrates cryptographic methods with physical layer security technologies to achieve a keyless, intrinsically secure mechanism. In this architecture, physical layer security techniques are first used to create a high bit error floor at non-target receiving nodes, for example, greater than 0.1, thereby introducing random entropy into the non-target receiving channel. Furthermore, a preprocessing module, such as a randomness extractor, is introduced into the legitimate transmitter. This module extracts and diffuses the random entropy introduced by physical layer security techniques into the non-target receiving channel, generating an equivalent key with a near-uniform distribution. This is used to ensure provable security strength for each bit in the message packet.

[0098] In the keyless secure transmission architecture, the core module is the security module, which corresponds to the pre-processing part in Figure 2. One of the implementation structures is shown in Figure 3. In Figure 3, m1, m2, ..., m q Represents the source message group to be transmitted, x1, x2, ..., x q represents the coded packet output by the channel encoder. The error control coding (ECC) module can be the channel coding module in Figure 2. Channel coding can adopt various coding schemes widely used in communication systems, such as low-density parity check code (LDPC) or polar coding. It is understood that the ECC module is not part of the security module and is shown in Figure 2 for the sake of diagram integrity.

[0099] The randomness extraction operation is implemented by the security module shown in Figure 3. t0 is the initial random seed, which can be a random vector. The security module operates as follows: Within a packet, a bidirectional randomness extractor (BRE) extracts and diffuses the random seed introduced by the non-target receiving channel, protecting all bits within the packet. This allows random errors introduced by physical layer security techniques to be diffused within a packet. Between packets, a compressive randomness extractor (CRE) and a one-way randomness extractor (ORE) accumulate channel noise seeds from previous packets, preventing some packets from failing to achieve the required security strength due to insufficient random seeds introduced by the channel. This means that even if the non-target receiving channel conditions within a packet are excellent, preventing the physical layer security techniques from introducing sufficient random seeds within the current packet, the CRE and ORE can still collect the channel noise seeds from previous packets and aggregate and diffuse the random errors introduced by them into the current packet.

[0100] The security module shown in Figure 3 can be divided into two submodules as shown in Figure 4A and Figure 4B. The submodule shown in Figure 4A is used for security processing. This submodule has two inputs, one of which is a packet plaintext m j , and the other input is the random seed t i , the output of this submodule is m j The ciphertext c j The submodule shown in FIG4B is used to update the random seed. The submodule has two inputs, one of which is the ciphertext c output by the submodule shown in FIG4A. j , the other input is the encrypted m j The random seed used is t i The output of this submodule is the updated random seed t i+1 .

[0101] In the embodiment of the present application, the ORE, BRE, etc. in the security module shown in Figure 3 can adopt modules commonly used in cryptography, such as random number extractors. The randomness extractor can use three deterministic random number generators (DRBG), such as hash-deterministic random bit generator (Hash-DRBG), hash information authentication code (HMAC-DRBG), and counter mode deterministic random number generator (CTR_DRBG). DRBG is a pseudo-random number generator defined by the standard. Alternatively, other traditional security algorithms can be used, such as directly performing a hash operation on the value, to increase randomness and obtain an updated security seed.

[0102] In order to facilitate understanding of the technical solution provided by the embodiment of the present application, a schematic diagram of a multi-HARQ process is introduced below. The transmission time interval (TTI) of the 5G cellular network can be a time slot (slot) of 0.5ms, and each time slot can transmit one or two transport blocks (TB). If it is an 8:2 frame structure, then each 10ms system frame has 16 downlink TTIs. Refer to Figure 5, which is a schematic diagram of multi-HARQ processes in a cellular network. Assume that one TB is transmitted per TTI. As can be seen in Figure 5, in HARQ process 1 (process1), the base station transmits TB1, the terminal receives TB1 and decodes it successfully, and the physical layer of the terminal forwards TB1 to the MAC layer. In HARQ process 2 (process2), the base station transmits TB2, the terminal receives TB2 but fails to decode it, and the terminal sends a non-acknowledgement (NACK) to the base station. The base station receives the NACK indicating a decoding failure and retransmits TB2 after 3 TTIs. The terminal receives the retransmitted TB2 and successfully decodes it. The terminal's physical layer forwards TB2 to the MAC layer. In HARQ process 3, the base station transmits TB3, the terminal receives TB3 and successfully decodes it. The terminal's physical layer forwards TB3 to the MAC layer. In HARQ process 4, the base station transmits TB4, the terminal receives TB4 and successfully decodes it. The terminal's physical layer forwards TB4 to the MAC layer. In HARQ process 3, the base station transmits TB5, the terminal receives TB5 and successfully decodes it. The terminal's physical layer forwards TB5 to the MAC layer.

[0103] In the above-mentioned multiple HARQ processes, in order to improve the security of data transmission, a keyless secure transmission method as shown in Figures 2 and 3 can be introduced. The embodiment of the present application designs a scheme to accumulate and spread random seeds between multiple consecutive TBs or code block groups (CBGs). TB and CBG are proprietary names in LTE or NR systems, which can be broadly regarded as message blocks. This application does not limit the naming of this message block. However, it can be seen from Figure 3 that the random seeds used for encryption and decryption synchronized between the receiving end and the transmitting end are the key to whether the data can be transmitted accurately. Therefore, how to synchronize the random seeds between the receiving end and the transmitting end in multiple HARQ processes becomes a technical problem that needs to be solved.

[0104] In view of this, an embodiment of the present application provides a secure communication method. In this method, a terminal can receive downlink control information from a base station. The downlink control information can be used to indicate whether the k-th data transmitted by the i-th HARQ process is newly transmitted data. If the downlink control information indicates that the k-th data is newly transmitted data, the terminal can update the random seed. Similarly, if the downlink control information indicates that the k-th data is newly transmitted data, the base station can also update the random seed. The updated random seed can be used for secure processing of the k-th data. It should be understood that i identifies the HARQ process number of the HARQ process. Based on this solution, the base station indicates to the terminal through downlink control information whether the scheduled k-th data is newly transmitted data. When the k-th data is newly transmitted data, the terminal and the base station can synchronously update the random seed, which can improve the security of data transmission and make the keyless transmission method feasible within the protocol framework of the cellular network.

[0105] To facilitate understanding of the technical solutions provided in the embodiments of the present application, the random seed used for securely processing data transmitted by the i-th HARQ process may be referred to as the random seed t[i, data] hereinafter. For example, t[i, k] is used for securely processing the k-th data transmitted by the i-th HARQ process, and t[i, k-1] is used for securely processing the k-1-th data transmitted by the i-th HARQ process. It should be noted that the random seed t[i, data] is merely an example to facilitate understanding of the technical solutions and does not limit the specific representation of the random seed.

[0106] In addition, it should be noted that the k-th data can be understood as the k-th data transmitted by the i-th HARQ process, or can also be understood as the data transmitted at time k. The k+1-th data and the k-th data are different data. For example, if the k-th data is transmitted in the i-th HARQ process, but the k-th data needs to be retransmitted due to a decoding failure, in this case, although the retransmitted data may be the k+1-th data in terms of quantity, or may be the data transmitted at time k+1, it is still referred to as the k-th data.

[0107] Referring to FIG. 6 , which is an exemplary flowchart of a secure communication method provided in an embodiment of the present application, the method may include the following operations.

[0108] S601: The base station sends downlink control information.

[0109] Correspondingly, the terminal receives downlink control information.

[0110] The downlink control information may indicate whether the kth data transmitted by the i-th HARQ process is newly transmitted data. In one possible scenario, the downlink control information may include an identifier of the i-th HARQ process, such as the HARQ process number of the i-th HARQ process, such as i. The downlink control information may indicate whether the kth data transmitted by the HARQ process corresponding to the HARQ process number is newly transmitted data. It is understood that the starting number of the HARQ process number may start from 0 or 1, and this application does not make any specific limitation.

[0111] For example, the downlink control information may be used to schedule a physical downlink shared channel (PDSCH), which may be used to transmit the kth data item of the i-th HARQ process. The downlink control information may indicate whether the kth data item is newly transmitted. For another example, the downlink control information may be used to schedule a physical uplink shared channel (PUSCH), which may be used to transmit the kth data item of the i-th HARQ process. The downlink control information may indicate whether the kth data item is newly transmitted.

[0112] In one possible scenario, a new field may be added to the downlink control information to indicate whether the kth data is newly transmitted data. For example, a one-bit information may be added to the downlink control information. When the value of this one-bit information is "0," it indicates that the kth data is not newly transmitted data, and when the value of this one-bit information is "1," it indicates that the kth data is newly transmitted data. Conversely, when the value of this one-bit information is "1," it indicates that the kth data is not newly transmitted data, and when the value of this one-bit information is "0," it indicates that the kth data is newly transmitted data.

[0113] In another possible scenario, the NDI included in the downlink control information can be used to determine whether the kth data is newly transmitted data. For example, a toggle in the NDI indicates that the kth data is newly transmitted data, while an untoggle in the NDI indicates that the kth data is retransmitted data. For example, assume that in a new HARQ process 0, the initial NDI value is 0. When the base station transmits TB0 to the terminal in HARQ process 0, it carries an NDI value of 0 in the downlink control information to the terminal. If the terminal sends a NACK to the base station, the base station needs to retransmit TB0. During the retransmission, the NDI value sent by the base station to the terminal remains unchanged, that is, the NDI value remains 0. The terminal can determine that the NDI has not toggled, that is, the value remains 0, and therefore considers this transmission to be a retransmission. If the terminal sends an ACK to the base station, this indicates that the transmission of TB0 was successful. The base station can continue to transmit TB1 to the receiver and flip the NDI value to 1 and send it to the terminal. The terminal can determine that the NDI has toggled, that is, the NDI value remains 1, and therefore considers this transmission to be an initial transmission, that is, TB1 is newly transmitted data.

[0114] S602: The terminal updates the random seed.

[0115] In S601, if the downlink control information indicates that the kth data is not newly transmitted data, the terminal does not execute S602, that is, the terminal may not update the random seed and may still use the random seed before the update to perform data transmission with the base station.

[0116] In S601, if the downlink control information indicates that the kth data is newly transmitted data, the terminal may update the random seed. For example, the terminal may obtain the random seed t[i, k] based on the random seed t[i, k-1] and the k-1th data. It is understood that the k-1th data may be data successfully transmitted in the first HARQ process. Optionally, the terminal may input the random seed t[i, k-1] and the k-1th data into the submodule shown in FIG4B for randomness extraction processing to obtain the random seed t[i, k].

[0117] Similarly, since the downlink control information indicates that the kth data is newly transmitted, the base station can also update the random seed. The terminal and the base station can securely process the kth data using the updated random seed t[i, k].

[0118] 7, the terminal and the base station successfully transmit the kth data m of the i-th HARQ process. k The m k It can be processed securely by random seed t[i,k]. k, then the base station can flip the NDI contained in the downlink control information and send the downlink control information to the terminal. The downlink control information is used to schedule the k+1th data m of the i-th HARQ process. k+1 In addition, the base station can also update the random seed t[i,k] to obtain the updated random seed t[i,k+1]. After the terminal receives the downlink control information, it can be determined that the NDI has flipped, and the terminal can determine m k+1 is the new data. Therefore, the terminal can update the random seed and obtain the random seed t[i,k+1]. The base station and the terminal can use the random seed t[i,k+1] to k+1 Safely processed and transmitted.

[0119] Based on the above scheme, since downlink control information can be used to indicate whether the kth data is newly transmitted data, when the kth data is newly transmitted data, the terminal and the base station can update the random seed. When the kth data is not newly transmitted data, the terminal and the base station can use the random seed before the update for data transmission, which can synchronize the random seeds between the terminal and the base station and improve the security of data transmission.

[0120] Since the HARQ process can be divided into an uplink HARQ process and a downlink HARQ process, the following describes methods for updating random seeds in the uplink HARQ process and the downlink HARQ process respectively with reference to FIG8 and FIG9 .

[0121] Referring to FIG. 8 , which is an exemplary flowchart of a method for updating a random seed in a downlink HARQ process provided in an embodiment of the present application, the method may include the following operations.

[0122] S801: The base station sends first downlink control information to the terminal.

[0123] Correspondingly, the terminal receives the first downlink control information from the base station.

[0124] For example, the base station and the terminal can schedule the kth data m shown in FIG7 through the first downlink control information k . The base station can send the first downlink control information through the physical downlink control channel (PDCCH). The first downlink control information can include a HARQ process number, such as the HARQ process number is 0. The first downlink control information can also include an NDI. The value of NDI is an initial value, such as NDI=0. It can be understood that the initial value of NDI can also be 1, and this application does not make a specific limitation.

[0125] The first downlink control information in S801 may schedule the first PDSCH. For example, the first downlink control information may include information such as time-frequency domain resources of the first PDSCH. It is understandable that the first downlink control information may also include other information, which will not be described one by one here.

[0126] S802: The base station sends m to the terminal k .

[0127] Correspondingly, the terminal receives m from the base station k .

[0128] For example, the base station may send m through the first PDSCH scheduled by the first downlink control information. k Accordingly, after receiving the first downlink control information, the terminal can determine the first PDSCH scheduled by the first downlink control information, such as determining the time-frequency domain resource information of the first PDSCH. Therefore, the terminal can receive m on the corresponding time-frequency domain resource. k .

[0129] In a possible implementation, the base station may use a random seed t[0, k] to generate m k For example, the base station can use the random seeds t[0,k] and m k Input it into the submodule shown in FIG4A for encryption, and obtain m k The base station can send m to the terminal. k ciphertext.

[0130] S803: The terminal sends feedback information to the base station.

[0131] Correspondingly, the base station receives feedback information from the terminal.

[0132] For example, the terminal can m k Decode and perform cyclic redundancy check (CRC) on the decoding result. If the check succeeds, the terminal is considered to be k Decoding is successful. If verification fails, it is considered that the terminal is not compatible with m. k Decoding failed.

[0133] If the terminal m k If the decoding is successful, the terminal can send an acknowledgment (ACK0) to the base station in S803 to indicate to the base station that the TB0 decoding is successful. k If the decoding fails, the terminal may send a negative response (NACK) to the base station in S803, indicating to the base station that k Decoding failed.

[0134] In a possible implementation, the terminal can generate a random seed t[0, k] for m k For example, the terminal can use the random seed t[0,k] and m k The input is sent to the submodule that performs the inverse operation of the operation shown in FIG4A , that is, the decryption submodule, and the random seed t[0, k] is used to generate the m k Decrypt.

[0135] In one possible case, if the feedback information in S803 is ACK, that is, the terminal and the base station successfully transmit m k , S804A to S807A can be executed.

[0136] S804A: The base station updates the random seed.

[0137] As shown in Figure 7, the base station and the terminal successfully transmit m k , so the base station and the terminal can update the random seed. For example, the base station can update the random seed t[0,k] based on the random seed t[0,k] and m k Get the updated random seed t[0,k+1]. For example, the base station can use the random seed t[0,k] and m k Input to the submodule shown in FIG4B to obtain an updated random seed t[0, k+1].

[0138] S805A: The base station sends second downlink control information to the terminal.

[0139] Correspondingly, the terminal receives the second downlink control information from the base station.

[0140] For example, the base station and the terminal can schedule the k+1th data m shown in FIG7 through the second downlink control information. k+1 The base station may send the second downlink control information via the PDCCH. The second downlink control information may include a HARQ process number, such as 1. The second downlink control information may also include an NDI, where NDI=1, meaning that the NDI is flipped.

[0141] The second downlink control information in S804A may schedule the second PDSCH, which may be implemented with reference to S801 and will not be described in detail here.

[0142] It is understandable that S804A may be executed before S805A, may be executed after S805A, or may be executed simultaneously, and this application does not make any specific limitation.

[0143] S806A: The base station sends m to the terminal k+1 .

[0144] Correspondingly, the terminal receives m from the base station k+1 .

[0145] Since the feedback information in S803 is ACK, that is, NDI=1 in the second downlink control information in S804A, the base station can use the random seed t[0, k+1] to generate the random seed t[0, k+1] for m k+1 For example, the base station can k+1 Input it into the submodule shown in FIG4A for encryption, and obtain m k+1 The base station can send m to the terminal. k+1 ciphertext.

[0146] S807A: The terminal updates the random seed t[0, k+1].

[0147] Since the terminal can determine that the NDI included in the second downlink control information in S805A is reversed, that is, m k+1 For new data, the terminal can update the random seed t[0,k+1]. For example, the terminal can update the random seed t[0,k] based on the random seed t[0,k] and m k Get the updated random seed t[0,k+1]. For example, the terminal will update the random seed t[0,k] and m k Input to the submodule shown in FIG4B to obtain the updated random seed t[0, k+1]. k+1 Decode and perform CRC on the decoded result. If the check succeeds, the terminal will k+1 Decoding is successful. As shown in Figure 7, the terminal can use the random seed t[0,k+1] to decode m k+1 Perform secure inverse processing, such as the random seed t[0,k+1] and m k+1 The input is sent to the submodule that performs the inverse operation of the operation shown in FIG4A , that is, the decryption submodule, and the random seed t[0, k+1] is used to generate the m k+1 Decrypt.

[0148] If the terminal m k+1 If the decoding is successful, S803, S804A~S807A can be repeated. k+1 Can be seen as m k If the terminal is m k+1 If the decoding fails, S803 and S804B to S805B may be repeatedly executed.

[0149] It is understandable that S806A may be executed before S807A, may be executed after S807A, or may be executed simultaneously, and this application does not make any specific limitation.

[0150] In another possible case, if the feedback information in S803 is NACK, that is, the terminal and the base station have no k If the transmission fails, then S804B to S805B can be executed.

[0151] S804B: The base station sends second downlink control information to the terminal.

[0152] Correspondingly, the terminal receives the second downlink control information from the base station.

[0153] For example, the base station and the terminal can schedule the retransmission of m through the second downlink control information k The base station may send the second downlink control information via the PDCCH. The second downlink control information may include a HARQ process number, such as 1. The second downlink control information may also include an NDI, where NDI = 0, indicating that the NDI has not flipped. Since the feedback information in S803 is NACK, indicating that the NDI has not flipped, the base station does not update the random seed t[0, k].

[0154] S805B: The base station sends m to the terminal k .

[0155] Correspondingly, the terminal receives m from the base station k .

[0156] Since the terminal fails to decode TB0, the base station can retransmit m k The base station can use random seeds t[0,k] to k The security processing can be performed by referring to S802, which will not be described here. Since the terminal can determine that the NDI included in the second downlink control information in S805B has not been flipped, that is, m k To retransmit data, the terminal does not need to update the random seed t[0,k].

[0157] The terminal can m k Decode and perform CRC on the decoded result. If the check succeeds, the terminal will k Decoding is successful. The terminal can use the random seed t[0,k] to decode m k Perform secure inverse processing, such as the terminal can convert the random seed t[0,k] and m k The input is sent to the submodule that performs the inverse operation of the operation shown in FIG4A , that is, the decryption submodule, and the random seed t[0, k] is used to generate the m k Decrypt.

[0158] If the terminal m k If the decoding is successful, S803, S804A to S807A can be repeated. kIf the decoding fails, S803 and S804B to S805B may be repeatedly executed.

[0159] In the embodiment of the present application, FIG8 is used to describe a method for updating a random seed in a downlink HARQ process. FIG9 is used below to describe a method for updating a random seed in an uplink HARQ process. FIG9 is a flowchart illustrating an exemplary method for updating a random seed in an uplink HARQ process according to an embodiment of the present application. The method may include the following operations.

[0160] S901: The base station sends first downlink control information to the terminal.

[0161] Correspondingly, the terminal receives the first downlink control information from the base station.

[0162] For example, the base station and the terminal can schedule the kth data m shown in FIG7 through the first downlink control information k The base station may send the first downlink control information via the PDCCH. The first downlink control information may include a HARQ process number, such as the HARQ process number being 1. The first downlink control information may also include an NDI. The value of NDI is an initial value, such as NDI=0. It is understood that the initial value of NDI may also be 1, and this application does not make any specific limitation.

[0163] The first downlink control information in S901 may schedule the first PUSCH. For example, the first downlink control information may include information such as time-frequency domain resources of the first PUSCH. It is understandable that the first downlink control information may also include other information, which will not be described one by one here.

[0164] S902: The terminal sends m to the base station k .

[0165] Accordingly, the base station receives m from the terminal k .

[0166] For example, the terminal may send m through the first PUSCH scheduled by the first downlink control information. k In a possible implementation, the terminal can use random seeds t[1,k] to k For example, the terminal can k Input it into the submodule shown in FIG4A for encryption, and obtain m k The terminal can send m k ciphertext.

[0167] The base station receives m k After that, you can k Decode and perform CRC on the decoding result. If the check succeeds, it is considered that the base station hask Decoding is successful. If verification fails, it is considered that the base station is k Decoding failed. If the base station k If the decoding is successful, the base station can use the random seed t[1,k] to k For example, the base station can use random seeds t[1,k] and m k The input is sent to the submodule that performs the inverse operation of the operation shown in FIG4A, that is, the decryption submodule, and the random seed t[1, k] is used to generate the m k Decrypt.

[0168] In one possible scenario, if the base station k Decoding is successful, that is, the terminal and the base station successfully transmit m k , S903A to S906A can be executed.

[0169] S903A: The base station updates the random seed.

[0170] As shown in Figure 7, the base station and the terminal successfully transmit m k , so the base station and the terminal can update the random seed. The base station can update the random seed t[1,k] based on the random seed t[1,k] and m k Get the updated random seed t[1,k+1]. For example, the base station can use the random seed t[1,k] and m k Input to the submodule shown in FIG4B to obtain an updated random seed t[1, k+1].

[0171] S904A: The base station sends second downlink control information to the terminal.

[0172] Correspondingly, the terminal receives the second downlink control information from the base station.

[0173] For example, the base station and the terminal can schedule the k+1th data m shown in FIG7 through the second downlink control information. k+1 The base station may send the second downlink control information via the PDCCH. The second downlink control information may include a HARQ process number, such as 1. The second downlink control information may also include an NDI, where NDI=1, meaning that the NDI is flipped.

[0174] The second downlink control information in S904A may schedule the second PUSCH, which may be implemented with reference to S901 and will not be described in detail here.

[0175] It is understandable that S903A may be executed before S904A, may be executed after S904A, or may be executed simultaneously, and this application does not make any specific limitation.

[0176] S905A: The terminal updates the random seed t[1, k+1].

[0177] Since the terminal can determine that the NDI included in the second downlink control information in S904A is flipped, the terminal can update the random seed t[1, k+1]. For example, the terminal can update the random seed t[1, k] based on the random seed t[1, k] and m k Get the updated random seed t[1,k+1]. For example, the terminal will update the random seed t[1,k] and m k Input to the submodule shown in FIG4B to obtain an updated random seed t[1, k+1].

[0178] S906A: The terminal sends m to the base station k+1 .

[0179] Accordingly, the base station receives m from the terminal k+1 .

[0180] For example, the terminal may send m through the second PUSCH scheduled by the second downlink control information. k+1 In a possible implementation, the terminal may use a random seed t[1, k+1] to generate m k+1 For example, the terminal can process t[1,k+1] and m k+1 Input it into the submodule shown in FIG4A for encryption, and obtain m k+1 The terminal can send m k+1 If the base station is m k+1 If the decoding is successful, S903A to S906A can be repeated. k+1 Can be seen as m k .

[0181] In one possible scenario, if the base station k Decoding failed, that is, the terminal and the base station have a bad relationship. k If the transmission fails, S903B to S904B may be executed.

[0182] S903B: The base station sends second downlink control information to the terminal.

[0183] Correspondingly, the terminal receives the second downlink control information from the base station.

[0184] For example, the base station and the terminal can schedule the retransmission of m through the second downlink control information kThe base station may send the second downlink control information via the PDCCH. The second downlink control information may include a HARQ process ID, such as 1. The second downlink control information may also include an NDI, where NDI = 0, indicating that the NDI has not flipped. Since the NDI has not flipped, the base station does not update the random seed t[1, k].

[0185] S904B: The terminal sends m to the base station k .

[0186] Accordingly, the base station receives m from the terminal k .

[0187] Since the base station fails to decode TB0, the terminal can retransmit m k The terminal can use random seeds t[1,k] to m k The security processing may be performed with reference to S902 and will not be described in detail here. Since the terminal can determine that the NDI included in the second downlink control information in S904B has not been flipped, the terminal may not update the random seed.

[0188] In a possible implementation, the terminal may use a random seed t[1,k] to generate m k For example, the terminal can k Input it into the submodule shown in FIG4A for encryption, and obtain m k The terminal can send m k If the terminal m k If the decoding is successful, S903A to S906A can be repeated. k If the decoding fails, S903B to S904B may be repeated.

[0189] Based on the above scheme, the random seeds on both the base station and the terminal are updated according to the transmission blocks that are successfully decoded by the legitimate receiver. From the perspective of the non-target receiver, errors can spread between multiple data because the output random seeds are related to the processed data. Once an error occurs in one data, it will affect the subsequent data. If the target receiver always receives correct data, the random number seeds on both sides are always updated. If the target receiver receives m k If it fails, the HARQ process will retransmit m k, the random seed remains unchanged. According to this method, subsequent data, after passing through the extractor, is related to the preceding data. This improves security by preventing an attacker from correctly receiving any intermediate data. Furthermore, for legitimate links, since the random seeds on both sides are synchronized and updated only after the legitimate receiver has confirmed correct data reception, errors are prevented from propagating and communication performance is not compromised.

[0190] In one possible implementation, if the downlink control information indicates data transmitted by the i-th HARQ process, and the k-th data is not newly transmitted data, that is, the k-th data is retransmitted data, the terminal and the base station do not update the random seed t[i, k+1]. The terminal and the base station may use the random seed t[i, k] to perform security processing and security inverse processing on the k-th data.

[0191] If the downlink control information indicates that the kth data transmitted by the i-th HARQ process is newly transmitted data, the terminal and the base station can update the random seed t[i, k]. For example, if MAC layer packet 1 comprises the k-1th data, and MAC layer packet 2 comprises the kth data, then since the k-1th data and the kth data are different data, that is, the kth data is newly transmitted data, the terminal and the base station can update the random seed t[i, k] and perform security processing and security inverse processing on the kth data based on the random seed t[i, k].

[0192] In another possible implementation, if the number of retransmissions of a transport block in the i-th HARQ process is relatively high, an attacker will obtain sufficient information, facilitating the attacker's deciphering of the original information. Therefore, if the number of retransmissions of a transport block in the i-th HARQ process is greater than or equal to a preset threshold, the base station may update the random seed using an initialization random number and send the initialization random seed to the terminal. The base station may reset the number of transmissions of the transport block in the i-th HARQ process to a set value, such as 0. The terminal may also update the random seed based on the initialization random number. The terminal may also reset the number of transmissions of the transport block in the i-th HARQ process to a set value, such as 0. It should be understood that the term "transport block" may be understood as the data described above.

[0193] It should be noted that the number of retransmissions of the transport block of the i-th HARQ process may be the cumulative number of retransmissions of all transport blocks corresponding to the i-th HARQ process. For example, if the i-th HARQ process transmits data 1 once, data 2 twice, and data 3 twice, then the number of retransmissions of the transport block of the i-th HARQ process may be two, that is, the number of retransmissions of data 2 plus the number of retransmissions of data 3. Alternatively, the number of retransmissions of the transport block of the i-th HARQ process may be the cumulative number of retransmissions of a certain transport block corresponding to the i-th HARQ process. For example, if the i-th HARQ process transmits data 1 once and data 2 twice. Then the number of retransmissions of the transport block of the i-th HARQ process may be the cumulative number of retransmissions of data 2, that is, one.

[0194] It is understood that if the number of retransmissions of the transport block in the i-th HARQ process reaches a preset threshold, the base station and terminal will continue to transmit the next new data. At this time, the NDI in the downlink control information also flips. This flip occurs when the number of retransmissions reaches a preset threshold, or in other words, reaches the maximum number of retransmissions. For example, when the base station and terminal are transmitting the k-1th data, because the k-1th data has been retransmitted multiple times, the number of retransmissions of the transport block in the i-th HARQ process reaches the preset threshold. In this case, the base station and terminal can then transmit the kth data.

[0195] In this case, the base station may count the number of retransmissions of the transport block of the i-th HARQ process. For example, the base station may locally maintain the number of retransmissions of the transport block of the i-th HARQ process, such as maintaining the number of retransmissions of a certain transport block of the i-th HARQ process, or maintaining the number of retransmissions of all transport blocks of the i-th HARQ process. When the base station determines that the number of retransmissions of the transport block of the i-th HARQ process is greater than or equal to a preset threshold, the base station updates the random seed t[i, k] according to the initialization random number, and uses the random seed t[i, k] to perform security processing or security inverse processing on the k-th data. The base station may send the initialization random number to the terminal to reset the number of retransmissions of the transport block of the i-th HARQ process to a set value, such as 0.

[0196] The terminal may count the number of retransmissions of the transport block of the i-th HARQ process, which may be implemented by referring to the manner in which the base station counts the number of retransmissions of the transport block of the i-th HARQ process, and will not be further described here. When the terminal determines that the number of retransmissions of the transport block of the i-th HARQ process is greater than or equal to a preset threshold, the terminal may update the random seed t[i, k] based on the initialized random number, and use the random seed t[i, k] to perform security processing or security inverse processing on the k-th data.

[0197] Optionally, if the number of retransmissions of the transport block of the i-th HARQ process is greater than or equal to a preset threshold, the base station and the terminal may not update the random seed, that is, use the random seed t[i, k-1] to perform security processing and security inverse processing on the k-th data. Taking downlink HARQ as an example, since the base station can determine that after retransmitting the k-1-th data twice, the number of retransmissions of the transport block of the i-th HARQ process has reached a preset threshold, the base station can abandon retransmitting the k-1-th data and send downlink control information to the terminal. The NDI in the downlink control information is flipped and indicates the k-th data of the i-th HARQ process. Since the base station can determine that the NDI flip at this time is caused by the number of retransmissions of the transport block of the i-th HARQ process reaching the preset threshold, the base station does not update the random seed and uses the random seed t[i, k-1] to perform security processing on the k-th data.

[0198] It is understood that the base station and the terminal may count the number of retransmissions of the transport block of the i-th HARQ process by referring to the aforementioned method for counting the number of retransmissions of the transport block of the i-th HARQ process by the terminal, and will not be further described here. When the number of retransmissions of the transport block of the i-th HARQ process of the terminal is greater than or equal to a preset threshold, even though the downlink control information indicates that the k-th data is newly transmitted data, the base station and the terminal may not update the random seed and may use the random seed t[i,k-1] to perform security processing and security inverse processing on the k-th data.

[0199] The embodiments of the present application are described using a single HARQ process as an example in Figures 6 to 9 above. The secure communication method provided in the embodiments of the present application can also be applied to multiple HARQ processes. In one possible scenario, in a scenario with multiple HARQ processes, each HARQ process can be associated with a security module. For example, each HARQ process number can be associated with a security module. Referring to Figure 10A , HARQ process #1 can be associated with security module #1, HARQ process #2 can be associated with security module #2, and HARQ process #N can be associated with security module #N.

[0200] As shown in FIG10A , the terminal wants to send data, such as MAC PDU, which is divided into multiple packets, namely m1, m2 to m q The terminal may send each packet to a HARQ buffer associated with each HARQ process, and the security module may update the random seed used by the associated HARQ process and perform security processing on data transmitted by the associated HARQ process.

[0201] For example, if a terminal receives downlink control information indicating that data m1 transmitted by HARQ process #1 is new data, the terminal can update the random seed in security module #1. The terminal then sends m1 to the HARQ buffer associated with HARQ process #1, performs security processing on m1, and then sends it to the base station.

[0202] It can be understood that when the random seed is updated, the input of the security module is obtained from the HARQ buffer of the HARQ process. For example, when updating the random seed t[i,k], the terminal or base station can obtain the successfully transmitted k-1th data from the HARQ buffer associated with the i-th HARQ process and input it into the security module. Optionally, the random seed t[i,k-1] as input can be stored by the HARQ buffer associated with the i-th HARQ process, or by the HARQ entity of the i-th HARQ process. For example, after m1 is successfully transmitted, the terminal can obtain m1 from the HARQ buffer associated with HARQ process #1, and update the random seed based on the random seed t[#1,m1] and m1 to obtain the updated random seed t[#1,m j ],m j It is a packet transmitted by HARQ process #1 among the packets of MAC PDU.

[0203] In one possible implementation, each HARQ process can be associated with a security module. If the number of retransmissions of a transmission block of a certain HARQ process is greater than or equal to a preset threshold, the random seed of the HARQ process can be updated based on the initialized random seed, as shown in FIG10B . It can be understood that each HARQ process can update the random seed used by the current process when the number of retransmissions of the transmission block of the current HARQ process is greater than or equal to the preset threshold corresponding to the current process. For example, when the number of retransmissions of the transmission block of HARQ process #1 is greater than or equal to N1, the terminal and the base station can update the random seed based on the initialized random number. For another example, when the number of retransmissions of the transmission block of HARQ process #2 is greater than or equal to N2, the terminal and the base station can update the random seed based on the initialized random number. For another example, when the number of retransmissions of the transmission block of HARQ process #N is greater than or equal to N N When the random number is initialized, the terminal and the base station can update the random seed based on the initialization random number.

[0204] It is understandable that N1, N2 and N N They can be the same or different, and this application does not make any specific limitations.

[0205] It should be noted that the packets transmitted by each HARQ process in Figures 10A and 10B are shown for illustrative purposes only and do not limit the number of MAC PDU packets transmitted by the HARQ process. Furthermore, the number of HARQ processes may be the same as the number of MAC PDU packets (as shown in Figures 10A and 10B) or may be different. Figures 10A and 10B are shown for illustrative purposes only.

[0206] In another possible scenario, in a scenario with multiple HARQ processes, M uplink HARQ processes can be associated with the same security module. M can be a configurable parameter, such as pre-configured or indicated by high-level signaling, and this application does not make specific limitations. Taking M=2 as an example, the two uplink HARQ processes are referred to as the i-th HARQ process and the i+1-th HARQ process, respectively. The i-th HARQ process and the i+1-th HARQ process can be associated with a security module, such as being associated with the same submodule as shown in FIG4B for updating the random seed, or being associated with the same submodule as shown in FIG4A for security processing or security inverse processing.

[0207] Similarly, in the scenario of multiple HARQ processes, L downlink HARQ processes can be associated with the same security module. Wherein, L can be a configurable parameter, such as being pre-configured or indicated by high-level signaling, and this application does not make specific limitations. It is understandable that M and L can be the same or different. Taking L=2 as an example, the two downlink HARQ processes are respectively referred to as the i-th HARQ process and the i+1-th HARQ process. The i-th HARQ process and the i+1-th HARQ process can be associated with a security module, such as being associated with the same submodule as shown in Figure 4B for updating the random seed, and being associated with the same submodule as shown in Figure 4A for security processing or security inverse processing.

[0208] In the embodiment of the present application, in order to improve the security of the system, some or all fields of the downlink control information may also be securely processed based on the random seed. For example, the downlink control information in S601 may be encrypted based on the random seed t[i, k-1].

[0209] In one possible scenario, the encrypted field in the downlink control information may include HARQ information, time-frequency domain information, and coding information. Optionally, taking one or more fields shown in Table 1 as encrypted fields as an example, the base station may encrypt one or more fields shown in Table 1.

[0210] Table 1: Some fields in downlink control information

[0211] The following describes the process of encrypting downlink control information in conjunction with Figure 10C. Referring to Figure 10C, the base station inputs the information block of the DCI to be transmitted as a packet information block into the security module associated with the HARQ process number carried by the DCI. In the encryption submodule shown in Figure 4A, the encryption submodule can use a random seed to perform encryption operations on one or more fields in the DCI as shown in Table 1. For example, the base station can use the currently valid random seed in the encryption submodule to encrypt part or all of the fields of the DCI. For example, if the DCI indicates that the kth data of the scheduled i-th HARQ process is newly transmitted data, then the base station can use the current random seed in the encryption submodule, that is, the random seed t[i,k-1], for encryption.

[0212] Optionally, to prevent increasing the complexity of PDCCH blind detection, the HARQ process number can remain in plain text format and not be encrypted. The base station reassembles the encrypted fields of the extractor with other unencrypted fields into the DCI information block according to the DCI format. The base station performs subsequent baseband transmission processing according to the standard protocol, such as adding CRC, radio network temporary identity (RNTI) masking, encoding such as polar coding, rate matching, etc., as shown in Figure 10C.

[0213] The terminal blindly detects the DCI signal, and after receiving the DCI signal, it can perform baseband reception processing according to the standard protocol, such as fast Fourier transform (FFT), resource demapping, channel estimation, multiple-input multiple-output (MIMO) decoding, orthogonal amplitude modulation (QAM) demodulation, etc., as shown in Figure 10C.

[0214] When the terminal successfully decodes the DCI (that is, when the CRC check succeeds), it decodes and obtains the HARQ process number carried in the DCI. The terminal can then obtain the currently valid random seed from the security module associated with the HARQ process corresponding to the HARQ process number. The terminal inputs the ciphertext field in the successfully decoded DCI into a submodule that performs the inverse of the operations of the submodule shown in Figure 4A. Using the currently valid random seed, the terminal decrypts the encrypted DCI field, obtaining one or more fields shown in Table 1.

[0215] Based on the above solution, the base station can encrypt part or all of the fields of the downlink control information, thereby improving the security of the downlink control information.

[0216] The following describes a communication device for executing the above-mentioned secure communication method provided in an embodiment of the present application in conjunction with the accompanying drawings.

[0217] Figure 11 is a schematic block diagram of a communication device 1100 provided in an embodiment of the present application. The communication device 1100 can implement the functions or steps implemented by the terminal device or network device in the above-mentioned various method embodiments. The communication device may include a processing unit 1110 and a transceiver unit 1120. Optionally, it may also include a storage unit, which can be used to store instructions (codes or programs) and / or data. The processing unit 1110 and the transceiver unit 1120 can be coupled to the storage unit. For example, the processing unit 1110 can read the instructions (codes or programs) and / or data in the storage unit to implement the corresponding method. The above-mentioned units can be set independently or partially or fully integrated.

[0218] Optionally, the transceiver unit 1120 may include a transmitting unit and a receiving unit, wherein the transmitting unit may be used to perform all transmitting operations performed by the communication device 1100, and the receiving unit may be used to perform all receiving operations performed by the communication device 1100.

[0219] In some possible implementations, the communication device 1100 can implement the behaviors and functions of the terminal device, etc. in the above-mentioned method embodiments. For example, the communication device 1100 can be a terminal device, or a component (such as a chip or circuit) used in the terminal device. The transceiver unit 1120 can be used to perform all receiving or sending operations performed by the terminal device in the embodiment shown in Figure 6. For example, S601 in the embodiment shown in Figure 6, and / or other processes for supporting the technology described herein; wherein the processing unit 1110 is used to perform all operations except the receiving and sending operations performed by the terminal device in the embodiment shown in Figure 6. For example, S602 in the embodiment shown in Figure 6, and / or other processes for supporting the technology described herein.

[0220] For example, the transceiver unit 1120 is configured to receive downlink control information indicating whether the kth data transmitted by the i-th hybrid automatic repeat request (HARQ) process is new data. Where i identifies the HARQ process number. If the kth data is new data, the processing unit 1110 is configured to update a random seed. The updated random seed is used for secure processing of the kth data.

[0221] In some possible implementations, the communication device 1100 can implement the behaviors and functions of the network device in the above-mentioned method embodiments. For example, the communication device 1100 can be a network device, or a component (such as a chip or circuit) used in a network device. The transceiver unit 1120 can be used to perform all receiving or sending operations performed by the network device in the embodiment shown in Figure 6. For example, S601 in the embodiment shown in Figure 6, and / or other processes for supporting the technology described herein; wherein the processing unit 1110 is used to perform all operations except the sending and receiving operations performed by the network device in the embodiment shown in Figure 6.

[0222] For example, the transceiver unit 1120 is configured to receive response information for the k-1th data transmitted by the i-th hybrid automatic repeat request (HARQ) process, where the response information indicates that the k-1th data was successfully transmitted. Alternatively, the transceiver unit 1120 is configured to receive the k-1th data transmitted by the i-th HARQ process and successfully decode the k-1th data. The processing unit 1110 is configured to update a random seed. The updated random seed is used for secure processing of the kth data transmitted by the i-th HARQ process. The transceiver unit 1120 is further configured to send downlink control information, where the downlink control information indicates that the kth data is newly transmitted data.

[0223] For the operations performed by the processing unit 1110 and the transceiver unit 1120 , please refer to the relevant description of the aforementioned method embodiment.

[0224] It should be understood that the processing unit 1110 in the embodiment of the present application can be implemented by a processor or a processor-related circuit component, and the transceiver unit 1120 can be implemented by a transceiver or a transceiver-related circuit component or a communication interface.

[0225] Based on the same concept, as shown in FIG12 , an embodiment of the present application provides a communication device 1200. The communication device 1200 includes a processor 1210. Optionally, the communication device 1200 may further include a memory 1220 for storing instructions executed by the processor 1210, or storing input data required by the processor 1210 to execute instructions, or storing data generated after the processor 1210 executes instructions. The processor 1210 can implement the method shown in the above method embodiment through the instructions stored in the memory 1220.

[0226] Based on the same concept, as shown in Figure 13, an embodiment of the present application provides a communication device 1300, which can be a chip or a chip system. Optionally, in the embodiment of the present application, the chip system can be composed of a chip, or can include a chip and other discrete devices.

[0227] Communication device 1300 may include at least one processor 1310, coupled to a memory. Optionally, the memory may be located within or outside the device. For example, communication device 1300 may also include at least one memory 1320. Memory 1320 stores the necessary computer programs, configuration information, computer programs or instructions, and / or data for implementing any of the aforementioned embodiments. Processor 1310 may execute the computer programs stored in memory 1320 to perform the method in any of the aforementioned embodiments.

[0228] The coupling in the embodiments of the present application is an indirect coupling or communication connection between devices, units, or modules, which can be electrical, mechanical, or other forms, and is used for information exchange between devices, units, or modules. The processor 1310 may operate in conjunction with the memory 1320. The specific connection medium between the transceiver 1330, processor 1310, and memory 1320 is not limited in the embodiments of the present application.

[0229] The communication device 1300 may also include a transceiver 1330, and the communication device 1300 can exchange information with other devices through the transceiver 1330. The transceiver 1330 can be a circuit, a bus, a transceiver or any other device that can be used for information exchange, or is called a signal transceiver unit. As shown in Figure 13, the transceiver 1330 includes a transmitter 1331, a receiver 1332 and an antenna 1333. In addition, when the communication device 1300 is a chip-type device or circuit, the transceiver in the communication device 1300 can also be an input and output circuit and / or a communication interface, which can input data (or receive data) and output data (or send data). The processor is an integrated processor or microprocessor or integrated circuit, and the processor can determine the output data based on the input data.

[0230] In one possible implementation, the communication device 1300 can be applied to a terminal device. Specifically, the communication device 1300 can be a terminal device, or a device that can support the terminal device in implementing the functions of the terminal device in any of the above-mentioned embodiments. The memory 1320 stores the necessary computer programs, computer programs or instructions and / or data to implement the functions of the terminal device in any of the above-mentioned embodiments. The processor 1310 can execute the computer program stored in the memory 1320 to perform the method performed by the terminal device in any of the above-mentioned embodiments.

[0231] In one possible implementation, the communication device 1300 can be applied to a network device. Specifically, the communication device 1300 can be a network device or a device that can support the network device in implementing the functions of the network device in any of the above-mentioned embodiments. The memory 1320 stores the necessary computer programs, computer programs or instructions and / or data to implement the functions of the network device in any of the above-mentioned embodiments. The processor 1310 can execute the computer program stored in the memory 1320 to perform the method performed by the network device in any of the above-mentioned embodiments.

[0232] Since the communication device 1300 provided in this embodiment can be applied to a terminal device to implement the method executed by the terminal device, or can be applied to a network device to implement the method executed by the network device, the technical effects that can be obtained can be referred to the above method embodiments and will not be repeated here.

[0233] In the embodiments of the present application, the processor may be a general-purpose processor, a digital signal processor, an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, or a discrete hardware component, and may implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of the present application. A general-purpose processor may be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of the present application may be directly implemented as being executed by a hardware processor, or may be executed by a combination of hardware and software modules in the processor.

[0234] In an embodiment of the present application, the memory may be a non-volatile memory, such as a hard disk drive (HDD) or a solid-state drive (SSD), etc., or a volatile memory (volatile memory), such as a random-access memory (RAM). The memory may also be any other medium that can be used to carry or store desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory in an embodiment of the present application may also be a circuit or any other device that can implement a storage function, for storing computer programs, computer programs or instructions and / or data.

[0235] Based on the above embodiments, referring to FIG14 , an embodiment of the present application also provides another communication device 1400, including: an input / output interface 1410 and a logic circuit 1420; the input / output interface 1410 is used to receive code instructions and transmit them to the logic circuit 1420; the logic circuit 1420 is used to run code instructions to execute the method executed by the terminal device or network device in any of the above embodiments.

[0236] Alternatively, the input / output interface 1410 may be an interface on a chip, and the logic circuit 1420 may be one or more processors. Alternatively, the one or more processors may be located within the device or outside the device.

[0237] The following describes in detail the operations performed by the communication device when applied to a terminal device or a network device.

[0238] In an optional implementation, the communication device 1400 may be applied to a terminal device to execute the method executed by the aforementioned terminal device, for example, the method executed by the terminal device in the embodiment shown in FIG. 6 .

[0239] For example, input / output interface 1410 is configured to input downlink control information, where the downlink control information indicates whether the kth data transmitted by the i-th Hybrid Automatic Repeat Request (HARQ) process is new data. Where i identifies the HARQ process number. If the kth data is new data, logic circuit 1420 is configured to update a random seed. The updated random seed is used to ensure secure processing of the kth data.

[0240] Since the communication device 1400 provided in this embodiment can be applied to a terminal device to implement the method executed by the terminal device, the technical effects that can be obtained can be referred to the above method embodiment and will not be described in detail here.

[0241] In an optional implementation, the communication device 1400 may be applied to a network device to execute the method executed by the aforementioned network device, for example, the method executed by the network device in the embodiment shown in FIG. 6 .

[0242] For example, input / output interface 1410 is configured to input response information for the k-1th data transmitted by the i-th hybrid automatic repeat request (HARQ) process, where the response information indicates successful transmission of the k-1th data. Alternatively, input / output interface 1410 is configured to input and successfully decode the k-1th data transmitted by the i-th HARQ process. Logic circuit 1420 is configured to update a random seed. The updated random seed is used for secure processing of the k-th data transmitted by the i-th HARQ process. Input / output interface 1410 is further configured to output downlink control information, where the downlink control information indicates that the k-th data is newly transmitted data.

[0243] Since the communication device 1400 provided in this embodiment can be applied to a network device to implement the method executed by the above network device, the technical effects that can be obtained can be referred to the above method embodiment and will not be described in detail here.

[0244] Based on the above embodiments, embodiments of the present application further provide a communication system. The communication system includes at least one communication device applied to a terminal device and at least one communication device applied to a network device. The technical effects that can be achieved can be referenced to the above method embodiments and will not be further described here.

[0245] Based on the above embodiments, the present application also provides a system. The communication system includes at least one network device and a terminal device.

[0246] Based on the above embodiments, embodiments of the present application further provide a computer-readable storage medium storing a computer program or instructions. When the instructions are executed, the method executed by the terminal device or the method executed by the network device in any of the above embodiments is implemented. The computer-readable storage medium may include various media capable of storing program code, such as a USB flash drive, a mobile hard drive, a read-only memory, a random access memory, a magnetic disk, or an optical disk.

[0247] To implement the functions of the communication device shown in Figures 11 to 14 above, embodiments of the present application further provide a chip including a processor for supporting the communication device in implementing the functions of the terminal device or network device in the above method embodiments. In one possible design, the chip is connected to or includes a memory, which is used to store computer programs, instructions, and data necessary for the communication device.

[0248] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0249] The present application is described with reference to the flow chart and / or block diagram of the method, device (system) and computer program product according to the embodiment of the present application. It should be understood that each flow process and / or box in the flow chart and / or block diagram and the combination of the flow process and / or box in the flow chart and / or block diagram can be realized by a computer program or instruction. These computer programs or instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processing machine or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device produce a device for realizing the function specified in one flow chart flow or multiple flows and / or one box or multiple boxes of the block diagram.

[0250] These computer programs or instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device that implements the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0251] These computer programs or instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, whereby the instructions executed on the computer or other programmable device provide steps for implementing the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0252] Obviously, those skilled in the art can make various changes and modifications to the embodiments of the present application without departing from the scope of the embodiments of the present application. Thus, if these modifications and variations of the embodiments of the present application fall within the scope of the claims of the present application and their equivalents, the present application also intends to include these modifications and variations.

Claims

1. A secure communication method, characterized in that: include: receiving downlink control information, where the downlink control information is used to indicate whether the kth data transmitted by the i-th hybrid automatic repeat request HARQ process is new data, where i identifies the HARQ process number; If the k-th data is newly transmitted data, the random seed is updated; the updated random seed is used for secure processing of the k-th data.

2. The method according to claim 1, characterized in that The identifier of the i-th HARQ process is associated with the i-th security module, and the i-th security module is used to update and / or generate the random seed and perform security processing on the k-th data.

3. The method according to claim 1 or 2, characterized in that: The updating of the random seed of the i-th HARQ process includes: The updated random seed is obtained according to the k-1th data and the first random seed; the first random seed is used to perform security processing on the k-1th data, and the k-1th data is the data successfully transmitted in the i-th HARQ process.

4. The method according to any one of claims 1 to 3, characterized in that: The downlink control information includes a new data indication NDI. If the NDI is flipped, it indicates that the kth data is newly transmitted data; if the NDI is not flipped, it indicates that the kth data is retransmitted data.

5. The method according to any one of claims 1 to 4, characterized in that: Before receiving the downlink control information, the method further includes: Receiving k-1th data transmitted by the i-th HARQ process; performing secure inverse processing on the k-1th data based on the first random seed; the updated random seed is updated based on the first random seed; Send response information of the k-1th data; the response information is used to indicate that the k-1th data is successfully transmitted.

6. The method according to any one of claims 1 to 4, characterized in that: Also includes: If the downlink control information indicates that the kth data is new data, sending the kth data after security processing; The kth data is securely processed using the updated random seed.

7. The method according to any one of claims 1 to 6, characterized in that: Also includes: Some or all of the fields included in the downlink control information are encrypted, and the downlink control information is decrypted based on the first random seed; The updated random seed is updated based on the first random seed.

8. The method according to claim 7, characterized in that The HARQ process number of the i-th HARQ process included in the downlink control information is not encrypted.

9. The method according to any one of claims 1 to 8, characterized in that: If the k-th data is new data, updating the random seed comprises: If the number of retransmissions of the transport block in the i-th HARQ process is greater than or equal to a preset threshold, and the k-th data is new transmission data, receiving an initialization random number; Based on the initialization random number, the random seed is updated, and the number of retransmissions is reset to a set value.

10. The method according to claim 9, characterized in that The number of retransmissions of the transport block in the i-th HARQ process includes the accumulation of the number of retransmissions of all transport blocks corresponding to the i-th HARQ process; or, the number of retransmissions of the transport block in the i-th HARQ process includes the accumulation of the number of retransmissions of a certain transport block of the i-th HARQ process.

11. A secure communication method, characterized in that: include: receiving response information of the k-1th data transmitted by the i-th hybrid automatic repeat request HARQ process, where the response information is used to indicate that the k-1th data is successfully transmitted; or receiving the k-1th data transmitted by the i-th HARQ process and successfully decoding the k-1th data; Updating the random seed; the updated random seed is used for secure processing of the kth data transmitted by the i-th HARQ process; Send downlink control information, where the downlink control information is used to indicate that the k-th data is new transmission data.

12. The method according to claim 11, characterized in that The identifier of the i-th HARQ process is associated with the i-th security module, and the i-th security module is used to update and / or generate the random seed and perform security processing on the k-th data.

13. The method according to claim 11 or 12, characterized in that: The updating of the random seed of the i-th HARQ process includes: The updated random seed is obtained according to the k-1th data and the first random seed; the first random seed is used to perform security processing on the k-1th data, and the k-1th data is the data successfully transmitted in the i-th HARQ process.

14. The method according to any one of claims 11 to 13, characterized in that: The downlink control information includes a new data indication NDI. If the NDI is flipped, it indicates that the kth data is newly transmitted data; if the NDI is not flipped, it indicates that the kth data is retransmitted data.

15. The method according to any one of claims 11 to 14, characterized in that: Before receiving the response information of the k-1th data transmitted by the i-th hybrid automatic repeat request HARQ process, the method further includes: securely processing the k-1th data based on a first random seed; the updated random seed is updated based on the first random seed; Send the k-1th data after security processing.

16. The method according to any one of claims 11 to 14, characterized in that: Also includes: If the downlink control information indicates that the kth data is new data, receiving the kth data after security processing; The securely processed kth data is securely inversely processed based on the updated random seed.

17. The method according to any one of claims 11 to 16, characterized in that: Also includes: Some or all of the fields included in the downlink control information are encrypted, and the downlink control information is decrypted based on the first random seed; The updated random seed is updated based on the first random seed.

18. The method according to claim 17, characterized in that The HARQ process number of the i-th HARQ process included in the downlink control information is not encrypted.

19. The method according to any one of claims 11 to 18, characterized in that: If the k-th data is new data, updating the random seed comprises: If the number of retransmissions of the transport block in the i-th HARQ process is greater than or equal to a preset threshold, updating the random seed based on the initialization random number; The initialization random number is sent, and the number of retransmissions is reset to a set value.

20. The method according to claim 19, characterized in that The number of retransmissions of the transport block in the i-th HARQ process includes the accumulation of the number of retransmissions of all transport blocks corresponding to the i-th HARQ process; or, the number of retransmissions of the transport block in the i-th HARQ process includes the accumulation of the number of retransmissions of a certain transport block of the i-th HARQ process.

21. A communication device, characterized in that: The method comprises means for executing the method according to any one of claims 1 to 10.

22. A communication device, characterized in that: Comprising means for performing the method as claimed in any one of claims 11 to 20.

23. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, which, when called by an electronic device, enable the electronic device to execute the method as claimed in any one of claims 1 to 10, or enable the electronic device to execute the method as claimed in any one of claims 11 to 20.

24. A communication system, characterized in that: The invention comprises a device for executing the method according to any one of claims 1 to 10 and a device for executing the method according to any one of claims 11 to 20.

25. A chip system, characterized in that: The chip system comprises: Communication interface; A processor, configured to call and execute the instruction through the communication interface, so that a device equipped with the chip system executes the method as described in any one of claims 1 to 10, or so that a device equipped with the chip system executes the method as described in any one of claims 11 to 20.

Images