Communication method and communication apparatus

Abstract

Provided in the present application is a communication method, the method comprising: a network device determining a security algorithm, wherein the security algorithm comprises a portion for performing confidentiality protection and a portion for performing integrity protection; the network device activating a security protection between the network device itself and a terminal device on the basis of the security algorithm and a security key, wherein the security key is a key shared between the terminal device and the network device; and the network device receiving a securely protected uplink message from the terminal device, using the security key as an input key of the portion for performing integrity protection in the security algorithm to perform integrity verification on the uplink message, and using the security key as an input key of the portion for performing confidentiality protection in the security algorithm to decrypt the uplink message. The security algorithm can implement both confidentiality protection and integrity protection, and a network device can perform an integrity check and decryption on the basis of the same security key, thereby avoiding potential security vulnerabilities existing in a combination of a confidentiality security protection algorithm and an integrity security protection algorithm.

Description

Communication method and communication device

[0001] This application claims priority to the Chinese patent application filed with the China Patent Office on August 4, 2023, with application number 202310985716.0 and application name “Communication Method and Communication Device”, the entire contents of which are incorporated by reference into this application. Technical Field

[0002] The present application relates to the field of communications, and more particularly, to a communication method and a communication device. Background Art

[0003] When a network device starts the non-access stratum (NAS) security mode control procedure (SMC) or the access stratum (AS) security mode control procedure, the network side sends a security mode command (SMC) message to the terminal side. The terminal device responds to the SMC message and replies to the network side with a security mode complete (SMP) message.

[0004] The terminal device and the network can negotiate security protection algorithms based on the SMC process to protect messages transmitted between them. For example, the terminal device and the network can negotiate the algorithms required for confidentiality and integrity protection based on the SMC process. When both confidentiality and integrity protection are required for transmitted messages, how to avoid the security risks associated with combining these algorithms becomes a pressing issue.

[0005] Summary of the Invention

[0006] The present application provides a communication method to avoid the security risks of the combination of a confidentiality security protection algorithm and an integrity security protection algorithm.

[0007] In a first aspect, a communication method is provided, which may be executed by a network device or a component of the network device (eg, a chip or circuit), and is not limited in this application.

[0008] The communication method includes: determining a security algorithm, wherein the security algorithm includes a part for confidentiality protection and a part for integrity protection; activating security protection between the network device and the terminal device based on the security algorithm and a security key, wherein the security key is a key shared between the terminal device and the network device; receiving a security-protected uplink message from the terminal device, using the security key as an input key for the integrity protection part in the security algorithm to verify the integrity of the security-protected uplink message, and using the security key as an input key for the confidentiality protection part in the security algorithm to decrypt the security-protected uplink message.

[0009] The network device uses the security key as the input key for the integrity protection portion of the security algorithm to verify the integrity of the uplink message, including: the network device uses part or all of the information elements carried in the uplink message and uses the security key as the input key for the integrity protection portion of the security algorithm to verify the integrity of the uplink message. In addition, the network device uses the security key as the input key for the confidentiality protection portion of the security algorithm to decrypt the security-protected uplink message, including: the network device uses the security key as the input key for the confidentiality protection portion of the security algorithm to decrypt part or all of the information elements carried in the security-protected uplink message.

[0010] Based on the above scheme, the security algorithm determined by the network device can achieve both confidentiality protection and integrity protection. The network device can then perform integrity verification and decryption of uplink messages based on the same security key and the security algorithm, thereby avoiding the security risks that exist in the combination of the confidentiality security protection algorithm and the integrity security protection algorithm. For example, the confidentiality security protection algorithm and the integrity security protection algorithm are used to perform security protection on messages transmitted between the terminal device and the network device (such as AMF or access network device), specifically including: first performing integrity security protection on the message based on the integrity security protection algorithm, and then using the result of the integrity security protection as the input parameter of the confidentiality security protection algorithm to perform confidentiality security protection on the message. When the result of the integrity security protection is used as the input parameter of the confidentiality security protection, there may be algorithm splicing, and algorithm splicing brings security risks.

[0011] Moreover, in the above scheme, both confidentiality protection and integrity protection can be achieved based on the same security key. The use of the same security key can also reduce the complexity of key deduction and save key storage space.

[0012] In combination with the first aspect, in certain implementations of the first aspect, after activating the security protection between the network device and the terminal device based on the security algorithm and the security key, the method further includes: performing security protection on the security mode command message to be sent based on the security algorithm, the security mode command message to be sent includes a first parameter and a second parameter, and sending a security-protected security mode command message to the terminal device, the security-protected security mode command message includes a first ciphertext, a first message authentication code MAC and the first parameter, wherein the first ciphertext is obtained by performing confidentiality protection on the second parameter based on the security algorithm, and the first MAC is obtained by performing integrity protection calculation on the first parameter and the first ciphertext based on the security algorithm.

[0013] Based on the above solution, the security-protected security mode command message sent by the network device carries a first ciphertext obtained by performing confidentiality protection on the second parameter based on a security algorithm, and a first MAC calculated by performing integrity protection on the first parameter and the first ciphertext based on the security algorithm. Furthermore, the security algorithm also includes the first parameter required by the terminal device for security verification. The network device uses this security algorithm to perform confidentiality and integrity security protection on the security mode command message, allowing certain parameters to be transmitted through the security mode command message while maintaining confidentiality, thereby improving security. Furthermore, the security mode command message also carries the first parameter in plaintext, facilitating security verification based on the first parameter upon receipt of the security mode command message.

[0014] In combination with the first aspect, in certain implementations of the first aspect, the first parameter includes at least one of the following: an identifier of the security algorithm, security capability information of the replayed terminal device, a key identifier of the first key, or first key change indication information, wherein the first key is used to determine the security key.

[0015] Based on the above solution, the first parameter carried in the security-protected security mode command message may include: an identifier of a security algorithm, security capability information of a replayed terminal device, first key change indication information, or a key identifier of a first key. There are various ways to enable a terminal device to perform security verification based on the first parameter. For example, the terminal device may verify whether the security mode command message has been tampered with based on the security capability information of the replayed terminal device. Another example is that the terminal device may determine the key of the security algorithm based on the key identifier of the first key and perform integrity verification, thereby further improving the security of message transmission.

[0016] In combination with the first aspect, in certain implementations of the first aspect, the security protection safety mode command message also includes first indication information, and the first indication information is used to indicate the length of the first parameter and / or to indicate the position of the first parameter in the security protection safety mode command message.

[0017] Based on the above scheme, the security mode command message can also carry first indication information to indicate the specific position and / or length of the above-mentioned first parameter, so that the terminal device can quickly and accurately read the first parameter from the security mode command message of the security protection based on the first indication information, thereby reducing processing delay.

[0018] In combination with the first aspect, in some implementations of the first aspect, the security mode command message for security protection includes a first packet header type indication, and the first packet header type indication is used to indicate that the security mode command message for security protection is security protected based on the security algorithm.

[0019] In combination with the first aspect, in certain implementations of the first aspect, after activating security protection between itself and the terminal device based on the security algorithm and the security key, the method further includes: using the security key as the input key of the integrity protection part to perform integrity protection on the security mode command message to be sent; and sending the integrity-protected security mode command message to the terminal device.

[0020] Based on the above solution, network devices can perform integrity security protection on the security mode command message to be transmitted based on the integrity protection portion of the security algorithm. This eliminates the need to select an integrity security algorithm or transmit the integrity security algorithm identifier to the terminal device. The terminal device can perform integrity security verification based on the integrity protection portion of the security algorithm, reducing signaling overhead.

[0021] In combination with the first aspect, in certain implementations of the first aspect, after determining the security algorithm, the method further includes: determining a first integrity security protection algorithm based on the security algorithm; performing integrity protection on the security mode command message to be sent based on the first integrity security protection algorithm, and sending the integrity-protected security mode command message to the terminal device.

[0022] Based on the above solution, the network device can further determine the first integrity security protection algorithm required for integrity protection of the security mode command message based on the determined security algorithm. In this technical solution, the security mode command message sent by the network device does not need to carry the identifier of the first integrity security protection algorithm. This is because the terminal device can also determine the first integrity security protection algorithm based on the security algorithm and perform integrity verification, which can reduce signaling overhead.

[0023] In combination with the first aspect, in certain implementations of the first aspect, after integrity protection is performed on the security mode command message to be sent based on the first integrity security protection algorithm, the method further includes: deleting the first integrity security protection algorithm in the security context.

[0024] Based on the above scheme, after the network device performs integrity protection on the security mode command message to be sent based on the first integrity security protection algorithm, it can delete the first integrity security protection algorithm in the security context, because the subsequently transmitted messages can be security protected based on the determined security algorithm without the need to be security protected based on the first integrity security protection algorithm. Compared with the scheme of saving all determined security protection algorithms as security context, it can reduce storage overhead.

[0025] In combination with the first aspect, in certain implementations of the first aspect, the integrity protection of the security mode command message to be sent based on the first integrity security protection algorithm includes: using the security key as the input key of the first integrity security protection algorithm to perform integrity protection on the security mode command message to be sent.

[0026] Based on the above solution, the network device can use the above security key when performing integrity protection on the security mode command message to be sent based on the first integrity security protection algorithm, without the need to determine a key separately, thereby reducing processing complexity.

[0027] In combination with the first aspect, in certain implementations of the first aspect, determining the first integrity security protection algorithm based on the security algorithm includes: using an algorithm with the confidentiality protection part in the security algorithm cleared as the first integrity security protection algorithm; or determining the first integrity security protection algorithm based on the correspondence between the security algorithm and the first integrity security protection algorithm and the security algorithm.

[0028] Based on the above solution, the network device can determine the first integrity security protection algorithm based on the security algorithm in different ways, including but not limited to: directly setting the confidentiality protection portion of the selected security algorithm to be blank and using it as the first integrity security protection algorithm; or determining the first integrity security protection algorithm based on a locally stored correspondence (i.e., the correspondence between the security algorithm and the first integrity security protection algorithm) and the selected security algorithm, thereby improving the flexibility of the solution.

[0029] In combination with the first aspect, in certain implementations of the first aspect, if the security algorithm is the SNOW-AEAD algorithm, then the first integrity security protection algorithm is the SNOW integrity security protection algorithm; or, if the security algorithm is the ZUC-AEAD algorithm, then the first integrity security protection algorithm is the ZUC integrity security protection algorithm; or, if the security algorithm is the AES-AEAD algorithm, then the first integrity security protection algorithm is the AES integrity security protection algorithm.

[0030] In combination with the first aspect, in certain implementations of the first aspect, the method further includes: determining a second integrity security protection algorithm, and performing integrity protection on a security mode command message to be sent based on the second integrity security protection algorithm; sending an integrity-protected security mode command message to the terminal device, the integrity-protected security mode command message including an identifier of the security algorithm and an identifier of the second integrity security protection algorithm.

[0031] Based on the above solution, the network device can determine a second integrity security algorithm for integrity protection of the secure mode command message to be transmitted. The aforementioned security algorithm is then used to implement confidentiality and integrity security protection for messages transmitted after the secure mode command message. Specifically, in this technical solution, messages transmitted between the network device and the terminal device subsequent to the secure mode command message are protected using this security algorithm, thus avoiding the security risks associated with combining the confidentiality and integrity security algorithms.

[0032] In combination with the first aspect, in certain implementations of the first aspect, after integrity protection is performed on the security mode command message to be sent based on the second integrity security protection algorithm, the method further includes: deleting the second integrity security protection algorithm in the security context.

[0033] Based on the above scheme, after the network device performs integrity protection on the security mode command message to be sent based on the second integrity security protection algorithm, it can delete the second integrity security protection algorithm in the security context, because the subsequently transmitted messages can be security protected based on the determined security algorithm and do not need to be security protected based on the second integrity security protection algorithm. Compared with the scheme of saving all determined security protection algorithms as security context, it can reduce storage overhead.

[0034] In combination with the first aspect, in certain implementations of the first aspect, the method further includes: determining a third integrity security protection algorithm, and performing security protection on a security mode command message to be sent based on the third integrity security protection algorithm; sending an integrity-protected security mode command message to the terminal device, the integrity-protected security mode command message including an identifier of the third integrity security protection algorithm and second indication information, the second indication information being used to indicate that a message transmitted after the security mode command message is to be security protected based on the security algorithm.

[0035] In combination with the first aspect, in some implementations of the first aspect, the identifier of the third integrity security protection algorithm is used to determine the security algorithm.

[0036] In combination with the first aspect, in some implementations of the first aspect, the method further includes: determining the security algorithm based on the correspondence between the third integrity security protection algorithm and the security algorithm, and the third integrity security protection algorithm.

[0037] Based on the above solution, the network device determines a third integrity security protection algorithm, activates the third integrity security protection algorithm, and performs integrity security protection on the security mode command message to be transmitted based on the third integrity security protection algorithm. Furthermore, the network device includes second indication information in the security mode command message, which indicates that messages transmitted after the security mode command message should be protected for confidentiality and integrity based on the security algorithm.

[0038] Specifically, the third integrity security protection algorithm can determine the security algorithm, allowing the network device and the terminal device to implement a security protection method for messages transmitted after the negotiated security mode command message, using the identifier of the third integrity security protection algorithm carried in the security mode command message. In this technical solution, subsequent messages transmitted between the network device and the terminal device are protected using this security algorithm, avoiding the security risks associated with combining the confidentiality and integrity security protection algorithms.

[0039] In combination with the first aspect, in certain implementations of the first aspect, after integrity protection is performed on the security mode command message to be sent based on the first integrity security protection algorithm, the method further includes: deleting the third integrity security protection algorithm in the security context.

[0040] Based on the above scheme, after the network device performs integrity protection on the security mode command message to be sent based on the third integrity security protection algorithm, it can delete the third integrity security protection algorithm in the security context, because the subsequently transmitted messages can be security protected based on the determined security algorithm and do not need to be security protected based on the third integrity security protection algorithm. Compared with the scheme of saving all determined security protection algorithms as security context, it can reduce storage overhead.

[0041] In combination with the first aspect, in some implementations of the first aspect, determining the security algorithm includes: selecting the security algorithm according to a priority of at least one security algorithm, wherein the security algorithm is one of the at least one security algorithm.

[0042] Based on the above solution, when the network device selects a security algorithm, if the network device has multiple locally stored security algorithms, considering the priorities of different security algorithms, a security algorithm with a higher priority can be selected as the above security algorithm.

[0043] In combination with the first aspect, in some implementations of the first aspect, the security algorithm is an authenticated encryption AEAD algorithm with associated data.

[0044] In combination with the first aspect, in certain implementations of the first aspect, the security-protected uplink message includes a security mode response message.

[0045] Based on the above solution, the network device receives a security mode response message (e.g., a security mode completion message) from the terminal device. The security mode response message is based on the confidentiality and integrity security protection of the security algorithm. The security mode response message implements confidentiality and integrity security protection based on a single security algorithm, avoiding the security risks of combining the confidentiality security protection algorithm and the integrity security protection algorithm.

[0046] In combination with the first aspect, in some implementations of the first aspect, the security-protected uplink message header includes a second packet header type indication, and the second packet header type indication is used to indicate that the security-protected uplink message is security-protected based on the security algorithm.

[0047] In combination with the first aspect, in certain implementations of the first aspect, the security mode command message (such as the security mode command message with security protection or the integrity protection security mode command message) sent by the above-mentioned network device to the terminal device is used to indicate the activation of security protection between the terminal device and the network device.

[0048] In a second aspect, a communication method is provided. The method may be executed by a terminal device or by a component of the terminal device (such as a chip or circuit), which is not limited in this application.

[0049] The communication method includes: determining a security algorithm, the security algorithm including a portion for performing confidentiality protection and a portion for performing integrity protection; activating security protection between the terminal device and the network device based on the security algorithm and a security key, the security key being a key shared between the terminal device and the network device; performing security protection on an uplink message to be sent based on the security algorithm and the security key, and sending the security-protected uplink message to the network device, wherein the performing security protection on the uplink message to be sent based on the security algorithm and the security key includes:

[0050] The security key is used as an input key of the integrity protection part in the security algorithm to perform integrity protection on the uplink message to be sent, and the security key is used as an input key of the confidentiality protection part in the security algorithm to perform confidentiality protection on the uplink message to be sent.

[0051] In combination with the second aspect, in certain implementations of the second aspect, a security mode command message of security protection is received from the network device, the security mode command message of security protection is used to instruct the terminal device to activate security protection between the terminal device and the network device, the security mode command message of security protection includes a first ciphertext, a first message authentication code MAC and a first parameter, the security algorithm and the security key are determined based on the first parameter; the security key is used as the input key of the integrity protection part of the security algorithm, and the first ciphertext and the first parameter are used as the input parameters of the integrity protection part of the security algorithm to calculate the MAC, and the integrity of the security mode command message of security protection is verified based on the first MAC and the calculated MAC; if the integrity verification passes, the first ciphertext is decrypted using the security key as the input key of the confidentiality protection part of the security algorithm to obtain the second parameter.

[0052] In combination with the second aspect, in certain implementations of the second aspect, the first parameter includes at least one of the following: an identifier of the security algorithm, security capability information of the replayed terminal device, a key identifier of the first key, or indication information of the change of the first key, wherein the first key is used to determine the security key.

[0053] In combination with the second aspect, in certain implementations of the second aspect, the security protection safety mode command message also includes first indication information, and the first indication information is used to indicate the length of the first parameter and / or to indicate the position of the first parameter in the security protection safety mode command message; the method also includes: determining the first parameter based on the first indication information.

[0054] In combination with the second aspect, in some implementations of the second aspect, the security mode command message of the security protection includes a first packet header type indication, and the first packet header type indication is used to indicate that the security mode command message of the security protection is security protected based on the security algorithm.

[0055] In conjunction with the second aspect, in certain implementations of the second aspect, determining the security algorithm includes: receiving a security mode command message for integrity protection from the network device; determining the security algorithm according to an identifier of the security algorithm;

[0056] The method further includes performing integrity verification on the integrity-protected security mode command message using the security key as an input key of an integrity-protected portion in the security algorithm.

[0057] In conjunction with the second aspect, in certain implementations of the second aspect, determining the security algorithm includes: receiving a security mode command message for integrity protection from the network device; determining the security algorithm according to an identifier of the security algorithm;

[0058] The method further includes: determining a first integrity security protection algorithm according to the security algorithm; and performing integrity verification on the integrity-protected security mode command message based on the first integrity security protection algorithm.

[0059] In combination with the second aspect, in some implementations of the second aspect, after the integrity verification is successful, the method further includes: deleting the first integrity security protection algorithm in the security context.

[0060] In combination with the second aspect, in certain implementations of the second aspect, the integrity verification of the integrity-protected security mode command message based on the first integrity security protection algorithm includes: using the security key as the input key of the first integrity security protection algorithm to perform integrity verification on the integrity-protected security mode command message.

[0061] In combination with the second aspect, in certain implementations of the second aspect, determining the first integrity security protection algorithm based on the security algorithm includes: using an algorithm with the confidentiality protection part in the security algorithm cleared as the first integrity security protection algorithm; or determining the first integrity security protection algorithm based on the correspondence between the security algorithm and the first integrity security protection algorithm and the security algorithm.

[0062] In combination with the second aspect, in certain implementations of the second aspect, if the security algorithm is the SNOW-AEAD algorithm, the first integrity security protection algorithm is the SNOW integrity security protection algorithm; or, if the security algorithm is the ZUC-AEAD algorithm, the first integrity security protection algorithm is the ZUC integrity security protection algorithm; or, if the security algorithm is the AES-AEAD algorithm, the first integrity security protection algorithm is the AES integrity security protection algorithm.

[0063] In combination with the second aspect, in certain implementations of the second aspect, determining the security algorithm includes: receiving an integrity-protected security mode command message from the network device, the integrity-protected security mode command message including an identifier of the security algorithm and an identifier of the second integrity security protection algorithm; performing integrity verification on the integrity-protected security mode command message based on the second integrity security protection algorithm, and determining the security algorithm based on the identifier of the security algorithm.

[0064] In combination with the second aspect, in some implementations of the second aspect, after the integrity verification is successful, the method further includes: deleting the second integrity security protection algorithm in the security context.

[0065] In combination with the second aspect, in certain implementations of the second aspect, determining the security algorithm includes: receiving an integrity-protected security mode command message from the network device, the integrity-protected security mode command message including an identifier of the third integrity security protection algorithm and second indication information, the second indication information being used to indicate that a message transmitted after the security mode command message is security-protected based on the security algorithm; performing integrity verification on the integrity-protected security mode command message based on the third integrity security protection algorithm, and determining the security algorithm based on the third integrity security protection algorithm.

[0066] In combination with the second aspect, in some implementations of the second aspect, after the integrity verification is successful and the security algorithm is determined based on the third integrity security protection algorithm, the method further includes: deleting the third integrity security protection algorithm in the security context.

[0067] In combination with the second aspect, in some implementations of the second aspect, the security algorithm is an authenticated encryption AEAD algorithm with associated data.

[0068] In combination with the second aspect, in certain implementations of the second aspect, the security-protected uplink message includes a security mode response message.

[0069] The technical effects of the method shown in the above second aspect and its possible design can refer to the technical effects in the first aspect and its possible design.

[0070] In a third aspect, a communication device is provided for implementing the method described in the first aspect. The device includes a transceiver unit and a processing unit, wherein the transceiver unit is used to send and receive information, and the processing unit is used to perform internal processing actions.

[0071] In a fourth aspect, a communication device is provided for implementing the method described in the second aspect. The device includes a transceiver unit and a processing unit, wherein the transceiver unit is used to send and receive information, and the processing unit is used to perform internal processing actions.

[0072] In a fifth aspect, a communication system is provided, comprising a network device and a terminal device, wherein the network device is used to execute the method shown in the above-mentioned first aspect, and the terminal device executes the method shown in the above-mentioned second aspect.

[0073] In a sixth aspect, a communication device is provided, which includes: a memory for storing programs; a processor for executing the programs stored in the memory, and when the programs stored in the memory are executed, the processor is used to execute the methods provided in the above aspects.

[0074] In a seventh aspect, the present application provides a processor for executing the methods provided in the above aspects. In the process of executing these methods, the process of sending the above information and obtaining / receiving the above information in the above methods can be understood as the process of the processor outputting the above information and the process of the processor receiving the input above information. When outputting the above information, the processor outputs the above information to the transceiver so that the transceiver can transmit it. After being output by the processor, the above information may also need to undergo other processing before reaching the transceiver. Similarly, when the processor receives the input above information, the transceiver obtains / receives the above information and inputs it into the processor. Furthermore, after the transceiver receives the above information, the above information may need to undergo other processing before being input into the processor.

[0075] Based on the above principles, for example, the receiving request message mentioned in the above method can be understood as the processor receiving input information.

[0076] For the operations such as transmission, sending and acquisition / reception involved in the processor, unless otherwise specified, or if they do not conflict with their actual functions or internal logic in the relevant descriptions, they can be more generally understood as processor output, reception, input and other operations, rather than the transmission, sending and receiving operations directly performed by the RF circuit and antenna.

[0077] During implementation, the processor may be a processor specifically configured to execute these methods, or may be a processor that executes computer instructions in a memory to execute these methods, such as a general-purpose processor. The memory may be a non-transitory memory, such as a read-only memory (ROM), which may be integrated with the processor on the same chip or disposed on separate chips. The embodiments of the present application do not limit the type of memory or the configuration of the memory and the processor.

[0078] In an eighth aspect, a computer-readable storage medium is provided, which stores a program code for execution by a device, wherein the program code includes a program for executing the methods provided in the above aspects.

[0079] In a ninth aspect, a computer program product comprising instructions is provided, which, when run on a computer, enables the computer to execute the methods provided in the above aspects.

[0080] In a tenth aspect, a chip is provided, which includes a processor and a communication interface. The processor reads instructions stored in a memory through the communication interface to execute the methods provided in the above aspects.

[0081] Optionally, as an implementation method, the chip may further include a memory storing instructions, and the processor is used to execute the instructions stored in the memory. When the instructions are executed, the processor is used to execute the methods provided in the above aspects. BRIEF DESCRIPTION OF THE DRAWINGS

[0082] FIG1 is a schematic diagram of a network architecture 100 .

[0083] Figure 2 (a) and (b) are schematic diagrams of how the authentication encryption algorithm is used.

[0084] FIG3 is a schematic flow chart of a NAS SMC process.

[0085] FIG4 is a schematic flow chart of an AS SMC process.

[0086] FIG5 is a schematic flow chart of a communication method provided in this application.

[0087] FIG6 is a schematic flow chart of another communication method provided in the present application.

[0088] FIG7 is a schematic flowchart of another communication method provided in the present application.

[0089] FIG8 is a schematic flowchart of another communication method provided in this application.

[0090] FIG9 is a schematic flowchart of another communication method provided in this application.

[0091] FIG10 is a schematic block diagram of a communication device 10 provided in an embodiment of the present application.

[0092] FIG11 is a schematic diagram of another communication device 20 provided in an embodiment of the present application.

[0093] FIG12 is a schematic diagram of a chip system 30 provided in an embodiment of the present application. DETAILED DESCRIPTION

[0094] The technical solution in this application will be described below with reference to the accompanying drawings.

[0095] The technical solutions provided in this application can be applied to various communication systems, such as new radio (NR) systems, long term evolution (LTE) systems, LTE frequency division duplex (FDD) systems, LTE time division duplex (TDD) systems, etc. The technical solutions provided in this application can also be applied to device-to-device (D2D) communication, vehicle-to-everything (V2X) communication, machine-to-machine (M2M) communication, machine type communication (MTC), and Internet of Things (IoT) communication systems or other communication systems.

[0096] In the communication system, the part operated by the operator can be called a public land mobile network (PLMN), or an operator network, etc. PLMN is a network established and operated by the government or an operator approved by it for the purpose of providing land mobile communication services to the public. It is mainly a public network in which mobile network operators (MNOs) provide mobile broadband access services to users. The PLMN described in the embodiment of the present application may specifically be a network that meets the requirements of the 3GPP standard, referred to as a 3GPP network. 3GPP networks generally include but are not limited to 5G networks, fourth-generation mobile communications (4th-generation, 4G) networks, and other future communication systems, such as (6th-generation, 6G) networks, etc. This technical solution is also applicable to SNPN (Stand-alone Non-Public Network).

[0097] For the convenience of description, the embodiments of the present application will be described using PLMN or 5G network as an example.

[0098] Figure 1 is a schematic diagram of a network architecture 100, using the 5G network architecture based on a service-oriented architecture for non-roaming scenarios as defined in the 3GPP standardization process as an example. As shown, the network architecture consists of three components: the terminal device component, the DN, and the operator network PLMN component. The following briefly describes the functions of the network elements in each component.

[0099] The terminal device part may include a terminal device 110, which may also be referred to as user equipment (UE). The terminal device 110 in this application is a device with wireless transceiver functions, which can communicate with one or more core network (CN) devices via an access network device (or also referred to as an access device) in a radio access network (RAN) 140. The terminal device 110 may also be referred to as an access terminal, terminal, user unit, user station, mobile station, mobile station, remote station, remote terminal, mobile device, user terminal, user agent or user device, etc. The terminal device 110 may be deployed on land, including indoors or outdoors, handheld or vehicle-mounted; it may also be deployed on water (such as ships, etc.); it may also be deployed in the air (such as airplanes, balloons and satellites, etc.). The terminal device 110 may be a cellular phone, a cordless phone, a Session Initiation Protocol (SIP) phone, a smart phone, a mobile phone, a wireless local loop (WLL) station, a personal digital assistant (PDA), etc. Alternatively, the terminal device 110 may be a handheld device with wireless communication capabilities, a computing device, or other device connected to a wireless modem, an in-vehicle device, a wearable device, an unmanned aerial vehicle (UAV), or a terminal in the Internet of Things (IoT), the Internet of Vehicles (IoV), any terminal in a 5G network or future networks, a relay user device, or a terminal in a future evolving 6G network, etc. The relay user device may be, for example, a 5G residential gateway (RG). For example, the terminal device 110 can be a virtual reality (VR) terminal, an augmented reality (AR) terminal, a wireless terminal in industrial control, a wireless terminal in self-driving, a wireless terminal in remote medical, a wireless terminal in smart grid, a wireless terminal in transportation safety, a wireless terminal in smart city, a wireless terminal in smart home, etc. The terminal device here refers to a 3GPP terminal. The embodiments of the present application do not limit the type or category of the terminal device. For ease of explanation, this application will be described later using UE as an example to refer to the terminal device.

[0100] The operator network PLMN part may include but is not limited to the (radio) access network (R)AN) 120 and the core network (CN) part.

[0101] (R)AN 120 can be considered a subnetwork of the operator network, serving as the implementation system between service nodes in the operator network and terminal device 110. To access the operator network, terminal device 110 first passes through (R)AN 120, which then connects to service nodes in the operator network. The access network device (RAN device) in the embodiment of the present application is a device that provides wireless communication functions for the terminal device 110, and can also be called a network device. The RAN device includes but is not limited to: the next generation node base station (gNB) in the 5G system, the evolved node B (eNB) in the long term evolution (LTE), the radio network controller (RNC), the node B (NB), the base station controller (BSC), the base transceiver station (BTS), the home base station (for example, home evolved node B, or home node B, HNB), the base band unit (BBU), the transmission point (TRP), the transmitting point (TP), the small base station device (pico), the mobile switching center, or the network device in the future network. In systems using different wireless access technologies, the name of the device with the access network device function may be different. For the convenience of description, in all embodiments of the present application, the above-mentioned device that provides wireless communication functions for the terminal device 110 is collectively referred to as the access network device or simply referred to as RAN or AN. It should be understood that this document does not limit the specific type of access network equipment.

[0102] The CN part may include but is not limited to the following NFs: user plane function (UPF) 130, network exposure function (NEF) 131, network function repository function (NRF) 132, policy control function (PCF) 133, unified data management function (UDM) 134, unified data repository function (UDR) 135, network data analytics function (NWDAF) 136, authentication server function (AUSF) 137, access and mobility management function (AMF) 138, and session management function (SMF) 139.

[0103] Data network DN 140, also known as a packet data network (PDN), is typically located outside of a carrier network, such as a third-party network. Of course, in some implementations, the DN may also be deployed by the carrier, meaning that the DN is part of a PLMN. This application does not restrict whether the DN is a PLMN. A carrier network PLMN can access multiple data network DNs 140, and various services can be deployed on the data network DN 140, providing data and / or voice services to the terminal device 110. For example, data network DN 140 may be the private network of a smart factory, where sensors installed in the workshop may be terminal devices 110. A control server for the sensors is deployed within data network DN 140, and the control server can provide services to the sensors. The sensors can communicate with the control server, obtain instructions from the control server, and transmit collected sensor data to the control server according to the instructions. For another example, data network DN 140 may be a company's internal office network, where the company's employees' mobile phones or computers may be terminal devices 110, allowing the employees' mobile phones or computers to access information and data resources on the company's internal office network. Terminal device 110 can establish a connection with the operator network through an interface provided by the operator network (e.g., N1) and use data and / or voice services provided by the operator network. Terminal device 110 can also access data network DN 140 through the operator network and use operator services deployed on data network DN 140 and / or services provided by third parties.

[0104] The following is a brief description of the NF functions included in CN.

[0105] 1. UPF 130 is a gateway provided by the operator, serving as the gateway for communication between the operator network and the data network DN 140. UPF 130 includes user-plane-related functions such as packet routing and transmission, packet inspection, service usage reporting, Quality of Service (QoS) processing, lawful interception, uplink packet inspection, and downlink packet storage.

[0106] 2. NEF 131 is a control plane function provided by the operator. It mainly enables third parties to use the services provided by the network, supports the network to open its capabilities, event and data analysis, provides PLMN security configuration information from external applications, and converts interactive information inside and outside the PLMN. It provides an API interface open to the operator network and provides interaction between external servers and internal operator networks.

[0107] 3. NRF 132 is a control plane function provided by the operator. It is used to maintain real-time information about network functions and services in the network. For example, it supports network service discovery, maintains the services supported by the NF profile of the NF instance, supports service discovery of the service communication proxy (SCP), maintains the SCP profile of the SCP instance, sends notifications about newly registered, deregistered, and updated NFs and SCPs, and maintains the health status of NF and SCP operations.

[0108] 4. PCF 133 is the control plane function provided by the operator. It supports a unified policy framework to govern network behavior, provide policy rules to other control functions, and provide contract information related to policy decisions.

[0109] 5. UDM 134 is a control plane function provided by the operator, responsible for storing information such as the subscriber permanent identifier (SUPI) of the subscriber in the operator network, the generic public subscription identifier (GPSI) of the subscriber, and credentials. The SUPI will be protected for confidentiality during transmission. The confidentiality-protected SUPI is called a hidden subscriber subscription identifier (SUCI). The information stored in UDM 134 can be used for authentication and authorization of the terminal device 110 to access the operator network. The subscribers of the above-mentioned operator network can specifically be users who use the services provided by the operator network, such as users who use China Telecom's mobile phone SIM card (Subscriber Identity Module, SIM card) or users who use China Mobile's mobile phone SIM card. The credentials of the above-mentioned subscribers can be a small file storing long-term keys stored in the mobile phone SIM card or information related to the encryption of the mobile phone SIM card, which is used for authentication and / or authorization. It should be noted that permanent identifiers, credentials, security contexts, authentication data (cookies), and tokens are equivalent to verification / authentication and authorization-related information. In the embodiments of this application, no distinction or restriction is made for the sake of convenience of description.

[0110] 6. UDR 135 is a control plane function provided by the operator. It provides the UDM with the functions of storing and retrieving subscription data, the PCF with the functions of storing and retrieving policy data, and the user's NF group ID information.

[0111] 7. NWDAF 136 is a control plane function provided by the operator. Its primary function is to collect data from the NF, external application function (AF), and operations, administration, and maintenance (OAM) systems, and to provide NWDAF service registration, data exposure, and data analysis to the NF and AF. In this application, NWDAF is primarily responsible for security-related data analysis. Therefore, NWDAF can also be understood as a network element with security analysis capabilities. The term "NWDAF" is merely an example, and other network element names may be used in the future. This application does not limit this.

[0112] 8. AUSF 137 is a control plane function provided by the operator and is typically used for level 1 authentication, that is, authentication between the terminal device 110 (subscriber) and the operator's network. After receiving an authentication request initiated by the subscriber, AUSF 137 can authenticate and / or authorize the subscriber using the authentication information and / or authorization information stored in UDM 134, or generate authentication and / or authorization information for the subscriber through UDM 134. AUSF 137 can also provide the subscriber with feedback on the authentication and / or authorization information.

[0113] 9. AMF 138 is a control plane network function provided by the operator network, responsible for access control and mobility management of the terminal device 110 accessing the operator network, such as mobility status management, allocation of user temporary identity, authentication and authorization of users, etc.

[0114] The AMF 138 is used to establish a non-access stratum (NAS) connection with the UE and has the same 5G NAS security context as the UE. The 5G NAS security context includes the KAMF, key identification information with the same NAS layer key, UE security capabilities, and uplink NAS COUNT values ​​and downlink NAS COUNT values. The NAS layer keys include the NAS confidentiality protection key and the NAS integrity security protection key, which are used for confidentiality and integrity protection of NAS messages, respectively.

[0115] 10. SMF 139 is a control plane network function provided by the operator network and is responsible for managing the PDU session of the terminal device 110. A PDU session is a channel for transmitting PDUs. The terminal device needs to transmit PDUs to and from the data network DN 140 through a PDU session. The SMF 139 is responsible for establishing, maintaining, and deleting PDU sessions. SMF 139 includes session management (such as session establishment, modification, and release, including tunnel maintenance between the user plane function UPF 130 and (R)AN 120), selection and control of the UPF 130, service and session continuity (SSC) mode selection, roaming, and other session-related functions.

[0116] 11. AF 141 is a control plane network function provided by the operator network. It is used to provide application layer information and can interact with the policy framework through network open function elements or directly interact with the policy framework to make policy decision requests. It can be located inside or outside the operator network.

[0117] It is understood that the above network elements or functions can be physical entities in hardware devices, software instances running on dedicated hardware, or virtualized functions instantiated on a shared platform (e.g., a cloud platform). Simply put, an NF can be implemented by hardware or software.

[0118] In Figure 1, Nnef, Nnrf, Npcf, Nudm, Nudr, Nnwdaf, Nausf, Namf, Nsmf, N1, N2, N3, N4, and N6 are interface serial numbers. For example, the meaning of the above interface serial numbers can be found in the meaning defined in the 3GPP standard protocol, and this application does not limit the meaning of the above interface serial numbers. It should be noted that the interface name between the various network functions in the figure is only an example. In a specific implementation, the interface name of the system architecture may also be other names, which is not limited by this application. In addition, the name of the message (or signaling) transmitted between the above network elements is only an example and does not constitute any limitation on the function of the message itself.

[0119] For ease of explanation, in the embodiments of this application, network functions (such as NEF 131…SMF 139) are collectively referred to as NFs. That is, the NFs described later in the embodiments of this application can be replaced with any network function. Furthermore, FIG1 schematically illustrates only some network functions, and the NFs described later are not limited to those shown in FIG1.

[0120] It should be understood that the above-mentioned network architecture applied to the embodiment of the present application is only a network architecture described from the perspective of service-oriented architecture. The network architecture applicable to the embodiment of the present application is not limited to this. Any network architecture that can realize the functions of the above-mentioned network elements is applicable to the embodiment of the present application.

[0121] It should also be understood that the AMF, SMF, UPF, NEF, AUSF, NRF, PCF, and UDM shown in the figure can be understood as network elements used to implement different functions in the core network, for example, they can be combined into network slices as needed. These core network network elements can be independent devices or integrated into the same device to implement different functions. This application does not limit the specific form of the above network elements.

[0122] It should also be understood that the above naming is defined only to facilitate the distinction between different functions and should not constitute any limitation to this application. This application does not exclude the possibility of adopting other naming in 5G networks and other future networks. For example, in a 6G network, some or all of the above network elements may continue to use the terminology used in 5G, or may adopt other names.

[0123] To facilitate understanding of the embodiments of the present application, some basic concepts involved in the present application are briefly explained.

[0124] 1. NAS security context:

[0125] For example, the NAS security context can be divided into a full NAS security context and a partial NAS security context from the perspective of whether it is complete.

[0126] The partial NAS security context includes: Kamf and its associated key identifier (ngKSI), UE security capabilities, uplink NAS counter values, and downlink NAS counter values. Compared to the partial NAS security context, the full NAS security context also includes integrity security protection keys and confidentiality security protection (or encryption security protection) keys, as well as the selected integrity security protection algorithm and confidentiality security protection algorithm.

[0127] For example, from the perspective of source, NAS security context can be divided into native NAS security context and mapped NAS security context.

[0128] Among them, the Kamf in the native NAS security context is generated by executing the main authentication process and is identified by the native ngKSI; the Kamf in the mapped NAS security context is generated by other keys during the network interaction process from different generations (such as generated by the 4G key during the interaction from 4G to 5G), and is identified by the mapped ngKSI.

[0129] For example, NAS security contexts can be divided into current and non-current from a status perspective. A current NAS security context refers to a security context that was recently activated, while a non-current NAS security context refers to a security context that is not in use.

[0130] As can be seen from the above, the specific types of NAS security contexts may include mapped, fully native, or partially native security contexts. The status may be active or inactive. For example, after the UE and the core network complete the primary authentication, a partially native context is generated, and the status is inactive. The AMF initiates a NAS security mode control (SMC) process to the UE. After the NAS SMC is successful, a fully native NAS context is generated, and the status is active.

[0131] 2. Activate security protection based on the confidentiality security protection algorithm: This refers to configuring the confidentiality security protection key and confidentiality security protection algorithm.

[0132] Furthermore, after activating security protection based on the confidentiality security protection algorithm, the sending end can use the confidentiality security protection key and the confidentiality security protection algorithm to perform confidentiality protection (e.g., encrypt) on the sent message; the receiving end can use the confidentiality security protection key and the confidentiality security protection algorithm to decrypt the received message (e.g., decrypt).

[0133] 3. Activate security protection based on the integrity security protection algorithm: This refers to configuring the integrity security protection key and integrity security protection algorithm.

[0134] Furthermore, after activating security protection based on the integrity security protection algorithm, the sender can use the integrity security protection key and the integrity security protection algorithm to perform integrity security protection on the sent message, that is, calculate the MAC used for integrity security protection; the receiver can use the integrity security protection key and the integrity security protection algorithm to perform integrity security verification on the received message, that is, determine whether the received MAC is correct.

[0135] 4. A security algorithm that can achieve both confidentiality security protection and integrity security protection: The security algorithm involved in this application that can achieve both confidentiality security protection and integrity security protection can be called an authenticated encryption algorithm. An authenticated encryption algorithm is an authenticated encryption with associated data (AEAD) algorithm. The AEAD algorithm (also known as the AEAD mode) can achieve both confidentiality security protection and integrity security protection of data. In other words, the AEAD algorithm can achieve both confidentiality security protection and integrity security protection of data at the same time. It can also be understood that the AEAD algorithm can achieve both confidentiality security protection and integrity security protection of data with a single key (AEAD key) as the input key.

[0136] For ease of understanding, the usage of the authentication encryption algorithm is briefly introduced in conjunction with (a) and (b) in Figure 2.

[0137] As can be seen from (a) and (b) in Figure 2, the authenticated encryption algorithm includes a part for confidentiality protection and a part for integrity protection.

[0138] As shown in Figure 2 (a), the sender can perform confidentiality protection (e.g., encryption) on the parameters to be protected based on the security key and the confidentiality-protected portion to obtain a ciphertext. Furthermore, the sender can perform an integrity protection operation on the parameters to be protected based on the security key, the integrity-protected portion, and the ciphertext to obtain a MAC. The parameters to be protected are transmitted to the receiver in plaintext.

[0139] For example, the sender uses the parameters to be protected for confidentiality and the security key as inputs for the confidentiality protection portion, performs confidentiality protection, and outputs ciphertext. The sender also uses the ciphertext, the security key, and the parameters to be protected for integrity as inputs for the integrity protection portion, and performs an integrity protection operation to obtain a MAC. It is understood that after the parameters to be protected for confidentiality are protected for confidentiality, the ciphertext obtained is also integrity protected. That is, the parameters to be protected for confidentiality are both protected for confidentiality and integrity.

[0140] As shown in Figure 2 (b), the receiving end can perform an integrity protection operation based on the security key, the parameter to be integrity verified, the received ciphertext, and the integrity-protected portion to obtain a MAC. It should be understood that, in the absence of a security attack, the parameter to be integrity verified is also the parameter to be integrity-protected. Furthermore, the receiving end can de-confidentialize (e.g., decrypt) the ciphertext based on the security key, the ciphertext, and the confidentiality-protected portion to obtain a de-confidentialized parameter (e.g., the plaintext obtained by decrypting the ciphertext). It should be understood that, in the absence of a security attack, the de-confidentialized parameter is also the parameter to be confidentiality-protected.

[0141] For example, the receiving end uses the received parameters to be integrity verified, the security key, and the ciphertext as input for the integrity protection part, performs an integrity protection operation to obtain a MAC, and compares the obtained MAC with the received MAC to ensure consistency, thereby implementing integrity security protection (e.g., integrity verification). The receiving end can also use the ciphertext and security key as input for the confidentiality protection part, perform confidentiality deprotection (e.g., decryption), and output the deconfidentiality protected parameters.

[0142] From the above, we can see that for the sender, confidentiality protection is encryption; for the receiver, integrity protection is integrity verification, and confidentiality protection is decryption.

[0143] Exemplarily, if the authenticated encryption algorithm shown in (a) and (b) in FIG2 is an AEAD algorithm.

[0144] For the sender, the input to the AEAD algorithm includes plaintext (e.g., the parameters to be protected for confidentiality shown in (a) of Figure 2), additional authenticated data (AAD) (e.g., the parameters to be protected for integrity shown in (a) of Figure 2), and an AEAD key (e.g., the security key shown in (a) of Figure 2). The plaintext portion is encrypted with the AEAD key to produce ciphertext (e.g., the ciphertext shown in (a) of Figure 2), which serves as the input for the integrity protection portion. The AAD portion is protected for integrity but not for confidentiality. The output of the AEAD algorithm includes the ciphertext portion and the MAC portion. The AEAD key can be used for both confidentiality and integrity protection and can therefore be referred to as a single key.

[0145] For the receiving end, the input of the AEAD algorithm includes ciphertext, AAD, and AEAD key. Among them, the ciphertext, AAD, and AEAD key will be used as the input of the integrity protection part, and the ciphertext and AEAD key will be used as the input of the confidentiality protection part.

[0146] Exemplarily, AAD can be carried in a message as plain text and transmitted between the sender and the receiver, or it can be a known parameter shared by the sender and the receiver.

[0147] In this application, the following relationships exist between the authentication encryption algorithm, the integrity security protection algorithm, and the confidentiality security protection algorithm:

[0148] 1) The authentication encryption algorithm can be used to determine the corresponding integrity security protection algorithm.

[0149] As an optional method, the authenticated encryption algorithm is used to determine the corresponding integrity security protection algorithm, including:

[0150] An authenticated encryption algorithm with the confidentiality-protected portion of the algorithm cleared can be considered an integrity-protected algorithm. This can be understood as a null scheme. When the confidentiality-protected portion is cleared, the input parameters to the confidentiality-protected portion and the ciphertext output of the confidentiality-protected portion are identical, meaning the confidentiality-protected portion is not protected.

[0151] Optionally, the integrity security protection algorithm determined in this way can also be called the integrity security protection algorithm of the authenticated encryption algorithm.

[0152] Alternatively, an authenticated encryption algorithm is used to determine the corresponding integrity security algorithm, including:

[0153] According to the preset rules, the integrity security protection algorithm corresponding to the authentication encryption algorithm is determined. The preset rules can be the correspondence between the authentication encryption algorithm and the integrity security protection algorithm. For example, the correspondence between the integrity security protection algorithm and the authentication encryption algorithm can be: the SNOW-AEAD algorithm corresponds to the SNOW integrity security protection algorithm, the ZUC-AEAD algorithm corresponds to the ZUC integrity security protection algorithm, the AES-AEAD algorithm corresponds to the AES integrity security protection algorithm, and so on. Then the SNOW-AEAD algorithm and the correspondence can determine the SNOW integrity security protection algorithm, the ZUC-AEAD algorithm and the correspondence can determine the ZUC integrity security protection algorithm, and the others are similar and will not be repeated. In addition, the correspondence between the integrity security protection algorithm and the authentication encryption algorithm can also be called the mapping relationship between the integrity security protection algorithm and the authentication encryption algorithm, which is not limited in this application.

[0154] For example, the method of omitting the confidentiality protection portion of the authenticated encryption algorithm to obtain the integrity security protection algorithm is called mapping, which is not limited in this application. Therefore, the authenticated encryption algorithm can be used to determine the corresponding integrity security protection algorithm, which can also be understood as the authenticated encryption algorithm can be used to map the corresponding integrity security protection algorithm.

[0155] 2) The authentication encryption algorithm can be used to determine the corresponding confidentiality security protection algorithm.

[0156] As an optional method, the authenticated encryption algorithm is used to determine the corresponding confidentiality security protection algorithm, including:

[0157] An authenticated encryption algorithm with the integrity protection portion cleared can be considered a confidentiality-protected security algorithm. This "null scheme" can be understood as a "null scheme." When the integrity protection portion is cleared, the output MAC is a constant (e.g., all zeros), indicating that the integrity protection portion is not protected.

[0158] Optionally, the confidentiality security protection algorithm determined in this way can also be called a confidentiality security protection algorithm of an authenticated encryption algorithm.

[0159] Alternatively, an authenticated encryption algorithm is used to determine the corresponding confidentiality security protection algorithm, including:

[0160] According to the preset rules, the confidentiality security protection algorithm corresponding to the authentication encryption algorithm is determined. The preset rules can be the correspondence between the authentication encryption algorithm and the confidentiality security protection algorithm. For example, the correspondence between the confidentiality security protection algorithm and the authentication encryption algorithm can be: the SNOW-AEAD algorithm corresponds to the SNOW confidentiality security protection algorithm, the ZUC-AEAD algorithm corresponds to the ZUC confidentiality security protection algorithm, the AES-AEAD algorithm corresponds to the AES confidentiality security protection algorithm, and so on. Then the SNOW-AEAD algorithm and the correspondence can determine the SNOW confidentiality security protection algorithm, the ZUC-AEAD algorithm and the correspondence can determine the ZUC confidentiality security protection algorithm, and the others are similar and will not be repeated. In addition, the correspondence between the confidentiality security protection algorithm and the authentication encryption algorithm can also be called the mapping relationship between the confidentiality security protection algorithm and the authentication encryption algorithm, which is not limited in this application.

[0161] For example, the method of omitting the integrity protection portion of the authentication encryption algorithm to obtain the confidentiality security protection algorithm is called mapping, which is not limited in this application. Therefore, the authentication encryption algorithm can be used to determine the corresponding confidentiality security protection algorithm, which can also be understood as the authentication encryption algorithm can be used to map the corresponding confidentiality security protection algorithm.

[0162] 3) The integrity security protection algorithm can be used to determine the corresponding authentication encryption algorithm.

[0163] Exemplarily, the integrity security protection algorithm is used to determine the corresponding authentication encryption algorithm, including:

[0164] According to preset rules, the authentication encryption algorithm corresponding to the integrity security protection algorithm is determined. The preset rules can be the correspondence between the authentication encryption algorithm and the integrity security protection algorithm. For example, see the description in 1) above. The SNOW integrity security protection algorithm can determine the SNOW-AEAD algorithm, the ZUC integrity security protection algorithm can determine the ZUC-AEAD algorithm, and other similar algorithms are not further described.

[0165] For example, the correspondence between an authentication encryption algorithm and an integrity security protection algorithm can also be referred to as a mapping relationship between the authentication encryption algorithm and the integrity security protection algorithm. Therefore, the fact that an integrity security protection algorithm can be used to determine a corresponding authentication encryption algorithm can also be understood as the fact that an integrity security protection algorithm can be used to map a corresponding authentication encryption algorithm.

[0166] 4) The confidentiality security protection algorithm can be used to determine the corresponding authentication encryption algorithm.

[0167] Exemplarily, the confidentiality security protection algorithm is used to determine the corresponding authentication encryption algorithm, including:

[0168] According to preset rules, the authentication encryption algorithm corresponding to the confidentiality security protection algorithm is determined. The preset rules can be the correspondence between the authentication encryption algorithm and the confidentiality security protection algorithm. For example, see the description in 2) above. The SNOW confidentiality security protection algorithm can determine the SNOW-AEAD algorithm, the ZUC confidentiality security protection algorithm can determine the ZUC-AEAD algorithm, and other similar algorithms are not repeated here.

[0169] For example, the correspondence between an authentication encryption algorithm and a confidentiality protection algorithm can also be referred to as a mapping relationship between the authentication encryption algorithm and the confidentiality protection algorithm. Therefore, the confidentiality protection algorithm can be used to determine the corresponding authentication encryption algorithm, which can also be understood as the confidentiality protection algorithm can be used to map the corresponding authentication encryption algorithm.

[0170] 5. NAS SMC process:

[0171] For example, the functions of the NAS SMC process are as follows:

[0172] (1) After the primary authentication is completed, the AMF initiates a NAS security mode command (SMC) message to convert the partial native context into a full native context for subsequent use;

[0173] (2) Changing the NAS security algorithm in the current NAS security context. For example, in scenarios where an AMF change occurs (such as N2-handover or mobility registration), the NAS security algorithm in the current NAS security context needs to be changed.

[0174] (3) Change the uplink NAS count value in the most recent NAS security mode complete (SMP) message to refresh the KgNB;

[0175] (4) Send the selected EPS NAS security algorithm to the UE.

[0176] For easier understanding, the NAS SMC process is described in detail with reference to Figure 3.

[0177] FIG3 is a schematic flow chart of a NAS SMC process, which includes the following steps:

[0178] S310: AMF configures a priority list of algorithms allowed to be used.

[0179] Exemplarily, the AMF configures a NAS integrity security protection algorithm priority list (e.g., the NAS integrity security protection algorithms configured on the AMF include the AES integrity security protection algorithm, the SNOW integrity security protection algorithm, the ZUC integrity security protection algorithm, the empty integrity security protection algorithm, etc., wherein the priorities of the configured multiple integrity security protection algorithms are ranked from high to low as the AES integrity security protection algorithm, the SNOW integrity security protection algorithm, the ZUC integrity security protection algorithm, and the empty integrity security protection algorithm) and a NAS confidentiality security protection algorithm priority list (e.g., the NAS confidentiality security protection algorithms configured on the AMF include the ZUC confidentiality security protection algorithm, the AES confidentiality security protection algorithm, the SNOW confidentiality security protection algorithm, and the empty integrity security protection algorithm, wherein the priorities of the configured multiple confidentiality security protection algorithms are ranked from high to low as the ZUC confidentiality security protection algorithm, the AES confidentiality security protection algorithm, the SNOW confidentiality security protection algorithm, and the empty integrity security protection algorithm).

[0180] The AMF obtains the UE security capabilities and selects the NAS integrity security protection algorithm and NAS confidentiality security protection algorithm based on the UE security capabilities and algorithm priority list. For example, if the UE security capabilities include the supported NAS integrity security protection algorithms as AES and SNOW, the integrity security protection algorithm selected by the AMF is the AES integrity security protection algorithm; for another example, if the UE security capabilities include the supported NAS confidentiality security protection algorithms as AES and ZUC, the confidentiality security protection algorithm selected by the AMF is the ZUC confidentiality security protection algorithm.

[0181] S320, AMF activates NAS integrity security protection.

[0182] Before sending the NAS SMC message, the AMF activates NAS integrity security protection.

[0183] Illustratively, the AMF calculates the integrity security protection key Knasint. Furthermore, the AMF performs integrity security calculations on the NAS SMC message and obtains the NAS MAC. Illustratively, the NAS MAC calculation input key is Knasint, and the input parameters are the bearer identifier, direction parameter, counter value, and the information element in the NAS SMC message to be protected. The security protection algorithm used is the selected integrity security protection algorithm.

[0184] The bearer identifier is used to distinguish different bearers. For example, in a 3GPP connection, the bearer identifier may be "0x01", and in a non-3GPP connection, the bearer identifier may be "0x02". The direction parameter is used to distinguish whether it is an uplink message or a downlink message. For example, in an uplink message, the direction parameter takes a value of 0, and in a downlink message, the direction parameter takes a value of 1. The value of the counter is used as a freshness parameter to prevent replay attacks. The information elements in the NAS SMC message to be protected may include a selected EPS security protection algorithm, an international mobile station equipment identity and software version number (IMEISV) request indication, etc.

[0185] It should be noted that the NAS SMC message performs integrity security protection but does not perform confidentiality security protection, because the UE side needs to use the parameters in the message (such as ngKSI, etc.) to obtain the key and algorithm for integrity verification.

[0186] S330: AMF sends a NAS SMC message to the UE.

[0187] The NAS SMC message includes, but is not limited to, the selected confidentiality security algorithm, the selected integrity security algorithm, the ngKSI, the replayed UE security capabilities, and the KAMF change indication. The selected confidentiality algorithm and integrity security algorithm are part of the NAS security context and are used by the UE and AMF to negotiate the security algorithms for subsequent security protection. The ngKSI identifies the KAMF. The replayed security capabilities are used to verify whether the security capabilities have been tampered with, i.e., to prevent downgrade attacks. The KAMF change indication instructs the UE to calculate a new KAMF.

[0188] The NAS SMC message includes a "Security Header Type" information element, which is used to indicate the protection mode of the NAS message. When the NAS message is a NAS SMC message, the value of this information element is 0011, which is used to indicate the use of 5G NAS security context for integrity security protection;

[0189] It should be noted that the confidentiality security protection algorithm and integrity security protection algorithm carried in the NAS SMC message will subsequently be part of the security context.

[0190] S340: AMF activates confidentiality protection for uplink NAS messages.

[0191] After sending the NAS SMC message, the AMF activates the deconfidentiality protection (e.g. decryption) of the uplink NAS messages.

[0192] S350, the UE verifies the NAS SMC message.

[0193] Exemplarily, the UE obtains the corresponding Knasint based on ngKSI and performs an integrity check based on the integrity security algorithm carried in the message. If the integrity check succeeds, the UE activates integrity and confidentiality security protection for uplink NAS messages and decrypts downlink messages.

[0194] S360, the UE sends a NAS SMP message to the AMF.

[0195] If the verification in step S350 succeeds, the UE sends a NAS SMP message to the AMF. This message is integrity-protected and confidentiality-protected. For example, the integrity protection key is Knasint, the integrity protection algorithm is the integrity protection algorithm selected in step S330, the confidentiality protection key is Knasenc, and the confidentiality protection algorithm is the confidentiality protection algorithm selected in step S330. The NAS MAC is used for integrity protection. The AMF receives the NAS SMP message, decrypts it, and performs integrity verification on it.

[0196] When the NAS message is a NAS SMP message, the value of this information element is 0100, which is used to indicate the use of the 5G NAS security context for confidentiality and integrity security protection.

[0197] S370: AMF activates confidentiality protection for NAS downlink messages.

[0198] After receiving the NAS SMP message, the AMF activates confidentiality protection (e.g., encryption) for NAS downlink messages.

[0199] It should be noted that in the existing security mechanism, confidentiality security protection and integrity security protection are independent of each other, that is, the keys and algorithms are isolated.

[0200] 6. AS SMC process:

[0201] For example, the AS SMC process is mainly used to negotiate the radio resource control (RRC) and user plane (UP) algorithms and to activate RRC security. The RRC reconfiguration message is mainly used to activate UP security.

[0202] For ease of understanding, the AS SMC process is described in detail with reference to Figure 4.

[0203] FIG4 is a schematic flow chart of an AS SMC process, which includes the following steps:

[0204] S410: The access network device configures a priority list of algorithms allowed to be used.

[0205] Exemplarily, an AS integrity security protection algorithm priority list is configured on the access network device (e.g., the AS integrity security protection algorithms configured on the access network device include AES integrity security protection algorithm, SNOW integrity security protection algorithm, ZUC integrity security protection algorithm, empty integrity security protection algorithm, etc., wherein the priorities of the configured multiple integrity security protection algorithms are ranked from high to low as AES integrity security protection algorithm, SNOW integrity security protection algorithm, ZUC integrity security protection algorithm, empty integrity security protection algorithm) and an AS confidentiality security protection algorithm priority list (e.g., the AS confidentiality security protection algorithms configured on the access network device include ZUC confidentiality security protection algorithm, AES confidentiality security protection algorithm, SNOW confidentiality security protection algorithm, empty integrity security protection algorithm, wherein the priorities of the configured multiple confidentiality security protection algorithms are ranked from high to low as ZUC confidentiality security protection algorithm, AES confidentiality security protection algorithm, SNOW confidentiality security protection algorithm, empty integrity security protection algorithm).

[0206] The access network device receives the UE security capabilities and selects the AS integrity security protection algorithm and the AS confidentiality security protection algorithm based on the UE security capabilities and the algorithm priority list. For example, if the UE security capabilities include the supported AS integrity security protection algorithms of AES and SNOW, the access network device selects the AES integrity security protection algorithm. For another example, if the UE security capabilities include the supported AS confidentiality security protection algorithms of AES and ZUC, the access network device selects the ZUC confidentiality security protection algorithm.

[0207] S420: Activate RRC integrity security protection.

[0208] Before sending the AS SMC message, the access network device activates RRC integrity security protection.

[0209] Exemplarily, the access network device performs integrity security calculation on the AS SMC message and obtains a MAC-I. Exemplarily, the AS MAC calculation input key is Krrcint, the input parameters are the bearer identifier, the direction parameter, the counter value, etc., and the security protection algorithm used is the selected integrity security protection algorithm.

[0210] Among them, the bearer identifier is used to distinguish different bearers. For example, in a 3GPP connection, the bearer identifier can be "0x01", and in a non-3GPP connection, the bearer identifier can be "0x02"; the direction parameter is used to distinguish whether it is an uplink message or a downlink message. For example, in an uplink message, the direction parameter value is 0, and in a downlink message, the direction parameter value is 1; the value of the counter is used as a freshness parameter to prevent replay attacks.

[0211] It should be noted that only integrity protection is performed in the AS SMC message, not confidentiality protection, because the UE side needs to use the parameters in the message (such as ngKSI, etc.) to obtain the key and algorithm for integrity verification.

[0212] S430: The access network device sends an AS SMC message to the UE.

[0213] The AS SMC message includes, but is not limited to, the selected confidentiality and integrity security algorithms. These algorithms are part of the AS security context and are used by the UE and access network device to negotiate the security algorithms for subsequent security protection.

[0214] It should be noted that the security protection algorithms for RRC messages and UP messages can be unified, that is, the selected confidentiality security protection algorithm and the selected integrity security protection algorithm are applicable to both the security protection of RRC messages and the security protection of UP messages; the security protection algorithms for RRC messages and UP messages can be independent, that is, the message includes the selected RRC confidentiality security protection algorithm, the selected RRC integrity security protection algorithm, the selected UP confidentiality security protection algorithm, and the selected UP integrity security protection algorithm.

[0215] S440: The access network device activates confidentiality protection of uplink RRC messages.

[0216] After sending the AS SMC message, the access network device activates the deconfidentiality protection (eg, decryption) of the uplink RRC message.

[0217] S450, the UE verifies the AS SMC message.

[0218] Exemplarily, the UE obtains the corresponding Krrcint and performs an integrity check based on the integrity security protection algorithm carried in the message. If the integrity check succeeds, the UE activates integrity security protection and confidentiality security protection for uplink RRC messages and decryption operations for downlink messages.

[0219] S460, the UE sends an AS SMP message to the access network device.

[0220] If the verification in step S450 is successful, the UE sends an AS SMP message to the access network device. The message is integrity security protected and confidentiality security protected. Exemplarily, the integrity security protection key is Krrcint, the integrity security protection algorithm is the selected integrity security protection algorithm carried by the AS SMC message in step S430, the confidentiality security protection key is Krrcenc, and the confidentiality security protection algorithm is the selected confidentiality security protection algorithm carried in the AS SMC message in step S430.

[0221] S470: The UE activates RRC uplink message confidentiality.

[0222] After sending the AS SMP message, the UE activates RRC uplink message confidentiality protection.

[0223] S480: The access network device activates RRC downlink message confidentiality protection.

[0224] After receiving the AS SMP message, the access network device activates RRC downlink message confidentiality (eg, encryption).

[0225] It should be noted that in the existing security mechanism, confidentiality security protection and integrity security protection are independent of each other, that is, the keys and algorithms are isolated.

[0226] In addition, in order to facilitate understanding of the embodiments of the present application, the following explanations are made.

[0227] First, in this application, "used to indicate" can include being used for direct indication and being used for indirect indication. When describing that a certain indication information is used to indicate A, it can include that the indication information directly indicates A or indirectly indicates A, but it does not mean that the indication information must include A.

[0228] The information indicated by the indication information is referred to as the information to be indicated. During the specific implementation process, there are many ways to indicate the information to be indicated. The information to be indicated can be sent as a whole or divided into multiple sub-information and sent separately. The transmission period and / or transmission timing of these sub-information can be the same or different. The specific transmission method is not limited in this application. The transmission period and / or transmission timing of these sub-information can be predefined, for example, according to a protocol, or can be configured by the transmitting device through sending configuration information to the receiving device.

[0229] Second, "at least one" shown in the present application refers to one or more, and "a plurality of" refers to two or more. In addition, in the embodiments of the present application, "first", "second" and various digital numbers (for example, "#1", "#2", etc.) are only for the convenience of description, and are not intended to limit the scope of the embodiments of the present application. The size of the sequence number of each process below does not mean the order of execution. The execution order of each process should be determined by its function and inherent logic, and should not constitute any limitation to the implementation process of the embodiments of the present application. It should be understood that the objects described in this way can be interchanged where appropriate, so that solutions other than the embodiments of the present application can be described. In addition, in the embodiments of the present application, words such as "510", "520" are only for the convenience of description, and are not intended to limit the order of execution of steps.

[0230] Third, in this application, words such as "exemplary" or "for example" are used to indicate examples, illustrations, or descriptions. Any embodiment or design described in this application as "exemplary" or "for example" should not be construed as being preferred or advantageous over other embodiments or designs. Rather, the use of words such as "exemplary" or "for example" is intended to present the relevant concepts in a concrete manner.

[0231] Fourth, the term "storage" used in the embodiments of this application may refer to storage in one or more memories. The one or more memories may be provided separately or integrated into an encoder or decoder, a processor, or a communication device. The one or more memories may also be provided in part separately and in part integrated into a decoder, a processor, or a communication device. The memory may be any type of storage medium, and this application is not limited thereto.

[0232] Fifth, the "protocol" involved in the embodiments of the present application may refer to a standard protocol in the communication field, for example, it may include an LTE protocol, an NR protocol, and related protocols used in future communication systems. This application does not limit this.

[0233] Sixth, in the embodiments of the present application, "under the circumstances", "when", and "if" can sometimes be used interchangeably. It should be pointed out that when the distinction between them is not emphasized, the meanings they intend to express are consistent.

[0234] Seventh, in the embodiments of this application, various terms and English abbreviations, such as radio resource control (RRC), are provided for ease of description and should not constitute any limitation on this application. This application does not exclude the possibility of defining other terms in existing or future protocols that can achieve the same or similar functions.

[0235] Eighth, the term "and / or" in this document simply describes a relationship between related objects, indicating that three possible relationships exist. For example, "A and / or B" can mean: A exists alone, A and B exist simultaneously, or B exists alone. Furthermore, the character " / " in this document generally indicates that the related objects are in an "or" relationship.

[0236] The above, in combination with Figure 1, briefly introduces the scenarios in which the communication method provided in the embodiment of the present application can be applied, as well as the basic concepts that may be involved in the embodiment of the present application, and introduces the NAS SMC process and the AS SMC process in the basic concepts in combination with Figures 3 and 4. In the processes shown in Figures 3 and 4, confidentiality security protection and integrity security protection are based on the confidentiality security protection algorithm and the integrity security protection algorithm, respectively. That is, if the message transmitted between the terminal device and the network device (such as AMF or access network device) is subjected to confidentiality security protection and integrity security protection, it is necessary to perform confidentiality security protection and integrity security protection based on the confidentiality security protection algorithm and the integrity security protection algorithm (such as the algorithm carried in step S330 in Figure 3 or step S430 in Figure 4 includes the selected confidentiality security protection algorithm and the selected integrity security protection algorithm).

[0237] When confidentiality and integrity security protection are required, the combination of confidentiality and integrity security algorithms presents security risks. For example, using confidentiality and integrity security algorithms to secure messages transmitted between terminal devices and network devices (such as AMF or access network devices) involves first performing integrity security protection on the message based on the integrity security algorithm, and then using the integrity security protection result as the input parameter of the confidentiality security algorithm to perform confidentiality security protection on the message. When the integrity security protection result is used as the input parameter of the confidentiality security protection, there may be algorithm splicing, which will bring security risks.

[0238] The present application provides a communication method that can be applied in the communication system shown in FIG1 , in order to achieve confidentiality security protection and integrity security protection.

[0239] It should be understood that the embodiments shown below do not particularly limit the specific structure of the execution subject of the method provided in the embodiments of the present application. As long as it is possible to communicate according to the method provided in the embodiments of the present application by running a program that records the code of the method provided in the embodiments of the present application. For example, the execution subject of the method provided in the embodiments of the present application can be a network device, or a functional module in the network device that can call and execute the program.

[0240] Figure 5 is a schematic flow chart of a communication method provided by the present application. In this communication method, the network device determines a security algorithm that can achieve both confidentiality security protection and integrity security protection, and after determining the security algorithm, activates the security algorithm to perform security protection on the uplink message. Since the security algorithm determined by the network device can achieve both confidentiality security protection and integrity security protection, the network device can perform integrity verification and decryption based on the same security key when performing security verification on the uplink message, thereby avoiding the security risks of the combination of the confidentiality security protection algorithm and the integrity security protection algorithm. Among them, the combination of the confidentiality security protection algorithm and the integrity security protection algorithm can be understood as: integrity protection or verification based on the integrity security protection algorithm and the key #1 corresponding to the integrity security protection algorithm, and confidentiality protection or decryption based on the confidentiality security protection algorithm and the key #2 corresponding to the confidentiality security protection algorithm, that is, confidentiality security protection and integrity security protection are respectively achieved based on different algorithms and different keys.

[0241] To facilitate understanding, a brief introduction to the security risks associated with the combination of confidentiality and integrity security algorithms includes: using confidentiality and integrity security algorithms to securely protect messages transmitted between terminal devices and network devices (such as AMF or access network devices). Specifically, the message is first protected for integrity based on the integrity algorithm, and then the integrity protection result is used as the input parameter for the confidentiality protection algorithm to protect the message for confidentiality. When the integrity protection result is used as the input parameter for confidentiality protection, the algorithm may be spliced, which brings security risks.

[0242] The security algorithm involved in the embodiment shown in FIG5 below can be the authenticated encryption algorithm introduced above, including a portion for confidentiality protection and a portion for integrity protection, and can achieve both confidentiality and integrity security. For example, the security algorithm is an AEAD algorithm. The security algorithm and the authenticated encryption algorithm can be described interchangeably in various embodiments of this application.

[0243] The security key involved in the embodiment shown in Figure 5 below is the input key of the security algorithm. Integrity security protection and confidentiality security protection, or integrity verification and decryption of received messages, are performed based on the security key and the security algorithm. The security key is a key shared between the terminal device and the network device. For example, the security key is a key generated during the primary authentication process, or a key derived from the key generated during the primary authentication process.

[0244] Specifically, the communication method includes the following steps:

[0245] S510: The network device determines a security algorithm.

[0246] The network device may be the AMF shown in FIG1 above, or an access network device. It should be understood that the name of the network device is not limited in this embodiment, and any device that can implement the functions of the network device in this embodiment can be considered as the network device involved in this embodiment.

[0247] As a possible implementation method, the network device is AMF, and the security algorithm determined by the network device in this embodiment is used to securely protect the NAS messages transmitted between the terminal device and the AMF. For example, the security algorithm is used to securely protect the security mode command message, security mode completion message transmitted in the NAS SMC process, and NAS messages transmitted after the NAS SMC process.

[0248] As another possible implementation, the network device is an access network device. In this embodiment, the security algorithm determined by the network device is used to provide security protection for AS messages transmitted between the terminal device and the access network device. For example, the security algorithm is used to provide security protection for RRC messages (such as security mode command messages and security mode complete messages) transmitted during the AS SMC process; for another example, the security algorithm is used to provide security protection for user plane (UP) messages transmitted after the AS SMC process.

[0249] It should be noted that, when the network device is an access network device, the security algorithm selected by the network device can provide security protection for both RRC messages and UP messages; alternatively, the security algorithm selected by the network device is the algorithm used for security protection of RRC messages, and the network device selects other integrity security protection algorithms, confidentiality security protection algorithms, or other authentication and encryption algorithms for security protection of UP messages. For example, the network device selects multiple algorithms (e.g., integrity security protection algorithms, confidentiality security protection algorithms, and security algorithms) and can determine the security protection algorithm to use based on the user plane message security protection requirements.

[0250] It should be understood that this embodiment does not limit whether the network device further determines an algorithm other than the security algorithm.

[0251] In this embodiment, at least one security algorithm is configured on the network device. The at least one security algorithm has a different priority, and each security algorithm is capable of implementing both confidentiality and integrity security protection. The algorithm list that includes the at least one security algorithm and that can characterize the priority relationships of the at least one security algorithm is referred to as a first algorithm priority list.

[0252] As an example but not a limitation, the first algorithm priority list configured on the network device includes AES AEAD algorithm, SNOW AEAD algorithm, ZUC AEAD algorithm and null algorithm, among which the priorities of the configured multiple authentication encryption algorithms are sorted from high to low as AES AEAD algorithm, SNOW AEAD algorithm, ZUC AEAD algorithm and null algorithm.

[0253] Exemplarily, the integrity security protection algorithm priority list and confidentiality security protection algorithm priority list configured on the network device in this embodiment can be compatible with the integrity security protection algorithm priority list and confidentiality security protection algorithm priority list configured on the network device in the existing mechanism.

[0254] For example, in this embodiment, in addition to the above-mentioned first algorithm priority list, the network device is also configured with an integrity security protection algorithm priority list and a confidentiality security protection algorithm priority list.

[0255] The integrity security protection algorithm priority list includes: AES integrity security protection algorithm, SNOW integrity security protection algorithm, ZUC integrity security protection algorithm, and Null integrity security protection algorithm. The priority order from high to low is: AES integrity security protection algorithm, SNOW integrity security protection algorithm, ZUC integrity security protection algorithm, and Null integrity security protection algorithm.

[0256] The priority list of confidentiality security protection algorithms includes: ZUC confidentiality security protection algorithm, AES confidentiality security protection algorithm, SNOW confidentiality security protection algorithm, null integrity security protection algorithm, etc. The priority is from high to low: ZUC confidentiality security protection algorithm, AES confidentiality security protection algorithm, SNOW confidentiality security protection algorithm, null integrity security protection algorithm.

[0257] Optionally, when the network device is configured with the above-mentioned first algorithm priority list, and is compatible with the existing mechanism and is configured with an integrity security protection algorithm priority list and a confidentiality security protection algorithm priority list, the network device can also be configured with an algorithm selection policy, which is used to indicate the principles for selecting algorithms.

[0258] As a possible implementation method, the network device selects a security algorithm as follows: the network device selects a security algorithm based on the UE security capability, an algorithm priority list (e.g., a first algorithm priority list, an integrity security protection algorithm priority list and / or a confidentiality security protection algorithm priority list), and / or an algorithm selection policy.

[0259] For example, an algorithm selection policy is configured on the network device, and the algorithm selection policy may be to give priority to algorithms in the first algorithm priority list. That is, when both the UE and the network device support the same security algorithm (e.g., AEAD algorithm), the security algorithm is selected according to the first algorithm priority list; otherwise, the integrity security protection algorithm and the confidentiality security protection algorithm are selected according to the integrity security protection algorithm priority list and the confidentiality security protection algorithm priority list.

[0260] For example, the algorithm selection strategy may also be to give priority to the integrity security protection algorithm and the confidentiality security protection algorithm, that is, when both the UE and the network device support the same integrity security protection algorithm, the integrity security protection algorithm is selected for security protection according to the integrity security protection algorithm priority list; and / or, when both the UE and the network device support the same confidentiality security protection algorithm, the confidentiality security protection algorithm is selected for security protection according to the confidentiality security protection algorithm priority list.

[0261] As another possible implementation manner, the network device may select a security algorithm by: the network device selects a security algorithm according to whether there is a first algorithm priority list locally.

[0262] For example, when a first algorithm priority list, an integrity security protection algorithm priority list, and a confidentiality security protection algorithm priority list are configured on the network device, the network device preferentially selects a security algorithm from the first algorithm priority list according to the UE security capability.

[0263] For example, when an integrity security protection algorithm priority list and a confidentiality security protection algorithm priority list are configured on a network device, and a first algorithm priority list is not configured, the network device selects a security algorithm based on the UE security capability, the integrity security protection algorithm priority list, and the confidentiality security protection algorithm priority list.

[0264] It should be understood that the two possible implementations described above are merely examples of how a network device determines a security algorithm. The network device may also randomly select a security algorithm. For another example, the network device may determine a security algorithm based on historical communication data. Examples are not provided here.

[0265] In addition, in this embodiment, the network device determining the security algorithm may further include: selecting an integrity security protection algorithm and / or a confidentiality security protection algorithm, and determining the security algorithm based on the selected integrity security protection algorithm and / or confidentiality security protection algorithm. Specifically, the method for determining the security algorithm based on the integrity security protection algorithm has been described previously and will not be repeated here; the method for determining the security algorithm based on the confidentiality security protection algorithm has also been described previously and will not be repeated here.

[0266] For example, in this embodiment, the network device determines that a trigger condition is satisfied before determining the security algorithm. This can be understood as follows: the network device selects the security algorithm when the trigger condition is satisfied. Trigger conditions include, but are not limited to: after primary authentication is complete, the network device determines to initiate a security mode command process; or a scenario in which the network device undergoes a change; or the network device determines to change the uplink count value.

[0267] As can be seen from the above, the security algorithm determined by the network device in this embodiment can be an authenticated encryption algorithm that can implement both confidentiality and integrity security protection; or it can be a confidentiality and integrity security algorithm; or it can be an authenticated encryption algorithm, a confidentiality and integrity security algorithm. This embodiment is described below using the security algorithm determined by the network device as an example.

[0268] S520: The network device activates security protection between the network device and the terminal device based on the security algorithm and the security key.

[0269] Specifically, the network device activates security protection between the network device and the terminal device based on the security algorithm and the security key, including: the network device configures the security algorithm and the security key corresponding to the security algorithm.

[0270] S521: The terminal device activates security protection between the network device and the terminal device based on the security algorithm and the security key.

[0271] Specifically, the terminal device activates security protection between the network device and the terminal device based on the security algorithm and the security key, including: the terminal device configures the security algorithm and the security key corresponding to the security algorithm.

[0272] In this embodiment, there is no limitation on the order of S520 and S521. The network device may first activate the security protection between the network device and the terminal device based on the security algorithm and security key, or the terminal device may first activate the security protection between the network device and the terminal device based on the security algorithm and security key.

[0273] After the terminal device activates security protection between the network device and the terminal device based on the security algorithm and the security key, the terminal device may perform security protection on the uplink message to be sent based on the security algorithm, obtain the securely protected uplink message, and send it to the network device; after the network device activates security protection between the network device and the terminal device based on the security algorithm and the security key, the network device may perform integrity verification and decryption on the received securely protected uplink message based on the security algorithm. The method flow shown in FIG5 further includes:

[0274] S530: The network device receives a security protection uplink message from the terminal device.

[0275] Illustratively, the security-protected uplink messages in this embodiment include, but are not limited to, NAS messages, RRC messages, or UP messages.

[0276] S540: The network device performs integrity verification and decryption on the security-protected uplink message.

[0277] Specifically, since the network device activates security protection between the network device and the terminal device based on the security algorithm and the security key, the network device uses the security key as the input key of the integrity protection part in the security algorithm to verify the integrity of the uplink message, and uses the security key as the input key of the confidentiality protection part in the security algorithm to decrypt the uplink message.

[0278] It should be understood that the use of the security key as the input key of the integrity protection part of the security algorithm described in this embodiment indicates that the security key is not a derived key, but an input key of the integrity protection part; similarly, the use of the security key as the input key of the confidentiality protection part of the security algorithm described in this embodiment indicates that the security key is not a derived key, but an input key of the confidentiality protection part.

[0279] Exemplarily, the network device uses the security key as the input key of the integrity protection part in the security algorithm to verify the integrity of the uplink message, including: the network device can perform integrity verification on the uplink message according to the plaintext parameters carried in the uplink message.

[0280] The network device uses the security key as the input key of the confidentiality protection part in the security algorithm to decrypt the uplink message, including: the network device uses the security key as the input key of the confidentiality protection part in the security algorithm to decrypt the ciphertext carried in the uplink message.

[0281] For ease of understanding, the AEAD algorithm is used as an example for explanation. The network device obtains the corresponding security key (i.e., the AEAD key) based on the security algorithm. In addition, the network device uses the plaintext parameters (AAD), ciphertext, and AEAD key carried in the uplink message as input for the integrity protection of the AEAD algorithm to obtain a MAC value. The network device then determines whether the MAC value is consistent with the MAC value carried in the uplink message to determine whether the MAC value carried in the uplink message is correct.

[0282] When the integrity check succeeds (that is, the MAC value carried in the uplink message is correct), the network device decrypts the ciphertext carried in the uplink message using the security key and the security algorithm.

[0283] Exemplarily, the security-protected uplink message in this embodiment is a security-protected uplink message transmitted after the network device sends a security mode command message to the terminal device. For example, the security-protected uplink message can be a security mode response message (e.g., a security mode completion message).

[0284] The SMC process between network devices and terminal devices can be performed in the following ways:

[0285] Method 1: The security mode command message sent by the network device to the terminal device is protected based on a determined security algorithm.

[0286] In the case shown in Method 1, the network device performs security protection on the security mode command message to be sent based on the security algorithm. The security mode command message to be sent includes a first parameter and a second parameter. The network device sends the securely protected security mode command message to the terminal device. The securely protected security mode command message includes a first ciphertext, a first message authentication code (MAC), and a first parameter. The first ciphertext is obtained by performing confidentiality protection (e.g., encryption) on the second parameter based on the security algorithm, and the first MAC is calculated by performing integrity protection on the first parameter and the first ciphertext based on the security algorithm. The specific contents of the first ciphertext, the first message authentication code (MAC), the first parameter, and the second parameter can be found in the embodiment shown in Figure 6.

[0287] Accordingly, after receiving the securely protected security mode command message, the terminal device performs integrity verification and decryption on the securely protected security mode command message based on the security algorithm. Specifically, the terminal device uses the security key as an input key for the integrity protection portion of the security algorithm to verify the integrity of the securely protected security mode command message, and uses the security key as an input key for the confidentiality protection portion of the security algorithm to decrypt the securely protected security mode command message.

[0288] For ease of understanding, the following will describe in detail the SMC process executed between the network device and the terminal device in the case shown in Method 1 in conjunction with Figure 6, which will not be described in detail here.

[0289] Method 2: The security mode command message sent by the network device to the terminal device is integrity protected based on the integrity protection part of the determined security algorithm, or the security mode command message sent by the network device to the terminal device is integrity protected based on the first integrity security protection algorithm further determined based on the determined security algorithm.

[0290] In the case of the second approach, the network device uses the security key as the input key for the integrity-protected portion to perform integrity protection on the security mode command message to be sent. Alternatively, the network device determines a first integrity security protection algorithm based on the security algorithm and performs integrity protection on the security mode command message to be sent based on the first integrity security protection algorithm. The network device sends the integrity-protected security mode command message to the terminal device, where the integrity-protected security mode command message includes an identifier of the security algorithm.

[0291] Accordingly, after receiving the integrity-protected security mode command message, the terminal device performs integrity verification and decryption on the integrity-protected security mode command message based on the integrity-protected portion of the security algorithm. Specifically, the security key is used as the input key of the integrity-protected portion of the security algorithm to perform integrity verification on the integrity-protected security mode command message. Alternatively,

[0292] After receiving the integrity-protected security mode command message, the terminal device determines a first integrity security protection algorithm and performs integrity verification and decryption on the integrity-protected security mode command message based on the first integrity security protection algorithm. Specifically, the terminal device uses the security key as an input key of the first integrity security protection algorithm to perform integrity verification on the integrity-protected security mode command message.

[0293] For ease of understanding, the following will describe in detail the SMC process executed between the network device and the terminal device in the case shown in Method 1 in conjunction with Figure 8, which will not be described in detail here.

[0294] Method 3: The security mode command message sent by the network device to the terminal device is integrity protected based on the second integrity security protection algorithm. In the case shown in Method 3, the network device can determine the second integrity security protection algorithm and the security algorithm.

[0295] In the case shown in the third embodiment, the network device determines a second integrity security protection algorithm and performs integrity protection on the security mode command message to be sent based on the second integrity security protection algorithm. The network device sends an integrity-protected security mode command message to the terminal device. The integrity-protected security mode command message includes an identifier of the security algorithm and an identifier of the second integrity security protection algorithm.

[0296] Correspondingly, after receiving the integrity-protected security mode command message, the terminal device performs integrity verification on the integrity-protected security mode command message based on the second integrity security protection algorithm.

[0297] For ease of understanding, the following will describe in detail the SMC process executed between the network device and the terminal device in the case of the third method shown in FIG7 , which will not be described in detail here.

[0298] Mode 4: The security mode command message sent by the network device to the terminal device is integrity protected based on the third integrity security protection algorithm. In the case shown in Mode 4, the security algorithm is determined based on the third integrity security protection algorithm.

[0299] In the case shown in the fourth mode, the network device determines a third integrity security protection algorithm and performs integrity protection on the security mode command message to be sent based on the third integrity security protection algorithm. The network device sends an integrity-protected security mode command message to the terminal device. The integrity-protected security mode command message includes an identifier of the third integrity security protection algorithm and second indication information. The second indication information is used to indicate that messages transmitted after the security mode command message are to be security-protected based on the security algorithm.

[0300] Correspondingly, after receiving the integrity-protected security mode command message, the terminal device performs integrity verification on the integrity-protected security mode command message based on the third integrity security protection algorithm, and further determines a security algorithm based on the third integrity security protection algorithm based on the second indication information, and the uplink message to be sent is security protected based on the security algorithm.

[0301] For ease of understanding, the following will describe in detail the SMC process executed between the network device and the terminal device in the case shown in Method 4 in conjunction with Figure 9, which will not be described in detail here.

[0302] Figure 6 is a schematic flow chart of another communication method provided by the present application. In this communication method, the network device determines a security algorithm that can achieve both confidentiality security protection and integrity security protection, and after determining the security algorithm, activates the security algorithm to perform security protection on the downlink message. The downlink message includes a security mode command message, so that certain parameters in the security mode command message can be transmitted through the security mode command message while maintaining confidentiality, thereby improving security. In addition, the network device and the terminal device can negotiate to use the security algorithm to perform security protection on the message to be transmitted (such as the security mode command message, and the message to be transmitted subsequent to the security mode command message), thereby avoiding the security risks of the combination of the confidentiality security protection algorithm and the integrity security protection algorithm. For example, in this scheme, when performing confidentiality security protection and integrity security protection on the message, there is no need to perform security protection based on the confidentiality security protection algorithm and the integrity security protection algorithm respectively. The confidentiality security protection and integrity security protection of the message are both performed based on the security algorithm, avoiding the splicing between different algorithms, thereby avoiding the security risks of the combination of the confidentiality security protection algorithm and the integrity security protection algorithm.

[0303] If the network device performs confidentiality and integrity security protection based on the security algorithm, the security mode command message sent by the network device carries the first ciphertext obtained by performing confidentiality protection based on the security algorithm, and the first MAC obtained by performing integrity security protection based on the authentication encryption algorithm.

[0304] The first ciphertext involved in the following embodiments is a ciphertext obtained based on the confidentiality of the security algorithm.

[0305] Specifically, the first ciphertext is the ciphertext obtained by maintaining the confidentiality of the algorithm-confidentiality portion of the security algorithm. The parameter in the security mode command message that maintains confidentiality based on the security algorithm is referred to as the second parameter. In other words, the first ciphertext is the ciphertext obtained by maintaining the confidentiality of the second parameter based on the security algorithm. The second parameter can also be referred to as the input parameter of the algorithm-confidentiality-protected portion of the security algorithm, or as a parameter to be maintained based on the confidentiality of the security algorithm.

[0306] It should be understood that the second parameter may be a parameter in the security mode command message that has high security requirements. The confidentiality of the second parameter may be protected (eg, encrypted) based on a security algorithm, thereby improving the security of the second parameter transmission.

[0307] Specifically, the second parameter includes one or more of the following: EPS security algorithm, international mobile station equipment identity, or software version IMEISV request indication and other information.

[0308] Optionally, if the security mode command message independently carries the security protection algorithm corresponding to the RRC message and the security protection algorithm corresponding to the user plane message, the security protection algorithm corresponding to the user plane message can also be used as a parameter for confidentiality protection based on the security algorithm in the security mode command message, that is, the second parameter can also include the identifier of the security protection algorithm corresponding to the user plane message. For example, the security protection algorithm corresponding to the user plane message selected by the network device includes a confidentiality security protection algorithm and an integrity security protection algorithm, then the second parameter can also include the identifier of the confidentiality security protection algorithm corresponding to the user plane message and the identifier of the integrity security protection algorithm. Among them, the security protection algorithm corresponding to the user plane message can also be called the security protection algorithm corresponding to the user plane; similarly, the security protection algorithm corresponding to the RRC message can also be called the security protection algorithm corresponding to the RRC.

[0309] It should be understood that for the AEAD algorithm shown in FIG2 , the second parameter is input as the plaintext part into the confidentiality protection part of the algorithm, so that the output ciphertext is the first ciphertext.

[0310] The first MAC involved in the following embodiments is obtained by performing integrity security protection based on a security algorithm.

[0311] Specifically, the first MAC is obtained by performing integrity security protection on the first parameter and the first ciphertext based on the security algorithm. The first parameter refers to a parameter in the security mode command message that is integrity-protected, or a parameter in the security mode command message that is not confidential. The first parameter is specifically a parameter to be integrity-protected based on the security algorithm, and can also be referred to as an input parameter of the algorithm integrity protection portion of the security algorithm, excluding the first ciphertext.

[0312] It should be understood that the first parameter is a parameter required by the terminal device for security verification. Therefore, the first parameter is carried in plain text in the secure mode command message and transmitted to the terminal device. Thus, the terminal device can perform security verification on the secure mode command message based on the first parameter. Performing integrity security protection on the first parameter without performing confidentiality security protection improves security while ensuring that the terminal device can obtain sufficient information for security verification.

[0313] The first parameter includes one or more of the following: an identifier of a security algorithm, security capability information of a replayed terminal device, first key change indication information, or a key identifier of the first key, etc. The first key is used to determine the security key, for example, the first key is the aforementioned security key or the first key is used to derive the aforementioned security key.

[0314] Exemplarily, the parameters specifically included in the first parameter may be agreed upon in advance by the terminal device and the network element. For example, the first parameter may be pre-configured in advance through a standard or protocol to include an identifier of the security algorithm and first key change indication information.

[0315] Security algorithm identifier: This identifies the algorithm used for security protection. After receiving the security algorithm identifier, the terminal device selects the corresponding security algorithm and performs security verification of the security mode command message, including integrity verification and decryption.

[0316] Replayed terminal device security capability information: used by the terminal device to discover whether the terminal device's security capability has been tampered with. Exemplarily, the terminal device compares whether the terminal device's security capability information sent by itself and the received replayed terminal device's security capability information are consistent. If they are consistent, the terminal device determines that the received message has not been tampered with; if they are inconsistent, the terminal device determines that the received message has been tampered with. The terminal device may subsequently choose to reselect a cell or re-initiate the registration process, and this application does not impose any restrictions on this.

[0317] Key identifier of the first key: used to identify the first key generated during the primary authentication process. Exemplarily, it is used to identify Kamf. The terminal device searches for the corresponding Kamf based on the received ngKSI. The key generated during the primary authentication process is maintained as part of the security context. For example, the first key is a NAS key in the NAS security context.

[0318] First key change indication information: used to indicate that a new key needs to be calculated. For example, the Kamf change indication is used to indicate that a new Kamf needs to be calculated.

[0319] Optionally, if the security mode command message independently carries the security protection algorithm corresponding to the RRC message and the security protection algorithm corresponding to the user plane message, the security protection algorithm corresponding to the user plane message can also be used as a parameter for integrity security protection in the security mode command message, that is, the first parameter can also include an identifier of the security protection algorithm corresponding to the user plane message. For example, if the security protection algorithm corresponding to the user plane message selected by the network device includes a confidentiality security protection algorithm and an integrity security protection algorithm, the first parameter also includes an identifier of the confidentiality security protection algorithm and an identifier of the integrity security protection algorithm corresponding to the user plane message.

[0320] It should be understood that for the AEAD algorithm shown in Figure 2, the first parameter is input into the integrity security protection part of the algorithm as the AAD part, and the first ciphertext is also input into the integrity security protection part, thereby outputting the first MAC.

[0321] Specifically, the communication method includes the following steps:

[0322] S610: The network device determines a security algorithm.

[0323] In this embodiment, since the network device can perform security protection on the security mode command message to be sent based on a determined security algorithm, in this embodiment, the network device can determine the security algorithm before sending the security mode command message. The specific method of determining the security algorithm can refer to the description of step S510 in the embodiment shown in Figure 5 above, which will not be repeated here.

[0324] S620: The network device activates security protection between the network device and the terminal device based on the security algorithm and the security key.

[0325] In this embodiment, the relevant description of the network device activating the security protection between the network device and the terminal device based on the security algorithm and the security key can refer to the description of step S520 in the embodiment shown in Figure 5 above, and will not be repeated here.

[0326] Specifically, in this embodiment, the network device activates security protection between the network device and the terminal device, and obtains a first ciphertext for confidentiality protection and a first message authentication code MAC for integrity security protection based on a security algorithm.

[0327] Exemplarily, a network device obtains a first ciphertext with confidentiality protection based on a security algorithm, including: the network device uses a security key as an input key for the confidentiality-protected portion of the security algorithm to confidentially protect a second parameter to obtain the first ciphertext. The second parameter is an input parameter for the confidentiality-protected portion of the security algorithm and may be a parameter with high security requirements in a security mode command message. The security key may be a key generated during a primary authentication process. A description of the second parameter and the security key can be found in the description above and will not be repeated here.

[0328] For example, if the security algorithm is an AEAD algorithm, the second parameter is the plaintext input to the confidentiality-protected part of the AEAD algorithm, the security key is the AEAD key, and the first ciphertext is the output of the confidentiality-protected part of the AEAD algorithm.

[0329] Exemplarily, the network device obtains a first MAC for integrity security protection based on a security algorithm, including: the network device uses a security key as an input key for the integrity protection portion of the security algorithm to perform integrity check on a first parameter and a first ciphertext to obtain the first MAC. The first parameter is an input parameter for the integrity security protection portion of the security algorithm, and the first parameter may be a parameter for integrity security protection in a security mode command message.

[0330] For example, if the security algorithm is an AEAD algorithm, the second parameter is the plaintext input to the confidentiality protection part of the AEAD algorithm, the first parameter is the AAD input to the integrity security protection part of the AEAD algorithm, the security key is the AEAD key, the first ciphertext is the output of the confidentiality protection part of the AEAD algorithm, and the first ciphertext is also the input to the integrity protection part of the AEAD algorithm, and the first MAC is the output of the integrity protection part of the AEAD algorithm.

[0331] S630: The network device sends a security mode command message to the terminal device.

[0332] The security mode command message involved in this embodiment is a security mode command message based on security algorithm security protection. For the convenience of description, the security mode command message with security protection is referred to as the security mode command message in this embodiment.

[0333] Specifically, the security mode command message carries a first ciphertext, a first MAC, and a first parameter.

[0334] As a possible implementation, if the network device is an AMF, the security mode command message is a NAS SMC. Exemplarily, if the security mode command message is a NAS SMC, the first parameter carried in the NAS SMC may be information such as ngKSI, replayed UE security capabilities, and Kamf change indication. Here, ngKSI is understood as the key identifier of the first key in the first parameter, the replayed UE security capabilities are understood as the security capability information of the replayed terminal device in the first parameter, and the Kamf change indication is understood as the first key change indication information in the first parameter.

[0335] As another possible implementation, if the network device is an access network device, the security mode command message is AS SMC.

[0336] In this implementation, if the security protection algorithms of the RRC message and the UP message are independent, that is, the AS SMC includes the security protection algorithm corresponding to the selected RRC message and the security protection algorithm corresponding to the selected UP message.

[0337] For example, the security protection algorithms selected by the access network device for protecting the UP message are the integrity security protection algorithm and the confidentiality security protection algorithm. The identifier of the integrity security protection algorithm and the identifier of the confidentiality security protection algorithm corresponding to the UP message can be carried in the AS SMC as part of the first ciphertext, or the identifier of the integrity security protection algorithm and the identifier of the confidentiality security protection algorithm corresponding to the UP message can be carried in the AS SMC as part of the first parameter.

[0338] Optionally, the security mode command message header carries a first header type indication, which is used to indicate that the security mode command message is protected by an authenticated encryption algorithm (e.g., an AEAD algorithm). Exemplarily, the first header type indication may reuse an existing header type indication information field (e.g., the security header type information element in a NAS message), but may have a different value, such as 0101. The first header type may also be additional indication information, indicated using additional bits.

[0339] Optionally, the security mode command message header carries first indication information, which is used to indicate the length of the first parameter and / or the position of the first parameter in the security mode command message. The first indication information can also be used as part of the first parameter.

[0340] For example, the length of the first parameter is 16 bits, bits 1 to 16 in the security mode command message payload are the first parameter, and the value after bit 16 is the first ciphertext and the first MAC part.

[0341] Optionally, after sending the security mode command message, the network device may activate security protection for uplink messages based on a security algorithm, wherein the uplink messages include messages received from the terminal device, and the security protection for uplink messages based on the security algorithm includes decrypting and performing integrity verification on the received uplink messages based on the security algorithm.

[0342] S640, the terminal device verifies the security mode command message.

[0343] After receiving the security mode command message, the terminal device can perform a security check on the security mode command message based on the first parameter carried in the security mode command message, wherein the security check includes but is not limited to: integrity check, decryption, and / or anti-replay check.

[0344] Exemplarily, the first parameter includes an identifier of a security algorithm, and the terminal device performs security verification on the security mode command message according to the first parameter, including: the terminal device performs security verification on the security mode command message according to the security algorithm.

[0345] Specifically, the terminal device performs security verification on the security mode command message according to the security algorithm, including: the terminal device performs integrity verification and decryption on the security mode command message according to the security algorithm.

[0346] For ease of understanding, the AEAD algorithm is used as an example for explanation. The terminal device obtains the corresponding security key (i.e., the AEAD key) based on the security algorithm. In addition, the terminal device uses the first parameter (AAD), the first ciphertext, and the AEAD key as inputs for the integrity protection portion of the AEAD algorithm to obtain a MAC value, and determines whether the first MAC is consistent with the MAC to determine whether the first MAC is correct.

[0347] When the integrity check succeeds (that is, the first MAC is correct), the terminal device decrypts the first ciphertext using the security key and the security algorithm.

[0348] Optionally, the first parameter also includes a key identifier of the first key. The terminal device can determine the first key based on the key identifier of the first key. The first key can be the above-mentioned security key, and the terminal device can perform integrity verification and decryption on the security mode command message based on the security key and the security algorithm. The specific integrity verification and decryption methods can be referred to the above description and will not be repeated here.

[0349] Optionally, the first parameter also includes first key change indication information, and the terminal device can determine key derivation based on the first key change indication information. Specifically, after determining the first key, the terminal device performs key derivation on the first key to obtain a security key, and performs integrity verification and decryption on the security mode command message based on the security key and the security algorithm. The specific integrity verification and decryption methods can be found in the above description and are not further elaborated here.

[0350] Optionally, the first parameter also includes the security capability information of the replayed terminal device. In addition to performing integrity verification and decryption on the security mode command message according to the security algorithm, the terminal device can compare the security capability information of the terminal device it sent with the security capability information of the replayed terminal device to determine whether they are consistent. If they are consistent, the terminal device determines that the received message has not been tampered with; if they are inconsistent, the terminal device determines that the received message has been tampered with.

[0351] Exemplarily, when the terminal device security verification is successful (e.g., integrity verification is successful, or both integrity verification and decryption are successful), the terminal device saves the security context, which includes the security algorithm, that is, the security algorithm is part of the security context.

[0352] It should be noted that if the network device is an AMF, the security context saved by the terminal device is a NAS security context; if the network device is an access network device, the security context saved by the terminal device is an AS security context.

[0353] As described above, if the network device is an access network device, and the RRC message and UP message can use different security protection algorithms, in this case, the AS security context saved by the terminal device includes both the security protection algorithm corresponding to the RRC message (i.e., the security algorithm) and the security protection algorithm corresponding to the UP message (the security protection algorithm selected by the access network device for the UP message, such as the confidentiality security protection algorithm and / or the integrity security protection algorithm, etc.). That is to say, when the network device is an access network device, the AS security context saved by the terminal device includes the RRC security context and the UP security context.

[0354] Exemplarily, when the security mode command message carries a first packet header type indication, the terminal device may determine whether to use a security algorithm based on the first packet header type indication.

[0355] For example, when the security mode command message header includes a first header type indication and the security algorithm carried in the security mode command message is a security algorithm, the terminal device determines to use the security algorithm for security verification and security protection of subsequent messages.

[0356] For another example, when the security mode command message header includes a first header type indication and the security algorithm carried in the security mode command message is not an authentication encryption algorithm, the terminal device discards the full mode command message.

[0357] Exemplarily, when the security mode command message carries the first indication information, the terminal device can obtain the first parameter from the security mode command message according to the first indication information.

[0358] If the security check succeeds in step S640, the terminal device activates integrity and confidentiality security protection for uplink messages based on the security algorithm. The uplink messages include messages sent to the network device, and the security protection for uplink messages based on the security algorithm includes confidentiality and integrity security protection for the uplink messages to be sent based on the security algorithm.

[0359] Optionally, the terminal device may also send a security mode response message to the network device. The security mode response message includes a security mode completion message or a security mode failure message.

[0360] S650: The terminal device sends a security mode response message to the network device.

[0361] The security mode command message involved in this embodiment is a security mode response message based on security algorithm security protection. For the convenience of description, the security mode response message with security protection is referred to as security mode response message in this embodiment.

[0362] If the security check succeeds in step S640, the terminal device sends a security mode completion message to the network device.

[0363] If the security check fails in step S640, the terminal device sends a security mode failure message to the network device.

[0364] Exemplarily, the terminal device performs integrity security protection and confidentiality security protection on the information elements in the security mode response message based on the security algorithm. For example, based on the security algorithm, the terminal device performs confidentiality protection on some information elements in the security mode response message to obtain a second ciphertext, and based on the security algorithm, the terminal device performs integrity security protection on some information elements in the security mode response message to obtain a second MAC.

[0365] In this embodiment, the second MAC is obtained by performing integrity security protection on the first parameter and the first ciphertext based on the security algorithm. For a description of the first parameter, refer to the previous text and are not repeated here. The second ciphertext is the ciphertext obtained by maintaining the confidentiality of the second parameter based on the algorithm confidentiality portion of the security algorithm. For a description of the second parameter, refer to the previous text and are not repeated here.

[0366] The terminal device then sends a security mode response message to the network device, where the security mode response message carries the second MAC and the second ciphertext.

[0367] Optionally, the security mode response message header carries a second header type indication, and the second header type indication is used to indicate that the security mode response message is securely protected based on an authenticated encryption algorithm (eg, an AEAD algorithm).

[0368] Exemplarily, the network device receives the security mode response message, and performs integrity verification and decryption on information elements in the security mode response message based on a security algorithm.

[0369] S660: The network device verifies the security mode response message.

[0370] The specific security verification method can refer to the method in the above step S540 regarding the network device performing integrity verification and decryption on the uplink message, which will not be repeated here.

[0371] As described above, in this embodiment, the network device activates security protection for uplink messages after sending a security mode command message. Furthermore, in this embodiment, the network device activates security protection for uplink messages after receiving a security mode response message. For example, when the network device receives a security mode completion message from a terminal device, it activates security protection for uplink messages based on a security algorithm. The uplink message includes a message received from a terminal device (e.g., a security mode response message), and the security protection for uplink messages based on a security algorithm includes decrypting and performing integrity verification on the received uplink message based on the security algorithm.

[0372] The present application also provides another communication method, in which a network device can select a second integrity security protection algorithm and a security algorithm that can achieve both confidentiality security protection and integrity security protection. The second integrity security protection algorithm is used to perform integrity security protection on a security mode command message to be transmitted, and the security algorithm is used to achieve confidentiality and integrity security protection for messages transmitted after the security mode command message.

[0373] In this communication method, after a network device selects a security algorithm, it doesn't immediately activate it. Instead, it includes the security algorithm identifier in a security mode command message. This allows the network device and terminal device to use the security algorithm identifier carried in the security mode command message to negotiate a security protection method for messages transmitted after the security mode command message. Subsequent messages transmitted between the network device and terminal device in this communication method are protected using the security algorithm, avoiding the potential security risks associated with combining a confidentiality and integrity security protection algorithm.

[0374] The communication method is described in detail below with reference to FIG7 . FIG7 is a schematic flow chart of another communication method provided by the present application. The method includes the following steps:

[0375] S710 , the network device selects a security algorithm and a second integrity security protection algorithm.

[0376] In this embodiment, the first algorithm priority list, integrity security protection algorithm priority list, and confidentiality security protection algorithm priority list locally configured by the network device can refer to the description of the algorithm priority list locally configured by the network device in step S510 of the communication method shown in Figure 5 above, and will not be repeated here.

[0377] The difference from the above step S510 is that in the process of selecting a security algorithm, the network device in this embodiment not only selects a security algorithm that can achieve both confidentiality security protection and integrity security protection, but also selects a second integrity security protection algorithm.

[0378] For example, the network device not only obtains a security algorithm according to the security algorithm selection logic shown in step S510 above, but also selects an integrity security protection algorithm according to the security capability information of the terminal device.

[0379] It should be understood that this embodiment does not limit how the network device selects the second integrity security protection algorithm. You can refer to the selection method of the network device selecting the integrity security protection algorithm in the prior art, which will not be repeated here.

[0380] It should also be understood that the second integrity security protection algorithm selected by the network device in this embodiment is used for security protection of the security mode command message, and the security algorithm is used for integrity security protection and confidentiality security protection of subsequent messages of the security mode command message.

[0381] S720: The network device activates security protection based on the second integrity security protection algorithm.

[0382] Specifically, the network device activates security protection of downlink messages based on the second integrity security protection algorithm, and temporarily does not activate security protection of downlink messages based on the security algorithm.

[0383] Specifically, the network device activates security protection based on the second integrity security protection algorithm, including: configuring the second integrity security protection algorithm and a key corresponding to the second integrity security protection algorithm.

[0384] Furthermore, the network device obtains a fourth MAC for integrity security protection based on the second integrity security protection algorithm. For example, the network device performs integrity security protection on some or all of the information elements in the security mode command message.

[0385] Exemplarily, if the network device is an AMF, the description related to step S720 can refer to the description of step S320 in the communication method shown in Figure 3 above, and will not be repeated here.

[0386] Exemplarily, if the network device is an access network device, the description related to step S720 can refer to the description of step S420 in the communication method shown in FIG4 above, and will not be repeated here.

[0387] S730: The network device sends a security mode command message to the terminal device.

[0388] The security mode command message involved in this embodiment is a security mode command message with integrity protection based on the second integrity security protection algorithm. For the convenience of description, the security mode command message with integrity protection is referred to as the security mode command message in this embodiment.

[0389] Optionally, if the network device is AMF, the security mode command message is NAS SMC.

[0390] Optionally, if the network device is an access network device, the security mode command message is AS SMC.

[0391] The security mode command message includes an identifier of a security algorithm, an identifier of a second integrity security protection algorithm, and a fourth MAC.

[0392] It should be noted that the identifier of the security algorithm carried in the security mode command message will subsequently be part of the security context, and the second integrity security protection algorithm is used to protect the security mode command message, that is, the second integrity security protection algorithm is a temporary security context or is not part of the security context.

[0393] Exemplarily, if the network device is an AMF, the information included in the security mode command message, in addition to the identifier of the above-mentioned security algorithm, can refer to the description of the information included in the NAS SMC message in step S330 in the communication method shown in Figure 3 above, and will not be repeated here.

[0394] Exemplarily, if the network device is an access network device, the information included in the security mode command message, in addition to the identifier of the above-mentioned security algorithm, can refer to the description of the information included in the AS SMC message in step S430 of the communication method shown in Figure 4 above. For example, if the security protection algorithms corresponding to the RRC message and the UP message are common, the AS SMC can carry the identifier of the security algorithm and the identifier of the second integrity security protection algorithm. For another example, if the security protection algorithms of the RRC message and the UP message are independent, the AS SMC includes the identifier of the second integrity security protection algorithm and the identifier of the security algorithm corresponding to the RRC message, and the AS SMC also includes the identifier of the confidentiality security protection algorithm corresponding to the UP message, the identifier of the integrity security protection algorithm corresponding to the UP message, or the identifier of the authentication encryption algorithm corresponding to the UP message.

[0395] Optionally, the security mode command message also includes a third parameter required for the terminal device to perform integrity verification. The third parameter refers to a parameter in the security mode command message that is integrity-protected, or a parameter in the security mode command message that is not confidentiality-protected. Specifically, the third parameter is a parameter to be integrity-protected based on the second integrity security protection algorithm. It should be understood that the third parameter is a parameter required by the terminal device for security verification. Therefore, the second parameter is carried in plaintext in the security mode command message and transmitted to the terminal device, allowing the terminal device to perform security verification on the security mode command message based on the third parameter. Integrity-protecting the third parameter without confidentiality-protecting it improves security while ensuring that the terminal device can obtain sufficient information for security verification. For example, if the security protection algorithms for the RRC message and the UP message are independent, the identifier of the security algorithm corresponding to the RRC message, the identifier of the confidentiality protection algorithm corresponding to the UP message, the identifier of the integrity protection algorithm corresponding to the UP message, or the identifier of the authenticated encryption algorithm corresponding to the UP message can all serve as the content of the third parameter.

[0396] Optionally, after sending the security mode command message, the network device may activate uplink message security protection based on a security algorithm. The uplink message includes a message received from the terminal device, and the security protection of the uplink message based on the security algorithm includes decrypting and integrity checking the received uplink message based on the security algorithm. Specifically, for a description of the security protection of uplink messages based on the security algorithm by the network device, reference can be made to the manner in which the terminal device verifies the security mode command message in the embodiment shown in FIG6 , and will not be repeated here.

[0397] S740, the terminal device verifies the security mode command message.

[0398] Exemplarily, if the network device is an AMF, the way in which the terminal device verifies the security mode command message can refer to the description of the UE verifying the NAS SMC message in step S350 of the communication method shown in Figure 3 above, and will not be repeated here.

[0399] Exemplarily, if the network device is an access network device, the way in which the terminal device verifies the security mode command message can refer to the description of the UE verifying the AS SMC message in step S450 of the communication method shown in Figure 4 above, and will not be repeated here.

[0400] If the verification is successful, the terminal device stores the security algorithm as part of the security context.

[0401] Optionally, after the verification is completed, the terminal device deletes or does not store the second integrity security protection algorithm.

[0402] For example, the security mode command message is an AS SMC message, and the security protection algorithms of the RRC message and the UP message are shared (e.g., a shared security algorithm). The AS SMC message includes the security protection algorithms corresponding to the RRC message and the UP message. After the terminal device completes the verification based on the second integrity security protection algorithm, it saves the security algorithm in the RRC security context and the UP security context, and deletes or does not store the second integrity security protection algorithm.

[0403] For example, the security mode command message is an AS SMC message, and the security protection algorithms of the RRC message and the UP message are independent. The AS SMC message includes the security protection algorithm corresponding to the RRC message (such as the security algorithm), and the security protection algorithm corresponding to the UP message (such as at least one of the authentication encryption algorithm #1, the integrity security protection algorithm #1, or the confidentiality security protection algorithm #1). After the terminal device completes the verification based on the second integrity security protection algorithm, it saves the security algorithm in the RRC security context, deletes or does not store the second integrity security protection algorithm, and saves the security protection algorithm corresponding to the UP message in the UP security context (such as saving at least one of the authentication encryption algorithm #1, the integrity security protection algorithm #1, or the confidentiality security protection algorithm #1).

[0404] For another example, the security mode command message is a NAS SMC message. After the terminal device completes verification based on the second integrity security protection algorithm, it saves the security algorithm in the NAS security context, and deletes or does not store the second integrity security protection algorithm.

[0405] If the security check succeeds in step S740, the terminal device activates integrity and confidentiality security protection for uplink messages based on the security algorithm. Uplink messages include messages sent to the network device, and security protection for uplink messages based on the security algorithm includes confidentiality and integrity security protection for uplink messages to be sent based on the security algorithm.

[0406] S750: The terminal device sends a security mode response message to the network device.

[0407] For the description related to the terminal device sending the security mode response message to the network device in this embodiment, please refer to the description about the terminal device sending the security mode response message to the network device in the communication method shown in Figure 6, which will not be repeated here.

[0408] Exemplarily, the network device receives the security mode response message, and performs integrity verification and decryption on information elements in the security mode response message based on a security algorithm.

[0409] S760, the network device verifies the security mode response message.

[0410] The specific security verification method can refer to the security verification method of the terminal device on the security mode command message in the above step S640, which will not be repeated here.

[0411] As described above, in this embodiment, the network device activates security protection for uplink messages after sending a security mode command message. Furthermore, in this embodiment, the network device activates security protection for uplink messages after receiving a security mode response message. For example, when the network device receives a security mode completion message from a terminal device, it activates security protection for uplink messages based on a security algorithm. The uplink message includes a message received from a terminal device (e.g., a security mode response message), and the security protection for uplink messages based on a security algorithm includes decrypting and performing integrity verification on the received uplink message based on the security algorithm.

[0412] The present application also provides another communication method in which a network device can select a security algorithm capable of both confidentiality and integrity protection. The security algorithm is used to provide confidentiality and integrity protection for messages transmitted after a security mode command message. A first integrity protection algorithm for integrity protection of the transmitted security mode command message is determined based on the security algorithm. Thus, when selecting a security protection algorithm, the network device can simply select the security algorithm, then determine the first integrity protection algorithm based on the selected security algorithm, and perform integrity protection on the transmitted security mode command message based on the first integrity protection algorithm.

[0413] In this communication method, after the network device selects the security algorithm, it carries the identifier of the security algorithm in the security mode command message, so that the network device and the terminal device can implement the security protection method of the message transmitted after the negotiated security mode command message through the identifier of the security algorithm carried in the security mode command message.

[0414] In this communication method, subsequent messages transmitted between the network device and the terminal device are protected using this security algorithm, avoiding the security risks associated with combining a confidentiality security algorithm with an integrity security algorithm. Furthermore, in this technical solution, the security mode command message sent by the network device only needs to include the identifier of the security algorithm, without needing to include the identifier of the first integrity security algorithm. This is because the terminal device can determine the first integrity security algorithm based on the security algorithm, reducing signaling overhead.

[0415] The communication method is described in detail below with reference to FIG8 . FIG8 is a schematic flow chart of another communication method provided by the present application. The method comprises the following steps:

[0416] S810: The network device determines a security algorithm.

[0417] Exemplarily, the network device may select the security algorithm. Specifically, the description of selecting the security algorithm may refer to the description of step S510 in the communication method shown in FIG5 , which will not be repeated here.

[0418] Exemplarily, the network device may select an integrity security protection algorithm and / or a confidentiality security protection algorithm, and determine the security algorithm based on the selected integrity security protection algorithm #1 and / or confidentiality security protection algorithm.

[0419] In this embodiment, the security algorithm determined by the network device can be used to determine the first integrity security protection algorithm.

[0420] As a possible implementation manner, the network device uses the algorithm obtained by clearing the confidentiality part in the security algorithm as the first integrity security protection algorithm.

[0421] As another possible implementation, the network device determines the first integrity security protection algorithm based on a corresponding relationship and a security algorithm, where the corresponding relationship includes a corresponding relationship between the security algorithm and the first integrity security protection algorithm. Optionally, the corresponding relationship may also include a corresponding relationship between other authentication encryption algorithms and integrity security protection algorithms, which is not limited in this embodiment.

[0422] For example, the correspondence between multiple integrity security protection algorithms and multiple authenticated encryption algorithms is: SNOW-AEAD algorithm corresponds to SNOW integrity security protection algorithm, ZUC-AEAD algorithm corresponds to ZUC integrity security protection algorithm, and AES-AEAD algorithm corresponds to AES integrity security protection algorithm.

[0423] If the security algorithm is the SNOW-AEAD algorithm, the first integrity security protection algorithm is the SNOW integrity security protection algorithm; or, if the security algorithm is the ZUC-AEAD algorithm, the first integrity security protection algorithm is the ZUC integrity security protection algorithm; or, if the security algorithm is the AES-AEAD algorithm, the first integrity security protection algorithm is the AES integrity security protection algorithm.

[0424] As another possible implementation, the network device directly uses the integrity-protected portion of the security algorithm as the first integrity security protection algorithm (or, in other words, the network device determines to use the integrity-protected portion of the security algorithm). For example, the network device considers all cells in the security mode command message as input to the integrity-protected portion of the security algorithm, without transmitting cells confidentially. In this implementation, the first integrity security protection algorithm is the security algorithm, but the security algorithm does not implement confidentiality security protection.

[0425] S820: The network device activates security protection based on the first integrity security protection algorithm or the security algorithm.

[0426] Specifically, the network device may activate security protection for downlink messages, for example, perform integrity security protection on downlink messages.

[0427] Exemplarily, the network device activates security protection based on a first integrity security protection algorithm, including: configuring the first integrity security protection algorithm and a key corresponding to the first integrity security protection algorithm.

[0428] Exemplarily, the network device activates security protection based on a security algorithm, including: configuring a security algorithm and a security key corresponding to the security algorithm.

[0429] Furthermore, the network device uses the security key as an input key for the integrity-protected portion to perform integrity protection on the security mode command message to be sent; or the network device determines a first integrity security protection algorithm based on the security algorithm, and performs integrity protection on the security mode command message to be sent based on the first integrity security protection algorithm. For example, the network device derives a third MAC for integrity security protection based on the first integrity security protection algorithm or the integrity-protected portion of the security algorithm.

[0430] It should be understood that for the AEAD algorithm shown in Figure 2, the network device uses part or all of the information elements of the downlink message as input to the AAD portion of the AEAD algorithm, using the AEAD key to output the third MAC. Therefore, part or all of the information elements of the downlink message are protected by integrity security, but not by confidentiality. The downlink message is specifically a security mode command message.

[0431] Exemplarily, if the network device is AMF, the relevant description of the integrity security protection of step S820 can refer to the description of step S320 in the communication method shown in Figure 3 above, and will not be repeated here.

[0432] Exemplarily, if the network device is an access network device, the relevant description of the integrity security protection of step S820 can refer to the description of step S420 in the communication method shown in Figure 4 above, and will not be repeated here.

[0433] The process of activating the security protection based on the first integrity security protection algorithm by the network device in this embodiment is similar to the process of activating NAS integrity security protection by the AMF in step S320 shown in FIG3 or the process of activating RRC integrity security protection by the access network device in step S420 in the communication method shown in FIG4 , except that:

[0434] In this embodiment, the first integrity security protection algorithm is an integrity security protection algorithm determined based on the security algorithm, or an algorithm in which the confidentiality security protection function in the security algorithm is not enabled. For details, see the description of S820.

[0435] S830: The network device sends a security mode command message to the terminal device.

[0436] The security mode command message involved in this embodiment is a security mode command message based on the first integrity security protection algorithm or security algorithm integrity protection. For the convenience of description, the integrity-protected security mode command message in this embodiment is referred to as the security mode command message.

[0437] Optionally, if the network device is AMF, the security mode command message is NAS SMC.

[0438] Optionally, if the network device is an access network device, the security mode command message is AS SMC.

[0439] The security mode command message includes an identifier of the security algorithm and a third MAC.

[0440] It should be noted that the identifier of the security algorithm carried in the security mode command message will be used as part of the security context later.

[0441] Exemplarily, if the network device is an AMF, the information included in the security mode command message, in addition to the identifier of the above-mentioned security algorithm, can refer to the description of the information included in the NAS SMC message in step S330 in the communication method shown in Figure 3 above, and will not be repeated here.

[0442] Exemplarily, if the network device is an access network device, the information included in the security mode command message, in addition to the identifier of the above-mentioned security algorithm, can refer to the description of the information included in the AS SMC message in step S430 of the communication method shown in Figure 4 above. For example, if the security protection algorithms corresponding to the RRC message and the UP message are common, the AS SMC can carry the identifier of the security algorithm and the identifier of the first integrity security protection algorithm. For another example, if the security protection algorithms of the RRC message and the UP message are independent, the AS SMC includes the identifier of the first integrity security protection algorithm and the identifier of the security algorithm corresponding to the RRC message, and the AS SMC also includes the identifier of the confidentiality security protection algorithm corresponding to the UP message, the identifier of the integrity security protection algorithm corresponding to the UP message, or the identifier of the authentication encryption algorithm corresponding to the UP message.

[0443] Optionally, the security mode command message also includes a third parameter required for the terminal device to perform integrity verification. The description of the third parameter can refer to the description of the third parameter in the communication method shown in Figure 7, and will not be repeated here.

[0444] Optionally, after sending the security mode command message, the network device may activate uplink message security protection based on a security algorithm. The uplink message includes a message received from the terminal device, and the security protection of the uplink message based on the security algorithm includes decrypting and integrity checking the received uplink message based on the security algorithm. Specifically, for a description of the security protection of uplink messages by the network device based on the security algorithm, reference can be made to the manner in which the terminal device verifies the security mode command message in the embodiment shown in FIG5 , and will not be repeated here.

[0445] S840, the terminal device verifies the security mode command message.

[0446] The terminal device receives the security mode command message and performs an integrity check on the security mode command message.

[0447] The terminal device determines the security algorithm based on the security algorithm identifier carried in the security mode command message. In other words, the terminal device determines that the security mode command message is integrity-protected based on the security algorithm (or the first integrity security protection algorithm corresponding to the security algorithm, or the integrity-protected portion of the security algorithm). Furthermore, the terminal device performs an integrity check on the security mode command message based on the security algorithm (or the first integrity security protection algorithm corresponding to the security algorithm, or the integrity-protected portion of the security algorithm).

[0448] As a possible implementation, the terminal device may perform an integrity check on the security mode command message based on the integrity protected portion of the security algorithm. For example, the third MAC is integrity protected based on the integrity protected portion of the security algorithm.

[0449] In this implementation, the terminal device uses the integrity-protected portion of the security algorithm to perform an integrity check on the security mode command message. The terminal device uses the security mode command message (part or all of the information elements of the security mode command message, such as the aforementioned third parameter) and the key corresponding to the security algorithm as input to the integrity-protected portion of the security algorithm. It should be understood that for the AEAD algorithm shown in Figure 2, the terminal device uses the AEAD key and inputs the security mode command message as the AAD portion, thereby outputting a MAC and determining whether the third MAC is consistent with the MAC to determine whether the third MAC is correct and implement integrity verification.

[0450] Exemplarily, the terminal device may perform an integrity check based on the third parameter carried in the security mode command message and the integrity-protected portion of the security algorithm. The third parameter includes parameters required for performing the integrity check based on the integrity-protected portion of the security algorithm. For example, the third parameter includes an identifier of the security algorithm, security capability information of the replayed terminal device, first key change indication information, or a key identifier of the first key.

[0451] In this implementation, the manner in which the terminal device performs integrity verification on the security mode command message can refer to the description of the terminal device performing integrity verification on the security mode command message in step S540 in the embodiment shown in FIG5 . For example, the security algorithm is the AEAD algorithm shown in FIG2 , and the terminal device obtains the corresponding security key (i.e., the AEAD key) according to the security algorithm. Furthermore, the terminal device uses the third parameter (AAD) and the AEAD key as inputs for the integrity protection portion of the AEAD algorithm to obtain a MAC value, and determines whether the third MAC is consistent with the MAC to determine whether the third MAC is correct, thereby implementing integrity verification.

[0452] As another possible implementation, the terminal device may perform integrity check on the security mode command message based on the first integrity security protection algorithm. This implementation corresponds to the following situation: the third MAC of the security mode command message is obtained by integrity security protection based on the first integrity security protection algorithm.

[0453] In this implementation, the terminal device determines the first integrity security protection algorithm. Specifically, the terminal device determines the security algorithm according to the identifier of the security algorithm, and further determines the first integrity security protection algorithm.

[0454] In this implementation, the method flow shown in FIG8 may further include:

[0455] S841, the terminal device determines a first integrity security protection algorithm.

[0456] As a possible implementation method, the terminal device uses the algorithm with the confidentiality part in the security algorithm cleared as the first integrity security protection algorithm.

[0457] As another possible implementation, the terminal device determines the first integrity security protection algorithm according to the corresponding relationship and the security algorithm. The description of the corresponding relationship can refer to the description of step S710 above, which will not be repeated here.

[0458] As another possible implementation, the network device directly uses the security algorithm as the first integrity security protection algorithm and performs integrity verification based on the security algorithm without decryption.

[0459] For example, in this embodiment, after the terminal device determines the first integrity security protection algorithm, the method of verifying the security mode command message based on the first integrity security protection algorithm can refer to the method of integrity verification performed by the terminal device in the prior art.

[0460] For example, if the network device is an AMF, the way in which the terminal device verifies the security mode command message can refer to the description of the UE verifying the NAS SMC message in step S350 of the communication method shown in Figure 3 above, and will not be repeated here.

[0461] For example, if the network device is an access network device, the way in which the terminal device verifies the security mode command message can refer to the description of the UE verifying the AS SMC message in step S450 in the communication method shown in Figure 4 above, and will not be repeated here.

[0462] If the verification is successful, the terminal device stores the security algorithm as part of the security context.

[0463] Optionally, after the verification is completed, the terminal device deletes or does not store the first integrity security protection algorithm.

[0464] For example, the security mode command message is an AS SMC message, and the security protection algorithms of the RRC message and the UP message are shared (e.g., a shared security algorithm). After the terminal device completes the verification based on the first integrity security protection algorithm, it saves the security algorithm in the RRC security context and the UP security context, and deletes or does not store the first integrity security protection algorithm.

[0465] For example, the security mode command message is an AS SMC message, and the security protection algorithms of the RRC message and the UP message are independent. The AS SMC message includes the security protection algorithm corresponding to the RRC message (such as the security algorithm), and the security protection algorithm corresponding to the UP message (such as at least one of the authentication encryption algorithm #1, the integrity security protection algorithm #1, or the confidentiality security protection algorithm #1). After the terminal device completes the verification based on the first integrity security protection algorithm, it saves the security algorithm in the RRC security context, deletes or does not store the first integrity security protection algorithm, and saves the security protection algorithm corresponding to the UP message in the UP security context (such as saving at least one of the authentication encryption algorithm #1, the integrity security protection algorithm #1, or the confidentiality security protection algorithm #1).

[0466] For another example, the security mode command message is a NAS SMC message. After the terminal device completes verification based on the first integrity security protection algorithm, it saves the security algorithm in the NAS security context, and deletes or does not store the first integrity security protection algorithm.

[0467] If the security check succeeds in step S840, the terminal device activates integrity and confidentiality security protection for uplink messages based on the security algorithm. Uplink messages include messages sent to the network device, and security protection for uplink messages based on the security algorithm includes confidentiality and integrity security protection for the uplink messages to be sent based on the security algorithm.

[0468] S850: The terminal device sends a security mode response message to the network device.

[0469] For the description related to the terminal device sending the security mode response message to the network device in this embodiment, please refer to the description about the terminal device sending the security mode response message to the network device in the communication method shown in Figure 5, which will not be repeated here.

[0470] S860, the network device verifies the security mode response message.

[0471] Exemplarily, the network device receives the security mode response message and performs integrity check and decryption on the information elements in the security mode response message based on the security algorithm. The specific security check method can refer to the method of the network device performing integrity check and decryption on the uplink message in step S540 above, which will not be repeated here.

[0472] As described above, in this embodiment, the network device activates security protection for uplink messages after sending a security mode command message. Furthermore, in this embodiment, the network device activates security protection for uplink messages after receiving a security mode response message. For example, when the network device receives a security mode completion message from a terminal device, it activates security protection for uplink messages based on a security algorithm. The uplink message includes a message received from a terminal device (e.g., a security mode response message), and the security protection for uplink messages based on a security algorithm includes decrypting and performing integrity verification on the received uplink message based on the security algorithm.

[0473] The present application also provides another communication method, in which a network device selects a third integrity security protection algorithm, activates the third integrity security protection algorithm, and performs integrity security protection on a security mode command message to be transmitted based on the third integrity security protection algorithm. Furthermore, the network device carries a fifth MAC address, an identifier of the third integrity security protection algorithm, and second indication information in the security mode command message, the second indication information indicating that confidentiality and integrity security protection of messages transmitted after the security mode command message are performed based on the security algorithm.

[0474] The third integrity security algorithm can determine the security algorithm, allowing network devices and terminal devices to implement security protection for messages transmitted after the negotiated security mode command message, using the identifier of the third integrity security algorithm carried in the security mode command message. This technical solution uses this security algorithm to protect subsequent messages transmitted between the network device and terminal device, avoiding the security risks associated with combining the confidentiality and integrity security algorithms.

[0475] The communication method is described in detail below in conjunction with FIG9 . FIG9 is a schematic flow chart of another communication method provided by the present application. The method includes the following steps:

[0476] S910: The network device determines a third integrity security protection algorithm.

[0477] Exemplarily, the network device may select the third integrity security protection algorithm. Specifically, the manner in which the network device selects the third integrity security protection algorithm may refer to the manner in which the network device selects the integrity security protection algorithm in the prior art.

[0478] For example, if the network device is AMF, the way in which the network device selects the third integrity security protection algorithm can refer to the description of AMF selecting the integrity security protection algorithm in step S310 of the communication method shown in Figure 3 above, and will not be repeated here.

[0479] For example, if the network device is an access network device, the way in which the network device selects the third integrity security protection algorithm can refer to the description of the access network device selecting the integrity security protection algorithm in step S410 in the communication method shown in Figure 4 above, and will not be repeated here.

[0480] Exemplarily, the network device may select an authenticated encryption algorithm, and determine the third integrity security protection algorithm based on the selected authenticated encryption algorithm.

[0481] Optionally, in this embodiment, the network device may also select a confidentiality security protection algorithm, which will not be described in detail here.

[0482] S920: The network device activates security protection based on the third integrity security protection algorithm.

[0483] Specifically, the network device may activate security protection for downlink messages, for example, perform integrity security protection on downlink messages.

[0484] Exemplarily, the network device activates security protection based on the third integrity security protection algorithm, including: configuring the third integrity security protection algorithm and a key corresponding to the third integrity security protection algorithm. Further, the network device obtains a fifth MAC of integrity security protection based on the third integrity security protection algorithm.

[0485] Exemplarily, if the network device is an AMF, the way in which the network device activates security protection based on the third integrity security protection algorithm can refer to the description of activating NAS integrity security protection in step S320 in the communication method shown in Figure 3 above, and will not be repeated here.

[0486] Exemplarily, if the network device is an access network device, the way in which the network device activates security protection based on the third integrity security protection algorithm can refer to the description of activating RRC integrity security protection in step S420 in the communication method shown in Figure 4 above, and will not be repeated here.

[0487] S930: The network device sends a security mode command message to the terminal device.

[0488] The security mode command message involved in this embodiment is a security mode command message based on the third integrity security protection algorithm or security algorithm integrity protection. For the convenience of description, the integrity-protected security mode command message in this embodiment is referred to as the security mode command message.

[0489] Optionally, if the network device is AMF, the security mode command message is NAS SMC.

[0490] Optionally, if the network device is an access network device, the security mode command message is AS SMC.

[0491] The security mode command message includes an identifier of a third integrity security protection algorithm, a fifth MAC, and second indication information. The second indication information is used to indicate that the message transmitted after the security mode command message is subjected to confidentiality and integrity security protection based on the security algorithm. The third integrity security protection algorithm is used to determine the security algorithm.

[0492] Exemplarily, the second indication information can be a 1-bit value. For example, when the second indication information takes a value of 1, it indicates that the message following the security mode command message uses a security algorithm; when the second indication information takes a value of 0 or is not carried, it indicates that the message following the security mode command message does not use a security algorithm.

[0493] Exemplarily, the second indication information may also be an identifier of a specific security algorithm. When the security mode command message carries the identifier of the security algorithm, it indicates that the message following the security mode command message uses the security algorithm; when the security algorithm identifier is not carried, it indicates that the message following the security mode command message does not use the security algorithm.

[0494] Exemplarily, the triggering condition for the network device to determine that a message following the security mode command message uses a security algorithm may include at least one of the following conditions:

[0495] 1) In step S910 above, the network device selects a third integrity security protection algorithm and a third confidentiality security protection algorithm, and the third integrity security protection algorithm and the third confidentiality security protection algorithm are the same type of algorithms. For example, the third integrity security protection algorithm and the third confidentiality security protection algorithm are both AES algorithms. For another example, the third integrity security protection algorithm and the third confidentiality security protection algorithm are both SNOW algorithms.

[0496] 2) In the above step S910, the algorithm selection policy is configured on the network device to give priority to the authentication encryption algorithm.

[0497] Exemplarily, if the network device is an AMF, the information included in the security mode command message, in addition to the above-mentioned second indication information, can refer to the description of the information included in the NAS SMC message in step S330 in the communication method shown in Figure 3 above, and will not be repeated here.

[0498] Exemplarily, if the network device is an access network device, the information included in the security mode command message, in addition to the above-mentioned second indication information, can refer to the description of the information included in the AS SMC message in step S430 of the communication method shown in Figure 4 above. For example, if the security protection algorithms corresponding to the RRC message and the UP message are common, the AS SMC can carry the identifier of the security algorithm and the identifier of the third integrity security protection algorithm. For another example, if the security protection algorithms of the RRC message and the UP message are independent, the AS SMC includes the identifier of the third integrity security protection algorithm and the security algorithm corresponding to the RRC message, and the AS SMC also includes the identifier of the confidentiality security protection algorithm corresponding to the UP message, the identifier of the integrity security protection algorithm corresponding to the UP message, or the identifier of the authentication encryption algorithm corresponding to the UP message.

[0499] Optionally, the security mode command message also includes a third parameter required for the terminal device to perform integrity verification. The description of the third parameter can refer to the description of the third parameter in the communication method shown in Figure 7, and will not be repeated here.

[0500] Optionally, after sending the security mode command message, the network device may activate uplink message security protection based on the security algorithm. Specifically, for a description of the security protection of uplink messages based on the security algorithm by the network device, reference may be made to the manner in which the terminal device verifies the security mode command message in the embodiment shown in FIG5 , which will not be repeated here.

[0501] As a possible implementation, after selecting the third integrity security protection algorithm, the network device determines a security algorithm based on the third integrity security protection algorithm. The uplink message includes a message received from the terminal device, and the security protection of the uplink message based on the security algorithm includes decrypting and integrity checking the received uplink message based on the security algorithm.

[0502] For example, the integrity security protection algorithm includes the AES integrity security protection algorithm, the SNOW integrity security protection algorithm, the ZUC integrity security protection algorithm, the null integrity security protection algorithm, etc. When the third integrity security protection algorithm is the AES integrity security protection algorithm, the security algorithm is the AES authenticated encryption algorithm; or, when the third integrity security protection algorithm is the SNOW integrity security protection algorithm, the security algorithm is the SNOW integrity security protection algorithm; or, when the third integrity security protection algorithm is the ZUC integrity security protection algorithm, the security algorithm is the ZUC authenticated encryption algorithm; or, when the third integrity security protection algorithm is the null integrity security protection algorithm, the security algorithm is the null algorithm.

[0503] As another possible implementation, the network device selects a security algorithm before determining the third integrity security protection algorithm, and the third integrity security protection algorithm is determined based on the security algorithm. The method for determining the third integrity security protection algorithm based on the security algorithm can be referenced by the method for determining the first integrity security protection algorithm based on the security algorithm described above, and is not further described here.

[0504] S940, the terminal device verifies the security mode command message.

[0505] For example, the manner in which the terminal device in this embodiment verifies the security mode command message based on the third integrity security protection algorithm may refer to the manner in which the terminal device performs integrity verification in the prior art.

[0506] For example, if the network device is an AMF, the way in which the terminal device verifies the security mode command message can refer to the description of the UE verifying the NAS SMC message in step S350 of the communication method shown in Figure 3 above, and will not be repeated here.

[0507] For example, if the network device is an access network device, the way in which the terminal device verifies the security mode command message can refer to the description of the UE verifying the AS SMC message in step S450 in the communication method shown in Figure 4 above, and will not be repeated here.

[0508] Optionally, after the verification is completed, the terminal device deletes or does not store the third integrity security protection algorithm.

[0509] If the security check succeeds in step S940, the terminal device determines the security algorithm based on the second indication information and the identifier of the third integrity security protection algorithm. Furthermore, the terminal device stores the security algorithm as part of the security context. Therefore, the method flow shown in Figure 8 may also include:

[0510] S950: The terminal device determines a security algorithm.

[0511] For example, when the second indication information indicates that a message transmitted after the security mode command message is to be protected for confidentiality and integrity based on a security algorithm, the terminal device determines the security algorithm based on a third integrity security protection algorithm. The manner in which the terminal device determines the security algorithm based on the third integrity security protection algorithm can be referred to the above description of the network device determining the security algorithm based on the third integrity security protection algorithm, and is not further described here.

[0512] For example, the security mode command message is an AS SMC message, and the security protection algorithms of the RRC message and the UP message are shared (e.g., a shared security algorithm). After the terminal device completes the verification based on the third integrity security protection algorithm, it saves the security algorithm in the RRC security context and the UP security context, and deletes or does not store the third integrity security protection algorithm.

[0513] For example, the security mode command message is an AS SMC message, and the security protection algorithms of the RRC message and the UP message are independent. After the terminal device completes the verification based on the third integrity security protection algorithm, it saves the security algorithm in the RRC security context, deletes or does not store the third integrity security protection algorithm, and saves the security protection algorithm corresponding to the UP message in the UP security context (for example, saving at least one of the authentication encryption algorithm #1, integrity security protection algorithm #1, or confidentiality security protection algorithm #1 corresponding to the UP message).

[0514] For another example, the security mode command message is a NAS SMC message. After the terminal device completes verification based on the third integrity security protection algorithm, it saves the security algorithm in the NAS security context, and deletes or does not store the third integrity security protection algorithm.

[0515] Exemplarily, after the terminal device determines the security algorithm, the terminal device may activate integrity security protection and confidentiality security protection for uplink messages based on the security algorithm. The uplink messages include messages sent to the network device, and the security protection for uplink messages based on the security algorithm includes performing confidentiality security protection and integrity security protection on the uplink messages to be sent based on the security algorithm.

[0516] S960, the terminal device sends a security mode response message to the network device.

[0517] The uplink message includes the security mode response message. For the description of the terminal device sending the security mode response message to the network device in this embodiment, please refer to the description of the terminal device sending the security mode response message to the network device in the communication method shown in Figure 6, which will not be repeated here.

[0518] Exemplarily, the network device receives the security mode response message, and performs integrity verification and decryption on information elements in the security mode response message based on a security algorithm.

[0519] S970, the network device verifies the security mode response message.

[0520] The specific security verification method can refer to the method in the above step S540 regarding the network device performing integrity verification and decryption on the uplink message, which will not be repeated here.

[0521] As described above, in this embodiment, the network device activates security protection for uplink messages after sending a security mode command message. Furthermore, in this embodiment, the network device activates security protection for uplink messages after receiving a security mode response message. For example, when the network device receives a security mode completion message from a terminal device, it activates security protection for uplink messages based on a security algorithm. The uplink message includes a message received from a terminal device (e.g., a security mode response message), and the security protection for uplink messages based on a security algorithm includes decrypting and performing integrity verification on the received uplink message based on the security algorithm.

[0522] It should be understood that the size of the serial numbers of the above processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0523] It should also be understood that in the various embodiments of the present application, unless otherwise specified or there is a logical conflict, the terms and / or descriptions between different embodiments are consistent and can be referenced to each other, and the technical features in different embodiments can be combined to form new embodiments according to their internal logical relationships.

[0524] It should also be understood that in some of the above embodiments, the devices in the existing network architecture are mainly used as examples for illustrative description (such as network devices, terminal devices, etc.), and it should be understood that the embodiments of the present application do not limit the specific form of the devices. For example, devices that can achieve the same functions in the future are applicable to the embodiments of the present application.

[0525] It is understandable that in the above-mentioned various method embodiments, the methods and operations implemented by devices (such as network devices, terminal devices) can also be implemented by components of the devices (such as chips or circuits).

[0526] The communication method provided in the embodiments of the present application is described in detail above with reference to Figures 3 to 6 . The communication method is primarily described from the perspective of interaction between a network device and a terminal device. It is understood that, in order to implement the aforementioned functions, the network device and the terminal device include hardware structures and / or software modules corresponding to the respective functions.

[0527] Those skilled in the art should be aware that, in combination with the units and algorithm steps of each example described in the embodiments disclosed herein, the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is performed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0528] The communication device provided in this application is described in detail below with reference to Figures 10 to 12. It should be understood that the description of the device embodiment corresponds to the description of the method embodiment. Therefore, for matters not described in detail, reference can be made to the method embodiment above. For the sake of brevity, some contents will not be repeated.

[0529] In the embodiment of the present application, the functional modules of the transmitting device or the receiving device can be divided according to the above method example. For example, each functional module can be divided according to each function, or two or more functions can be integrated into one processing module. The above integrated modules can be implemented in the form of hardware or in the form of software functional modules. It should be noted that the division of modules in the embodiment of the present application is schematic and is only a logical functional division. There may be other division methods in actual implementation. The following is an example of dividing each functional module according to each function.

[0530] Figure 10 is a schematic block diagram of a communication device 10 provided in an embodiment of the present application. The device 10 includes a transceiver module 11 and a processing module 12. The transceiver module 11 can implement corresponding communication functions, and the processing module 12 is used to process data. In other words, the transceiver module 11 is used to perform operations related to receiving and sending, while the processing module 12 is used to perform operations other than receiving and sending. The transceiver module 11 can also be referred to as a communication interface or a communication unit.

[0531] Optionally, the device 10 may further include a storage module 13, which may be used to store instructions and / or data. The processing module 12 may read the instructions and / or data in the storage module so that the device implements the actions of the devices in the aforementioned method embodiments.

[0532] In one design, the apparatus 10 may correspond to the network device in the above method embodiment, or a component (such as a chip) of the network device.

[0533] The device 10 can implement the steps or processes executed by the network device in the above method embodiment, wherein the transceiver module 11 can be used to perform the transceiver-related operations of the network device in the above method embodiment, and the processing module 12 can be used to perform the processing-related operations of the network device in the above method embodiment.

[0534] In one possible implementation, the processing module 12 is used to determine a security algorithm, which includes a part for confidentiality protection and a part for integrity protection; and activate security protection between the network device and the terminal device based on the security algorithm and a security key, wherein the security key is a key shared between the terminal device and the network device. The transceiver module 11 is used to receive an uplink message from the terminal device. The processing module 12 is used to use the security key as an input key for the integrity protection part of the security algorithm to verify the integrity of the uplink message, and use the security key as an input key for the confidentiality protection part of the security algorithm to decrypt the uplink message.

[0535] When the device 10 is used to execute the method in FIG5 , the transceiver module 11 can be used to execute the steps of sending and receiving information in the method, such as step S530 ; the processing module 12 can be used to execute the processing steps in the method, such as steps S510 , S520 and S540 .

[0536] When the device 10 is used to execute the method in Figure 6, the transceiver module 11 can be used to execute the steps of sending and receiving information in the method, such as steps S630 and S650; the processing module 12 can be used to execute the processing steps in the method, such as steps S610, S620 and S660.

[0537] When the device 10 is used to execute the method in Figure 7, the transceiver module 11 can be used to execute the steps of sending and receiving information in the method, such as steps S730 and S750; the processing module 12 can be used to execute the processing steps in the method, such as steps S710, S720 and S760.

[0538] When the device 10 is used to execute the method in Figure 8, the transceiver module 11 can be used to execute the steps of sending and receiving information in the method, such as steps S830 and S850; the processing module 12 can be used to execute the processing steps in the method, such as steps S810, S820 and S860.

[0539] When the device 10 is used to execute the method in Figure 9, the transceiver module 11 can be used to execute the steps of sending and receiving information in the method, such as steps S930 and S960; the processing module 12 can be used to execute the processing steps in the method, such as steps S910, S920 and S970.

[0540] It should be understood that the specific process of each unit executing the above corresponding steps has been described in detail in the above method embodiment, and for the sake of brevity, it will not be repeated here.

[0541] In another design, the apparatus 10 may correspond to the terminal device in the above method embodiment, or be a component (such as a chip) of the terminal device.

[0542] The device 10 can implement the steps or processes executed by the terminal device in the above method embodiment, wherein the transceiver module 11 can be used to execute the transceiver-related operations of the terminal device in the above method embodiment, and the processing module 12 can be used to execute the processing-related operations of the terminal device in the above method embodiment.

[0543] In one possible implementation, the processing module 12 is used to determine a security algorithm, the security algorithm including a part for confidentiality protection and a part for integrity protection; activate security protection between the terminal device and the network device based on the security algorithm and the security key, the security key being a key shared between the terminal device and the network device; perform security protection on the uplink message to be sent based on the security algorithm and the security key, and send the security-protected uplink message to the network device, wherein the security protection of the uplink message to be sent based on the security algorithm and the security key includes: using the security key as the input key of the integrity protection part of the security algorithm to perform integrity protection on the uplink message to be sent, and using the security key as the input key of the confidentiality protection part of the security algorithm to perform confidentiality protection on the uplink message to be sent. The transceiver module 11 is used to send the uplink message to the network device.

[0544] When the device 10 is used to execute the method in FIG5 , the transceiver module 11 may be used to execute the steps of sending and receiving information in the method, such as step S530 ; the processing module 12 may be used to execute the processing steps in the method, such as step S521 .

[0545] When the device 10 is used to execute the method in FIG6 , the transceiver module 11 may be used to execute the steps of sending and receiving information in the method, such as steps S630 and S650 ; the processing module 12 may be used to execute the processing steps in the method, such as step S640 .

[0546] When the device 10 is used to execute the method in Figure 7, the transceiver module 11 can be used to execute the steps of sending and receiving information in the method, such as steps S730 and S750; the processing module 12 can be used to execute the processing steps in the method, such as step S740.

[0547] When the device 10 is used to execute the method in Figure 8, the transceiver module 11 can be used to execute the steps of sending and receiving information in the method, such as steps S830 and S850; the processing module 12 can be used to execute the processing steps in the method, such as steps S841 and S840.

[0548] When the device 10 is used to execute the method in Figure 9, the transceiver module 11 can be used to execute the steps of sending and receiving information in the method, such as steps S930 and S960; the processing module 12 can be used to execute the processing steps in the method, such as steps S940 and S950.

[0549] It should be understood that the specific process of each unit executing the above corresponding steps has been described in detail in the above method embodiment, and for the sake of brevity, it will not be repeated here.

[0550] It should also be understood that the device 10 here is embodied in the form of a functional module. The term "module" here may refer to an application specific integrated circuit (ASIC), an electronic circuit, a processor (such as a shared processor, a dedicated processor or a group processor, etc.) and memory for executing one or more software or firmware programs, a combined logic circuit and / or other suitable components that support the described functions. In an optional example, those skilled in the art will understand that the device 10 may be specifically the mobile management network element in the above-mentioned embodiment, and may be used to execute the various processes and / or steps corresponding to the mobile management network element in the above-mentioned method embodiments; or, the device 10 may be specifically the terminal device in the above-mentioned embodiment, and may be used to execute the various processes and / or steps corresponding to the terminal device in the above-mentioned method embodiments. To avoid repetition, it will not be described here.

[0551] The apparatus 10 of each of the above-described solutions has the function of implementing the corresponding steps performed by the devices (such as terminal devices and network devices) in the above-described methods. This function can be implemented by hardware, or by hardware executing corresponding software implementations. The hardware or software includes one or more modules corresponding to the above-described functions; for example, the transceiver module can be replaced by a transceiver (for example, the transmitting unit in the transceiver module can be replaced by a transmitter, and the receiving unit in the transceiver module can be replaced by a receiver), and other units, such as the processing module, can be replaced by a processor to respectively perform the transceiver operations and related processing operations in each method embodiment.

[0552] In addition, the transceiver module 11 may also be a transceiver circuit (for example, may include a receiving circuit and a sending circuit), and the processing module may be a processing circuit.

[0553] Figure 11 is a schematic diagram of another communication device 20 provided in an embodiment of the present application. Device 20 includes a processor 21, which is configured to execute computer programs or instructions stored in memory 22, or read data / signaling stored in memory 22, to perform the methods described in the above method embodiments. Optionally, there may be one or more processors 21.

[0554] Optionally, as shown in FIG11 , the device 20 further includes a memory 22 for storing computer programs or instructions and / or data. The memory 22 may be integrated with the processor 21 or may be separately provided. Optionally, there may be one or more memories 22.

[0555] Optionally, as shown in Figure 11, the device 20 further includes a transceiver 23, which is used to receive and / or send signals. For example, the processor 21 is used to control the transceiver 23 to receive and / or send signals.

[0556] As a solution, the apparatus 20 is used to implement the operations performed by the network device in each of the above method embodiments.

[0557] As another solution, the apparatus 20 is used to implement the operations performed by the terminal device in the above various method embodiments.

[0558] It should be understood that the processor mentioned in the embodiments of the present application may be a central processing unit (CPU), or may be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor, etc.

[0559] It should also be understood that the memory mentioned in the embodiments of the present application may be a volatile memory and / or a non-volatile memory. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM). For example, RAM can be used as an external cache. By way of example and not limitation, RAM includes the following forms: static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), and direct rambus RAM (DR RAM).

[0560] It should be noted that when the processor is a general-purpose processor, DSP, ASIC, FPGA or other programmable logic device, discrete gate or transistor logic device, discrete hardware component, the memory (storage module) can be integrated into the processor.

[0561] It should also be noted that the memory described herein is intended to include, but is not limited to, these and any other suitable types of memory.

[0562] 12 is a schematic diagram of a chip system 30 according to an embodiment of the present application. The chip system 30 (or also referred to as a processing system) includes a logic circuit 31 and an input / output interface 32.

[0563] The logic circuit 31 may be a processing circuit in the chip system 30. The logic circuit 31 may be coupled to a storage unit and call instructions in the storage unit so that the chip system 30 can implement the methods and functions of the various embodiments of the present application. The input / output interface 32 may be an input / output circuit in the chip system 30, outputting information processed by the chip system 30 or inputting data or signaling information to be processed into the chip system 30 for processing.

[0564] As a solution, the chip system 30 is used to implement the operations performed by the network device and the terminal device in the above various method embodiments.

[0565] For example, the logic circuit 31 is used to implement the processing-related operations performed by the network device and the terminal device in the above method embodiment; the input / output interface 32 is used to implement the sending and / or receiving-related operations performed by the network device and the terminal device in the above method embodiment.

[0566] An embodiment of the present application further provides a computer-readable storage medium on which computer instructions for implementing the methods executed by the network device and the terminal device in the above-mentioned method embodiments are stored.

[0567] For example, when the computer program is executed by a computer, the computer can implement the methods performed by the network device and the terminal device in each embodiment of the above method.

[0568] An embodiment of the present application also provides a computer program product, comprising instructions, which, when executed by a computer, implement the methods performed by the network device and the terminal device in the above-mentioned method embodiments.

[0569] An embodiment of the present application also provides a communication system, including the aforementioned network device and terminal device.

[0570] The explanation of the relevant contents and beneficial effects of any of the above-mentioned devices can be referred to the corresponding method embodiments provided above, which will not be repeated here.

[0571] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0572] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. For example, the computer can be a personal computer, a server, or a network device, etc. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one website, computer, server or data center to another website, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrations. The available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a magnetic tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid state disk (SSD)). For example, the aforementioned available medium includes, but is not limited to, various media that can store program code, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0573] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.

Claims

1. A communication method, characterized in that: Applied to a network device or a chip in the network device, the method comprising: Determine a security algorithm, wherein the security algorithm includes a part for performing confidentiality protection and a part for performing integrity protection; activating security protection between the network device and the terminal device based on the security algorithm and the security key, where the security key is a key shared between the terminal device and the network device; Receive a security-protected uplink message from the terminal device, use the security key as an input key for the integrity protection part of the security algorithm to perform integrity verification on the security-protected uplink message, and use the security key as an input key for the confidentiality protection part of the security algorithm to decrypt the security-protected uplink message.

2. The method according to claim 1, characterized in that After activating security protection between the network device and the terminal device based on the security algorithm and the security key, the method further includes: Based on the security algorithm, security protection is performed on the security mode command message to be sent, wherein the security mode command message to be sent includes a first parameter and a second parameter, Sending a security-protected secure mode command message to the terminal device, wherein the security-protected secure mode command message includes a first ciphertext, a first message authentication code MAC, and the first parameter, The first ciphertext is obtained by performing confidentiality protection on the second parameter based on the security algorithm, and the first MAC is obtained by performing integrity protection calculation on the first parameter and the first ciphertext based on the security algorithm.

3. The method according to claim 2, characterized in that The first parameter includes at least one of the following: The identifier of the security algorithm, the security capability information of the replayed terminal device, the key identifier of the first key, or the change indication information of the first key, wherein the first key is used to determine the security key.

4. The method according to claim 2 or 3, characterized in that: The security-protected safe mode command message further includes first indication information, where the first indication information is used to indicate a length of the first parameter and / or to indicate a position of the first parameter in the security-protected safe mode command message.

5. The method according to any one of claims 2 to 4, characterized in that The security-protected security mode command message includes a first packet header type indication, and the first packet header type indication is used to indicate that the security-protected security mode command message performs security protection based on the security algorithm.

6. The method according to claim 1, characterized in that After activating security protection between the terminal device and the terminal device based on the security algorithm and the security key, the method further includes: Using the security key as an input key of the integrity protected part, integrity protecting the security mode command message to be sent; An integrity-protected security mode command message is sent to the terminal device, wherein the integrity-protected security mode command message includes an identifier of the security algorithm.

7. The method according to claim 1, characterized in that After determining the security algorithm, the method further includes: Determining a first integrity security protection algorithm according to the security algorithm; Performing integrity protection on the security mode command message to be sent based on the first integrity security protection algorithm, An integrity-protected security mode command message is sent to a terminal device, wherein the integrity-protected security mode command message includes an identifier of the security algorithm.

8. The method according to claim 7, characterized in that The performing integrity protection on the security mode command message to be sent based on the first integrity security protection algorithm includes: The security key is used as an input key of the first integrity security protection algorithm to perform integrity protection on the security mode command message to be sent.

9. The method according to claim 7 or 8, characterized in that: The determining a first integrity security protection algorithm according to the security algorithm comprises: The algorithm after the confidentiality protection part in the security algorithm is cleared is used as the first integrity security protection algorithm; or The first integrity security protection algorithm is determined according to the corresponding relationship between the security algorithm and the first integrity security protection algorithm and the security algorithm.

10. The method according to claim 9, characterized in that If the security algorithm is the SNOW-AEAD algorithm, then the first integrity security protection algorithm is the SNOW integrity security protection algorithm; or, If the security algorithm is the ZUC-AEAD algorithm, then the first integrity security protection algorithm is the ZUC integrity security protection algorithm; or, If the security algorithm is the AES-AEAD algorithm, the first integrity security protection algorithm is the AES integrity security protection algorithm.

11. The method according to claim 1, characterized in that The method further comprises: Determine a second integrity security protection algorithm, and perform integrity protection on the security mode command message to be sent based on the second integrity security protection algorithm; An integrity-protected security mode command message is sent to a terminal device, wherein the integrity-protected security mode command message includes an identifier of the security algorithm and an identifier of the second integrity security protection algorithm.

12. The method according to claim 1, characterized in that The method further comprises: Determine a third integrity security protection algorithm, and perform security protection on the security mode command message to be sent based on the third integrity security protection algorithm; An integrity-protected security mode command message is sent to a terminal device, wherein the integrity-protected security mode command message includes an identifier of the third integrity security protection algorithm and second indication information, wherein the second indication information is used to indicate that a message transmitted after the security mode command message is to be security-protected based on the security algorithm.

13. The method according to claim 12, characterized in that The determining of the security algorithm comprises: The security algorithm is determined according to the corresponding relationship between the third integrity security protection algorithm and the security algorithm, and the third integrity security protection algorithm.

14. The method according to any one of claims 1 to 12, characterized in that The determining of the security algorithm comprises: The security algorithm is selected according to a priority of at least one security algorithm, wherein the security algorithm is one of the at least one security algorithm.

15. The method according to any one of claims 1 to 14, characterized in that The security algorithm is an authenticated encryption AEAD algorithm with associated data.

16. The method according to any one of claims 1 to 15, characterized in that The security-protected uplink message includes a security mode response message.

17. The method according to any one of claims 1 to 16, characterized in that The security-protected uplink message header includes a second packet header type indication, and the second packet header type indication is used to indicate that the security-protected uplink message is security-protected based on the security algorithm.

18. A communication method, characterized in that: Applied to a terminal device or a chip in the terminal device, the method comprising: Determine a security algorithm, wherein the security algorithm includes a part for performing confidentiality protection and a part for performing integrity protection; activating security protection between the terminal device and the network device based on the security algorithm and the security key, where the security key is a key shared between the terminal device and the network device; Performing security protection on the uplink message to be sent based on the security algorithm and the security key, and sending the security-protected uplink message to the network device, wherein the performing security protection on the uplink message to be sent based on the security algorithm and the security key includes: The security key is used as an input key of the integrity protection part in the security algorithm to perform integrity protection on the uplink message to be sent, and the security key is used as an input key of the confidentiality protection part in the security algorithm to encrypt the uplink message to be sent.

19. The method according to claim 18, characterized in that The method further comprises: receiving a security protection safety mode command message from the network device, wherein the security protection safety mode command message is used to activate security protection between the terminal device and the network device, The security mode command message of the security protection includes a first ciphertext, a first message authentication code MAC and a first parameter; The determining of the security algorithm comprises: determining the security algorithm and the security key according to the first parameter; The method further includes: using the security key as an input key of the integrity protection part in the security algorithm, calculating a MAC using the first ciphertext and the first parameter as input parameters of the integrity protection part in the security algorithm, and performing integrity verification on the security-protected security mode command message based on the first MAC and the calculated MAC; If the integrity verification passes, the first ciphertext is decrypted using the security key as an input key of a confidentiality protection part in the security algorithm to obtain a second parameter.

20. The method according to claim 19, characterized in that The first parameter includes at least one of the following: The identifier of the security algorithm, the security capability information of the replayed terminal device, the key identifier of the first key, or the first key change indication information, wherein the first key is used to determine the security key.

21. The method according to claim 19 or 20, characterized in that The security protection safety mode command message further includes first indication information, where the first indication information is used to indicate a length of the first parameter and / or to indicate a position of the first parameter in the security protection safety mode command message; The method further comprises: The first parameter is determined according to the first indication information.

22. The method according to any one of claims 19 to 21, characterized in that The security-protected security mode command message includes a first packet header type indication, and the first packet header type indication is used to indicate that the security-protected security mode command message performs security protection based on the security algorithm.

23. The method according to claim 18, characterized in that The determining of the security algorithm comprises: receiving an integrity-protected security mode command message from the network device, wherein the integrity-protected security mode command message includes an identifier of the security algorithm; Determining the security algorithm according to the identifier of the security algorithm; The method further comprises: The integrity-protected security mode command message is integrity verified using the security key as an input key for an integrity-protected portion of the security algorithm.

24. The method according to claim 18, characterized in that The determining of the security algorithm comprises: receiving an integrity-protected security mode command message from the network device, wherein the integrity-protected security mode command message includes an identifier of the security algorithm; Determining the security algorithm according to the identifier of the security algorithm; The method further comprises: Determining a first integrity security protection algorithm according to the security algorithm; The integrity-protected security mode command message is integrity verified based on the first integrity security protection algorithm.

25. The method according to claim 24, characterized in that The performing integrity verification on the integrity-protected security mode command message based on the first integrity security protection algorithm includes: The security key is used as an input key of the first integrity security protection algorithm to perform integrity verification on the integrity-protected security mode command message.

26. The method according to claim 24 or 25, characterized in that The determining a first integrity security protection algorithm according to the security algorithm comprises: The algorithm after the confidentiality protection part in the security algorithm is cleared is used as the first integrity security protection algorithm; or The first integrity security protection algorithm is determined according to the corresponding relationship between the security algorithm and the first integrity security protection algorithm and the security algorithm.

27. The method according to claim 26, characterized in that If the security algorithm is the SNOW-AEAD algorithm, the first integrity security protection algorithm is the SNOW integrity security protection algorithm; or, if the security algorithm is the ZUC-AEAD algorithm, the first integrity security protection algorithm is the ZUC integrity security protection algorithm; or, if the security algorithm is the AES-AEAD algorithm, the first integrity security protection algorithm is the AES integrity security protection algorithm.

28. The method according to claim 18, characterized in that The determining of the security algorithm comprises: receiving an integrity-protected security mode command message from the network device, the integrity-protected security mode command message including an identifier of the security algorithm and an identifier of the second integrity security protection algorithm; The integrity of the integrity-protected security mode command message is verified based on the second integrity security protection algorithm, and the security algorithm is determined according to the identifier of the security algorithm.

29. The method according to claim 18, characterized in that The determining of the security algorithm comprises: receiving an integrity-protected security mode command message from the network device, the integrity-protected security mode command message including an identifier of the third integrity security protection algorithm and second indication information, the second indication information being used to indicate that a message transmitted after the security mode command message is security-protected based on the security algorithm; The integrity-protected security mode command message is integrity verified based on the third integrity security protection algorithm, and the security algorithm is determined according to the third integrity security protection algorithm.

30. The method according to any one of claims 18 to 29, characterized in that The security algorithm is an authenticated encryption AEAD algorithm with associated data.

31. The method according to any one of claims 18 to 30, characterized in that The security-protected uplink message includes a security mode response message.

32. The method according to any one of claims 18 to 31, characterized in that The security-protected uplink message header includes a second packet header type indication, and the second packet header type indication is used to indicate that the security-protected uplink message is security-protected based on the security algorithm.

33. A communication device, characterized in that: include: One or more functional modules for executing the method according to any one of claims 1 to 17, or one or more functional modules for executing the method according to any one of claims 18 to 32.

34. A communication device, characterized in that: include: A processor, configured to execute a computer program stored in a memory, so that the apparatus performs the method according to any one of claims 1 to 17, or so that the apparatus performs the method according to any one of claims 18 to 32.

35. A computer program product, characterized in that The computer program product comprises instructions for performing the method of any one of claims 1 to 32.

36. A computer-readable storage medium, characterized in that: include: The computer-readable storage medium stores a computer program; when the computer program is executed on a computer, the computer is caused to perform the method according to any one of claims 1 to 32.

37. A chip, characterized in that: The chip is installed in a communication device, and the chip includes a processor and a communication interface. When the processor reads instructions through the communication interface and runs, the communication device executes the method as described in any one of claims 1 to 32.

38. A system, characterized in that: The method comprises a network device and a terminal device, wherein the network device is used to execute the method according to any one of claims 1 to 17, and the terminal device is used to execute the method according to any one of claims 18 to 32.

Images