Security processing method and apparatus, and storage medium

Abstract

Provided in the present disclosure are a security processing method and apparatus, and a storage medium. The security processing method is applied to a terminal, and comprises: on the basis of security-related information, determining a security key corresponding to a target cell, wherein the target cell is a candidate target cell supporting subsequent cell changes. By means of the security processing method and apparatus, and the storage medium provided in the present disclosure, a security key is updated on the basis of security-related information, thereby ensuring a key update in a scenario of subsequent cell changes, avoiding the need to frequently reconfigure configuration information of a candidate target cell for a terminal due to the key update, reducing signaling overheads of an air interface, and reducing the waste of air interface resources.

Description

Security processing method, device and storage medium

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This disclosure claims priority to Chinese patent application number 202311016549.5, filed on August 11, 2023, entitled “Secure Processing Method, Device and Storage Medium,” which is incorporated herein by reference in its entirety. Technical Field

[0003] The present disclosure relates to the field of communication technology, and in particular to a security processing method, device, and storage medium. Background Art

[0004] In the 5th Generation New Radio (5G NR) system, Layer 1 or Layer 2 Triggered Mobility (L1 / L2 Triggered Mobility, LTM) first requires the network device to pre-configure LTM candidate cell configuration information and Layer 1 measurement configuration information for the terminal / user equipment (UE). The UE then performs Layer 1 measurement based on the Layer 1 measurement configuration information and reports the Layer 1 measurement results to the network device. The network device makes a cell change (handover) decision based on the Layer 1 measurement results reported by the UE, and the UE performs a cell change (handover) according to the cell change (handover) command sent by the network device.

[0005] In a continuous cell change scenario, such as a subsequent LTM (Subsequent LTM) with inter-CU cell change or other continuous cell change scenarios with key updates, frequent updates of security keys may lead to waste of air interface resources.

[0006] Summary of the Invention

[0007] The embodiments of the present disclosure provide a security processing method, device, and storage medium to solve the technical problem of air interface resource waste in a continuous cell change scenario in related technologies.

[0008] In a first aspect, an embodiment of the present disclosure provides a security processing method, applied to a terminal, comprising:

[0009] Determine a security key corresponding to the target cell based on the security related information;

[0010] The target cell is a candidate target cell that supports continuous cell change.

[0011] In some embodiments, the security-related information includes one or more of the following:

[0012] Security parameter information;

[0013] Security update instructions;

[0014] first group identification information;

[0015] second group identification information;

[0016] Security key counter list.

[0017] In some embodiments, when the security-related information is security parameter information and / or security update indication information, determining the security key corresponding to the target cell based on the security-related information includes:

[0018] The security key corresponding to the target cell is determined based on the security parameter information and / or security update indication information included in the configuration information of the target cell.

[0019] In some embodiments, the security update indication information includes one or more of the following:

[0020] Information indicating whether a key update is required for this cell change;

[0021] Information indicating whether the value of the security parameter information corresponding to this cell change needs to be increased by one;

[0022] Information indicating whether the value of the security parameter information after the security key update corresponding to this cell change needs to be increased by one.

[0023] In some embodiments, when the security-related information is first group identification information, determining the security key corresponding to the target cell based on the security-related information includes:

[0024] When the first group identification information of the source cell is the same as the first group identification information of the target cell, determining that the security key corresponding to the target cell is the current security key; or,

[0025] When the first group identification information of the source cell is different from the first group identification information of the target cell, the security key is updated to obtain the security key corresponding to the target cell.

[0026] In some embodiments, the method further comprises:

[0027] In a case where the second group identification information of the source cell is different from the second group identification information of the target cell, after the security key is updated, the value of the security parameter information is increased by one; or

[0028] In a case where the second group identification information of the source cell is identical to the second group identification information of the target cell, after the security key is updated, it is determined that the value of the security parameter information remains unchanged.

[0029] In some embodiments, determining a security key corresponding to the target cell based on security-related information includes:

[0030] Determine a security key counter list corresponding to the target cell from the security-related information, or generate a security key counter list corresponding to the target cell based on the security-related information;

[0031] The security key corresponding to the target cell is determined based on the security key counter value of the source cell and the security key counter list corresponding to the target cell.

[0032] In some embodiments, determining the security key corresponding to the target cell based on the security key counter value of the source cell and the security key counter list corresponding to the target cell includes:

[0033] In a case where the security key counter value of the source cell is in the security key counter list corresponding to the target cell, determining that the security key corresponding to the target cell is the current security key; or,

[0034] When the security key counter value of the source cell is not in the security key counter list corresponding to the target cell, the security key is updated to obtain the security key corresponding to the target cell.

[0035] In some embodiments, determining the security key corresponding to the target cell based on the security key counter value of the source cell and the security key counter list corresponding to the target cell includes:

[0036] When the last security key counter value in the security key counter list corresponding to the target cell is equal to the security key counter value of the source cell, determining the security key corresponding to the target cell as the current security key; or

[0037] When the last security key counter value in the security key counter list corresponding to the target cell is greater than the security key counter value of the source cell, the security key is updated to obtain the security key corresponding to the target cell.

[0038] In some embodiments, generating a security key counter list corresponding to the target cell based on the security-related information includes:

[0039] A security key counter list corresponding to the target cell is generated based on the security key counter initial value and the global step size included in the security-related information.

[0040] In some embodiments, the first group identification information or the second group identification information or the security key counter list is included in candidate target cell configuration information.

[0041] In some embodiments, the method further comprises:

[0042] Receive candidate target cell configuration information and / or security-related information sent by the network device.

[0043] In some embodiments, the security-related information is sent by one or more of the following signaling:

[0044] RRC signaling;

[0045] MAC CE signaling;

[0046] DCI signaling.

[0047] In a second aspect, an embodiment of the present disclosure provides a security processing method applied to a network device, including:

[0048] Send candidate target cell configuration information and / or security-related information to the terminal; the security-related information is used to determine the security key corresponding to the target cell; the target cell is a candidate target cell that supports continuous cell change.

[0049] In some embodiments, the security-related information includes one or more of the following:

[0050] Security parameter information;

[0051] Security update instructions;

[0052] first group identification information;

[0053] second group identification information;

[0054] Security key counter list.

[0055] In some embodiments, the security update indication information includes one or more of the following:

[0056] Information indicating whether a key update is required for this cell change;

[0057] Information indicating whether the value of the security parameter information corresponding to this cell change needs to be increased by one;

[0058] Information indicating whether the value of the security parameter information after the key update corresponding to this cell change needs to be increased by one.

[0059] In some embodiments, the security-related information is sent by one or more of the following signaling:

[0060] RRC signaling;

[0061] MAC CE signaling;

[0062] DCI signaling.

[0063] In some embodiments, sending security-related information to the terminal includes:

[0064] Send security-related information to the terminal in one or more of the following situations:

[0065] The core network updates the security key of the target cell based on the AMF key;

[0066] The core network updates the AMF key;

[0067] Traditional switchover, conditional switchover, or dual-active protocol stack switchover occurs.

[0068] In a third aspect, an embodiment of the present disclosure provides a terminal, including a memory, a transceiver, and a processor;

[0069] A memory for storing a computer program; a transceiver for transmitting and receiving data under the control of the processor; and a processor for reading the computer program in the memory and performing the following operations:

[0070] Determine a security key corresponding to the target cell based on the security related information;

[0071] The target cell is a candidate target cell that supports continuous cell change.

[0072] In some embodiments, the security-related information includes one or more of the following:

[0073] Security parameter information;

[0074] Security update instructions;

[0075] first group identification information;

[0076] second group identification information;

[0077] Security key counter list.

[0078] In some embodiments, when the security-related information is security parameter information and / or security update indication information, determining the security key corresponding to the target cell based on the security-related information includes:

[0079] The security key corresponding to the target cell is determined based on the security parameter information and / or security update indication information included in the configuration information of the target cell.

[0080] In some embodiments, the security update indication information includes one or more of the following:

[0081] Information indicating whether a key update is required for this cell change;

[0082] Information indicating whether the value of the security parameter information corresponding to this cell change needs to be increased by one;

[0083] Information indicating whether the value of the security parameter information after the security key update corresponding to this cell change needs to be increased by one.

[0084] In some embodiments, when the security-related information is first group identification information, determining the security key corresponding to the target cell based on the security-related information includes:

[0085] When the first group identification information of the source cell is the same as the first group identification information of the target cell, determining that the security key corresponding to the target cell is the current security key; or,

[0086] When the first group identification information of the source cell is different from the first group identification information of the target cell, the security key is updated to obtain the security key corresponding to the target cell.

[0087] In some embodiments, the processor is further configured to read the computer program in the memory and perform the following operations:

[0088] In a case where the second group identification information of the source cell is different from the second group identification information of the target cell, after the security key is updated, the value of the security parameter information is increased by one; or

[0089] In a case where the second group identification information of the source cell is identical to the second group identification information of the target cell, after the security key is updated, it is determined that the value of the security parameter information remains unchanged.

[0090] In some embodiments, determining a security key corresponding to the target cell based on security-related information includes:

[0091] Determine a security key counter list corresponding to the target cell from the security-related information, or generate a security key counter list corresponding to the target cell based on the security-related information;

[0092] The security key corresponding to the target cell is determined based on the security key counter value of the source cell and the security key counter list corresponding to the target cell.

[0093] In some embodiments, determining the security key corresponding to the target cell based on the security key counter value of the source cell and the security key counter list corresponding to the target cell includes:

[0094] In a case where the security key counter value of the source cell is in the security key counter list corresponding to the target cell, determining that the security key corresponding to the target cell is the current security key; or,

[0095] When the security key counter value of the source cell is not in the security key counter list corresponding to the target cell, the security key is updated to obtain the security key corresponding to the target cell.

[0096] In some embodiments, determining the security key corresponding to the target cell based on the security key counter value of the source cell and the security key counter list corresponding to the target cell includes:

[0097] When the last security key counter value in the security key counter list corresponding to the target cell is equal to the security key counter value of the source cell, determining the security key corresponding to the target cell as the current security key; or

[0098] When the last security key counter value in the security key counter list corresponding to the target cell is greater than the security key counter value of the source cell, the security key is updated to obtain the security key corresponding to the target cell.

[0099] In some embodiments, generating a security key counter list corresponding to the target cell based on the security-related information includes:

[0100] A security key counter list corresponding to the target cell is generated based on the security key counter initial value and the global step size included in the security-related information.

[0101] In some embodiments, the first group identification information or the second group identification information or the security key counter list is included in candidate target cell configuration information.

[0102] In some embodiments, the processor is further configured to read the computer program in the memory and perform the following operations:

[0103] Receive candidate target cell configuration information and / or security-related information sent by the network device.

[0104] In some embodiments, the security-related information is sent by one or more of the following signaling:

[0105] RRC signaling;

[0106] MAC CE signaling;

[0107] DCI signaling.

[0108] In a fourth aspect, an embodiment of the present disclosure provides a network device, including a memory, a transceiver, and a processor;

[0109] A memory for storing a computer program; a transceiver for transmitting and receiving data under the control of the processor; and a processor for reading the computer program in the memory and performing the following operations:

[0110] Send candidate target cell configuration information and / or security-related information to the terminal; the security-related information is used to determine the security key corresponding to the target cell; the target cell is a candidate target cell that supports continuous cell change.

[0111] In some embodiments, the security-related information includes one or more of the following:

[0112] Security parameter information;

[0113] Security update instructions;

[0114] first group identification information;

[0115] second group identification information;

[0116] Security key counter list.

[0117] In some embodiments, the security update indication information includes one or more of the following:

[0118] Information indicating whether a key update is required for this cell change;

[0119] Information indicating whether the value of the security parameter information corresponding to this cell change needs to be increased by one;

[0120] Information indicating whether the value of the security parameter information after the key update corresponding to this cell change needs to be increased by one.

[0121] In some embodiments, the security-related information is sent by one or more of the following signaling:

[0122] RRC signaling;

[0123] MAC CE signaling;

[0124] DCI signaling.

[0125] In some embodiments, sending security-related information to the terminal includes:

[0126] Send security-related information to the terminal in one or more of the following situations:

[0127] The core network updates the security key of the target cell based on the AMF key;

[0128] The core network updates the AMF key;

[0129] Traditional switchover, conditional switchover, or dual-active protocol stack switchover occurs.

[0130] In a fifth aspect, an embodiment of the present disclosure provides a secure processing device, including:

[0131] A determination module, configured to determine a security key corresponding to a target cell based on security-related information;

[0132] The target cell is a candidate target cell that supports continuous cell change.

[0133] In some embodiments, the security-related information includes one or more of the following:

[0134] Security parameter information;

[0135] Security update instructions;

[0136] first group identification information;

[0137] second group identification information;

[0138] Security key counter list.

[0139] In some embodiments, when the security-related information is security parameter information and / or security update indication information, the determining module includes:

[0140] The first determining unit is configured to determine a security key corresponding to the target cell based on the security parameter information and / or security update indication information included in the configuration information of the target cell.

[0141] In some embodiments, the security update indication information includes one or more of the following:

[0142] Information indicating whether a key update is required for this cell change;

[0143] Information indicating whether the value of the security parameter information corresponding to this cell change needs to be increased by one;

[0144] Information indicating whether the value of the security parameter information after the security key update corresponding to this cell change needs to be increased by one.

[0145] In some embodiments, when the security-related information is first group identification information, the determining module includes:

[0146] A second determining unit is configured to, when the first group identification information of the source cell is the same as the first group identification information of the target cell, determine that the security key corresponding to the target cell is the current security key; or

[0147] The acquiring unit is configured to update the security key when the first group identification information of the source cell is different from the first group identification information of the target cell, and obtain the security key corresponding to the target cell.

[0148] In some embodiments, the determining module further includes:

[0149] a calculation unit, configured to, when the second group identification information of the source cell is different from the second group identification information of the target cell, increase the value of the security parameter information by one after updating the security key; or

[0150] The third determining unit is configured to determine that the value of the security parameter information remains unchanged after the security key is updated when the second group identification information of the source cell is the same as the second group identification information of the target cell.

[0151] In some embodiments, the determining module includes:

[0152] a fourth determining unit, configured to determine a security key counter list corresponding to the target cell from the security-related information, or to generate a security key counter list corresponding to the target cell based on the security-related information;

[0153] The fifth determining unit is configured to determine the security key corresponding to the target cell based on the security key counter value of the source cell and the security key counter list corresponding to the target cell.

[0154] In some embodiments, the fifth determining unit includes:

[0155] A first determining subunit is configured to, when the security key counter value of the source cell is in the security key counter list corresponding to the target cell, determine that the security key corresponding to the target cell is the current security key; or

[0156] The first acquisition subunit is configured to update the security key if the security key counter value of the source cell is not in the security key counter list corresponding to the target cell, and obtain the security key corresponding to the target cell.

[0157] In some embodiments, the fifth determining unit includes:

[0158] A second determining subunit is configured to determine, when the last security key counter value in the security key counter list corresponding to the target cell is equal to the security key counter value of the source cell, that the security key corresponding to the target cell is the current security key; or

[0159] The second acquisition subunit is configured to update the security key to obtain the security key corresponding to the target cell when the last security key counter value in the security key counter list corresponding to the target cell is greater than the security key counter value of the source cell.

[0160] In some embodiments, the fourth determining unit includes:

[0161] The third acquisition subunit is configured to generate a security key counter list corresponding to the target cell based on the security key counter initial value and the global step size included in the security-related information.

[0162] In some embodiments, the first group identification information or the second group identification information or the security key counter list is included in candidate target cell configuration information.

[0163] In some embodiments, further comprising:

[0164] The receiving module is configured to receive candidate target cell configuration information and / or security-related information sent by a network device.

[0165] In some embodiments, the security-related information is sent by one or more of the following signaling:

[0166] RRC signaling;

[0167] MAC CE signaling;

[0168] DCI signaling.

[0169] In a sixth aspect, an embodiment of the present disclosure provides a secure processing device, including:

[0170] The sending module is used to send candidate target cell configuration information and / or security related information to the terminal; the security related information is used to determine the security key corresponding to the target cell; the target cell is a candidate target cell that supports continuous cell change.

[0171] In some embodiments, the security-related information includes one or more of the following:

[0172] Security parameter information;

[0173] Security update instructions;

[0174] first group identification information;

[0175] second group identification information;

[0176] Security key counter list.

[0177] In some embodiments, the security update indication information includes one or more of the following:

[0178] Information indicating whether a key update is required for this cell change;

[0179] Information indicating whether the value of the security parameter information corresponding to this cell change needs to be increased by one;

[0180] Information indicating whether the value of the security parameter information after the key update corresponding to this cell change needs to be increased by one.

[0181] In some embodiments, the security-related information is sent by one or more of the following signaling:

[0182] RRC signaling;

[0183] MAC CE signaling;

[0184] DCI signaling.

[0185] In some embodiments, the sending module includes:

[0186] A sending unit is configured to send security-related information to a terminal in one or more of the following situations:

[0187] The core network updates the security key of the target cell based on the AMF key;

[0188] The core network updates the AMF key;

[0189] Traditional switchover, conditional switchover, or dual-active protocol stack switchover occurs.

[0190] In the seventh aspect, an embodiment of the present disclosure further provides a non-transitory readable storage medium, which stores a computer program, and the computer program is used to enable a processor to execute the security processing method described in the first aspect or the second aspect above.

[0191] In an eighth aspect, an embodiment of the present disclosure further provides a processor-readable storage medium, wherein the processor-readable storage medium stores a computer program, and the computer program is used to enable the processor to execute the security processing method described in the first aspect or the second aspect above.

[0192] In a ninth aspect, an embodiment of the present disclosure further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and the computer program is used to enable a computer to execute the security processing method described in the first aspect or the second aspect above.

[0193] In a tenth aspect, an embodiment of the present disclosure further provides a communication device, in which a computer program is stored, and the computer program is used to enable the communication device to execute the security processing method described in the first aspect or the second aspect above.

[0194] In the eleventh aspect, an embodiment of the present disclosure further provides a chip product, wherein a computer program is stored in the chip product, and the computer program is used to enable the chip product to execute the security processing method described in the first aspect or the second aspect above.

[0195] The security processing method, device and storage medium provided by the embodiments of the present disclosure determine the security key corresponding to the target cell based on security-related information. The target cell is a candidate target cell that supports continuous cell changes, ensuring key updates in continuous cell change scenarios, avoiding the need to frequently reconfigure candidate target cell configuration information to the terminal due to key updates, and reducing the waste of air interface resources. BRIEF DESCRIPTION OF THE DRAWINGS

[0196] In order to more clearly illustrate the technical solutions in the embodiments of the present disclosure or related technologies, the following is a brief introduction to the drawings required for use in the embodiments or related technical descriptions. Obviously, the drawings described below are some embodiments of the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0197] FIG1 is a schematic diagram of a flow chart of a security processing method according to an embodiment of the present disclosure;

[0198] FIG2 is a second flow chart of the security processing method provided by an embodiment of the present disclosure;

[0199] FIG3 is a schematic structural diagram of a terminal provided by an embodiment of the present disclosure;

[0200] FIG4 is a schematic diagram of the structure of a network device provided by an embodiment of the present disclosure;

[0201] FIG5 is a schematic diagram of a structure of a secure processing device according to an embodiment of the present disclosure;

[0202] FIG6 is a second structural diagram of a secure processing device provided in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0203] For intra-CU LTM, the key used by the terminal remains unchanged after the cell change. Subsequent LTM is supported in the intra-CU scenario, that is, the network pre-configures LTM candidate cells. After executing LTM once, the UE can continue to maintain the candidate target cell configuration information for subsequent LTM, which can avoid the network reconfiguring or reinitializing LTM every time.

[0204] For inter-CU LTM, since the key used by the terminal may change after the cell changes, it is necessary to frequently reconfigure the configuration information of the candidate target cell to the UE, resulting in a waste of air interface resources.

[0205] In addition, considering coexistence scenarios, such as intra-CU and inter-CU scenarios, the UE cannot know under what circumstances the key needs to be updated (inter-CU) and under what circumstances the key does not need to be updated (intra-CU). Therefore, the LTM network device and the UE need to update the key every time. After the UE accesses the target cell, the new key is used to interact with the target cell for signaling / data, even in cases where a key update is not required, such as an intra-CU cell change. This will lead to unnecessary key updates and some data interruptions caused by the key update. The above problems exist on the Master Cell Group (MCG) side and the Secondary Cell Group (SCG) side.

[0206] To support continuous LTM and ensure that the network does not reconfigure the target cell configuration information due to key issues after each LTM, a certain solution is needed on how the UE side and the network side derive new keys to ensure that the UE is not frequently reconfigured due to key changes.

[0207] To ensure continuous cell changes while reducing unnecessary key updates and unnecessary data interruptions caused by key updates, the UE also needs to know when to update the key (inter-CU) and when not to update the key (intra-CU).

[0208] Based on the above technical problems, an embodiment of the present disclosure proposes a security processing method, which determines the security key corresponding to the target cell based on security-related information, wherein the target cell is a candidate target cell that supports continuous cell changes, ensuring key updates in continuous cell change scenarios, avoiding the need for frequent RRC reconfiguration or reinitialization of LTM due to key updates, reducing signaling overhead, and reducing waste of air interface resources.

[0209] To make the objectives, technical solutions, and advantages of the embodiments of the present disclosure more clear, the technical solutions in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present disclosure, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present disclosure without making any creative efforts shall fall within the scope of protection of the present disclosure.

[0210] FIG1 is a flow chart of a security processing method provided by an embodiment of the present disclosure. As shown in FIG1 , an embodiment of the present disclosure provides a security processing method, the execution subject of which may be a terminal, such as a mobile phone. The method includes:

[0211] Step 101: The UE determines a security key corresponding to a target cell based on security-related information; the target cell is a candidate target cell that supports continuous cell change.

[0212] Specifically, the security-related information is information used to determine a security key corresponding to the target cell. The security key corresponding to the target cell refers to a key used by the terminal to perform signaling and / or data exchange with the target cell after accessing the target cell.

[0213] In an embodiment of the present disclosure, the security-related information is carried in the cell change command, or is received by the network device before executing the cell change, or is received by the network device after successfully accessing the target cell, or is included in the configuration information of the candidate target cell pre-configured by the network device.

[0214] The target cell is a candidate target cell that supports continuous cell change. Continuous cell change means that the terminal can continue to perform subsequent cell changes after performing the cell change (can continue to perform cell changes among the configured candidate target cells) without reconfiguration or reinitialization, such as continuous LTM.

[0215] For example, the source base station sends a cell change command to the UE, which contains security-related information. The UE receives the cell change command and determines whether it is necessary to update the key and / or how to update the key based on the security-related information. If necessary, it calculates a new security key and uses the new key as the security key corresponding to the target cell.

[0216] For another example, before the source base station sends a cell change command, it sends security-related information to the UE. The UE determines whether it needs to update the key and / or how to update the key based on the security-related information. If necessary, it calculates a new security key and uses the new key as the security key corresponding to the target cell.

[0217] For another example, after the UE accesses the target cell, the target base station sends security-related information to the UE. After receiving the security-related information sent by the target base station, the UE determines whether a key needs to be updated for this cell change or the next cell change based on the security-related information. If necessary, the UE calculates a new security key and uses the new key as the security key corresponding to the target cell (this target cell is the target cell for this cell change or the next cell change).

[0218] For another example, before the initial cell change, the network device configures the configuration information of each candidate target cell for the UE, where security-related information is carried in the configuration information of the corresponding candidate target cell. Each subsequent time the UE performs a cell change, it obtains the security-related information of the target cell from the candidate target cell configuration information pre-configured by the network before the initial cell change, and determines whether and / or how to update the key based on the security-related information. If necessary, it calculates a new security key as the security key corresponding to the target cell.

[0219] It should be noted that whether the key needs to be updated is determined by the network side, and the UE learns whether to update the key based on security-related information.

[0220] The security processing method provided by the embodiment of the present disclosure determines the security key corresponding to the target cell based on security-related information. The target cell is a candidate target cell that supports continuous cell changes, and realizes key update in the continuous cell change scenario, so that the UE continues to maintain the candidate target cell configuration information after executing the cell change to perform subsequent cell changes, avoiding frequent reconfiguration or reinitialization operations due to key updates, reducing signaling overhead and reducing waste of air interface resources.

[0221] In some embodiments, the security-related information includes one or more of the following:

[0222] Security parameter information;

[0223] Security update instructions;

[0224] first group identification information;

[0225] second group identification information;

[0226] Security key counter list.

[0227] Specifically, the security-related information includes security parameter information, and the security parameter information may be a next hop chaining count (NCC), which is used to obtain a security key.

[0228] The security update indication information is used to indicate whether a key update is required for this cell change, and / or whether the value of the security parameter information corresponding to this cell change needs to be increased by one, and / or whether the value of the security parameter information after the security key corresponding to this cell change is updated needs to be increased by one.

[0229] In an embodiment of the present disclosure, the security parameter information or the security update indication information can be sent to the UE by being carried in the cell change command when performing the cell change, or can be sent to the UE before performing the cell change, or can be sent to the UE after successfully accessing the target cell.

[0230] Specifically, the first group identification information is used to determine whether key update is required. The first group identification information value of the candidate target cell under each secondary base station / secondary node (SN) is the same, and the candidate target cells under different SNs are configured with different first group identification information values.

[0231] In the disclosed embodiment, the first group identification information may be information obtained by concatenating two identification information. For example, the first group identification information may be composed of base station (gNB) identification information / CU identification information / control plane central unit (CU-CP) identification information / core network (CN) identification information as the first part, and user plane central unit (CU-UP) identification information, such as a security domain ID, as the second part.

[0232] If there is only gNB identification information / CN identification information / CU identification information / CU-CP identification information, and no CU-UP identification information, the first group identification information may be gNB identification information / CN identification information / CU identification information / CU-CP identification information.

[0233] Specifically, the second group identification information is used to determine whether the security parameter information needs to be increased by one after the key is updated.

[0234] In the embodiment of the present disclosure, the second group identification information may be gNB identification information / CN identification information / CU identification information / CU-CP identification information.

[0235] In some cases, when there is only one identification information, the first group identification information and the second group identification information are the same information. Alternatively, in some cases, the first group identification information and the second group identification information are the same, i.e., there is only one group identification information, not two group identification information. For example, there is only gNB identification information / CN identification information / CU identification information / CU-CP identification information. This identification information can be used in such a way that when the source cell and target cell have the same identification information, the UE determines that a key update is not required; if they are different, the UE determines that a key update is required, and after the key update, the security parameter information (NCC value) maintained by the UE needs to be incremented by one.

[0236] Specifically, there are multiple security key counter values ​​(sk-counter) in the security key counter list (sk-counter list). The security key counter lists of candidate target cells under the same SN are the same, the security key counter lists of candidate target cells under different SNs are different, and there are no repeated security key counter values ​​in the security key counter lists of candidate target cells under different SNs.

[0237] In particular, the security key counter list here may be calculated based on the security key counter initial value and the global step size, and the security-related information may include the security key counter initial value and the global step size configuration information.

[0238] The security processing method provided by the embodiment of the present disclosure provides a variety of security-related information for determining security keys, and can flexibly select one or more of them for judgment and calculation of key updates in different scenarios, avoiding the reconfiguration or reinitialization operations brought about by each key update, reducing signaling overhead, and reducing the waste of air interface resources.

[0239] In some embodiments, the security-related information is sent by one or more of the following signaling:

[0240] RRC signaling;

[0241] MAC CE signaling;

[0242] DCI signaling.

[0243] In the embodiment of the present disclosure, the security-related information may be sent via a downlink control information (DCI) command, a media access control control element (MAC CE) command, or a radio resource control (RRC) signaling. The security-related information may be sent via the same signaling as the candidate target cell configuration information, or may be sent via different signaling.

[0244] In some embodiments, when the security-related information is security parameter information and / or security update indication information, determining the security key corresponding to the target cell based on the security-related information includes:

[0245] The security key corresponding to the target cell is determined based on the security parameter information and / or security update indication information included in the configuration information of the target cell.

[0246] Specifically, if the configuration information of the target cell applied by the UE during this cell change includes received security parameter information, the security parameter information is the security-related information, and the UE determines whether to update the key based on the security parameter information. The target cell configuration information refers to the configuration information applied by the UE, which may include candidate target cell configuration information and / or security-related information. The candidate target cell configuration information and security-related information may be sent in the same signaling or in different signalings.

[0247] If the target cell configuration information applied by the UE during this cell change includes received security update indication information, the security update indication information is the security-related information, and the UE determines whether to update the key based on the security update indication information. The target cell configuration information refers to the configuration information applied by the UE, which may include candidate target cell configuration information and / or security-related information. The candidate target cell configuration information and security-related information may be sent in the same signaling or in separate signaling messages.

[0248] For example, the UE obtains security parameter information from the configuration information of the target cell, and then the UE derives a new security key based on the security parameter information to obtain the security key corresponding to the target cell.

[0249] For another example, if the UE does not receive the security parameter information sent by the network device, the UE continues to use the current security key as the security key corresponding to the target cell.

[0250] When the UE receives security parameter information, the UE compares the security parameter information with the NCC value corresponding to the current security key generated by the UE. If they are the same, the UE uses the horizontal key derivation method to derive the new key, and the calculation method is to use the UE's current security key, the PCI of the target cell, and the absolute frequency of the target cell to derive the new security key; if they are different, the UE uses the vertical key derivation method to derive the new security key, and the calculation method is to use the NH value, the PCI of the target cell, and the absolute frequency of the target cell to derive the new security key.

[0251] For another example, the UE obtains security update indication information from the configuration information of the target cell, and the UE determines whether the key needs to be updated based on the security update indication information. If necessary, the UE derives a new security key to obtain the security key corresponding to the target cell.

[0252] For another example, if the UE does not receive the security update indication information sent by the network device, the UE continues to use the current security key as the security key corresponding to the target cell.

[0253] When the UE receives security update indication information indicating that the value of the security parameter information corresponding to this cell change does not need to be increased by one, the UE uses the horizontal key derivation method to derive a new security key for this cell change, and the calculation method is to use the UE's current security key, the PCI of the target cell, and the absolute frequency of the target cell to derive the new security key; otherwise, that is, when the UE receives security update indication information indicating that the value of the security parameter information corresponding to this cell change needs to be increased by one, the UE uses the vertical key derivation method to derive the new security key for this cell change, and the calculation method is to use the NH value, the PCI of the target cell, and the absolute frequency of the target cell to derive the new security key.

[0254] When the UE receives information indicating that the value of the security parameter information does not need to be increased by one after the security key corresponding to this cell change is updated, one situation is that this means that the next cell change will be to derive a new security key using the horizontal key derivation method (if a new security key needs to be derived), that is, the next time the UE changes the cell, (optionally) the UE compares the NCC value corresponding to the generation of the current source cell security key with the NCC value currently stored in the UE. If they are the same, the UE determines that the new security key is to be derived using the horizontal method. The calculation method of the horizontal key derivation method is that the UE uses the key of the current cell, the PCI value of the target cell, and the absolute frequency information of the target cell to calculate and derive the new security key.

[0255] When the UE receives information indicating that the value of the security parameter information needs to be increased by one after the security key corresponding to this cell change is updated, one situation is that this means that the next cell change is to derive a new security key using a vertical key derivation method (if a new security key needs to be derived), that is, the next time the UE changes the cell, (optionally) the UE compares the NCC value corresponding to the generation of the current source cell security key with the NCC value currently stored in the UE. If they are different, the UE determines that the new security key is to be derived vertically. The calculation method of the vertical key derivation method is that the UE uses the NH value, the PCI value of the target cell, and the absolute frequency information of the target cell to calculate and derive the new security key.

[0256] The following further illustrates the security processing method provided in the above embodiment through specific examples:

[0257] Example 1:

[0258] The network device sends security parameter information to the UE when the cell changes.

[0259] Step 1: The network device configures the configuration information of candidate target cells supporting continuous cell change for the UE.

[0260] Step 2: The network device sends a cell change command to the UE, notifying the UE to perform the cell change, and the network device sends security parameter information (such as NCC value) to the UE.

[0261] The security parameter information may be sent via a DCI command, a MAC CE command, or an RRC signaling.

[0262] The security parameter information may be sent by the source cell to the UE in the cell change command, or the security parameter information may be sent by the source cell to the UE before the UE receives the cell change command, or the security parameter information may be sent by the target cell to the UE after the UE accesses the target cell.

[0263] The security parameter information and the candidate target cell configuration information may be sent to the UE via the same signaling or different signaling.

[0264] Step 3: The UE derives a new security key (the security key corresponding to the target cell) based on the received security parameter information; if the UE does not receive the security parameter information sent by the network, the UE will continue to use the old key.

[0265] Step 4: The source base station sends the new security key and / or security parameter information to the target base station via interface signaling.

[0266] It should be noted that there is no time sequence restriction between step 4 and any of steps 1, 2, and 3, that is, step 4 can be executed at any time.

[0267] Step 5: After accessing the target cell, the UE uses the new security key to exchange signaling / data with the target cell; or, if the UE does not receive the security parameter information sent by the network, the UE continues to use the old key to exchange signaling / data with the target cell after accessing the target cell;

[0268] Step 6: After executing the cell change command, the UE continues to maintain the configuration information of the continuous cell change for subsequent cell changes.

[0269] In addition, after the UE successfully accesses the target cell, the target cell also sends this security parameter information to the UE for subsequent cell changes. If the UE learns that the subsequent cell change requires a key update, the UE uses the security parameter information received in the target cell to derive a new security key.

[0270] In some embodiments, the security update indication information includes one or more of the following:

[0271] Information indicating whether a key update is required for this cell change;

[0272] Information indicating whether the value of the security parameter information corresponding to this cell change needs to be increased by one;

[0273] Information indicating whether the value of the security parameter information after the security key update corresponding to this cell change needs to be increased by one.

[0274] Specifically, the security update indication information may include information indicating whether a key update is required for this cell change, and / or information indicating whether the value of the security parameter information corresponding to this cell change needs to be increased by one, and / or information indicating whether the value of the security parameter information after the security key corresponding to this cell change is updated needs to be increased by one.

[0275] For example, if the security update indication information received by the UE is 0, then the key update is not required for this cell change; if the security update indication information received by the UE is 1, then the key update is required for this cell change.

[0276] For another example, if the security update indication information received by the UE is 0, the value of the security parameter information corresponding to this cell change does not need to be increased by one; if the security update indication information received by the UE is 1, the value of the security parameter information corresponding to this cell change needs to be increased by one.

[0277] For another example, if the security update indication information received by the UE is 0, then the value of the security parameter information does not need to be increased by one after the security key is updated for this cell change; if the security update indication information received by the UE is 1, then the value of the security parameter information needs to be increased by one after the security key is updated for this cell change.

[0278] The following further illustrates the security processing method provided in the above embodiment through specific examples:

[0279] Example 2:

[0280] The network sends security update indication information to the UE when the cell changes.

[0281] Step 1: The network device configures the configuration information of candidate target cells supporting continuous cell change for the UE.

[0282] Step 2: The network sends a cell change command to the UE, notifying the UE to perform the cell change, and the network sends a security update indication message to the UE.

[0283] The security update indication information includes one or more of the following:

[0284] Information indicating whether a key update is required for this cell change;

[0285] Information indicating whether the value of the security parameter information corresponding to this cell change needs to be increased by one;

[0286] Information indicating whether the value of the security parameter information after the security key update corresponding to this cell change needs to be increased by one.

[0287] In addition, the security update indication information can be sent via a DCI command, a MAC CE command, or RRC signaling.

[0288] The security update indication information may be sent by the source cell to the UE in the cell change command, or the security update indication information may be sent by the source cell to the UE before the UE receives the cell change command, or the security update indication information may be sent by the target cell to the UE after the UE accesses the target cell.

[0289] The security update indication information and the candidate target cell configuration information may be sent to the UE via the same signaling or different signaling.

[0290] Step 3: The UE determines whether a key update is required and how to derive a new security key based on the received security update indication information. If a key update is required, the UE derives a new security key based on the security update indication information. The method for the UE to derive a new security key is as follows:

[0291] The UE maintains a security parameter information (NCC value): If the security update indication information indicates that the security parameter information remains unchanged, the UE will use the first method (such as the horizontal key derivation method) to derive the key, that is, based on the current security key, the physical cell identifier (PCI) of the target cell, and the absolute frequency information to calculate a new security key, and maintain the security parameter information (NCC value) unchanged.

[0292] If the security update indication information indicates that the security parameter information is increased by one, the UE will use the second method (such as the vertical key derivation method) to derive the key, that is, calculate the new security key based on the next hop (NH) parameter value, the PCI of the target cell, and the absolute frequency information, and increase the security parameter information (NCC value) maintained by the UE by one.

[0293] Step 3a: If the UE does not receive the security update indication message sent by the network, the UE will continue to use the old key.

[0294] Step 4: The source base station derives a new security key, and sends the new security key and / or security parameter information to the target base station via interface signaling.

[0295] It should be noted that there is no time sequence restriction between step 4 and any of steps 1, 2, and 3, that is, step 4 can be executed at any time.

[0296] Step 5: After accessing the target cell, the UE uses the new security key to perform signaling / data interaction with the target cell; or continues to use the old key to perform signaling / data interaction with the target cell.

[0297] Step 6: After executing the cell change command, the UE continues to maintain the configuration information of the candidate target cells supporting continuous cell changes for subsequent cell changes.

[0298] In addition, the method for the UE to derive a new security key based on the security update indication information may further include:

[0299] The UE maintains a security parameter information (NCC value): After the UE successfully accesses the target cell, the target cell sends this security update indication information to the UE. The UE decides whether to keep the security parameter information (NCC value) unchanged or increase the security parameter information (NCC value) by one based on the security update indication information, and uses this security parameter information for subsequent cell changes. If the UE learns that the subsequent cell change requires a key update, the UE derives a new security key based on the maintained security parameter information (NCC value). This security update indication information is: information indicating whether the security parameter information needs to be increased by one after the security key corresponding to this cell change is updated.

[0300] The security processing method provided by the embodiment of the present disclosure determines whether to perform a key update based on security parameter information or security update indication information, and then determines the security key corresponding to the target cell, thereby avoiding the reconfiguration or reinitialization operations caused by each key update, reducing signaling overhead, and realizing continuous cell changes in various scenarios.

[0301] Example 3:

[0302] Network equipment reconfigures security-related parameters after a cell change.

[0303] Step 1: The source base station sends new security keys and / or security parameter information (NCC value) to the target base station through interface signaling.

[0304] Step 2: The network device configures the configuration information of the candidate target cell supporting continuous cell change (including security-related parameters) for the UE.

[0305] The network device configures security-related parameters only for candidate target cells that require a key change when performing a cell change from the current source cell to the target cell, and does not configure security-related parameters for other candidate target cells.

[0306] Step 3: The network device sends a cell change command to the UE, notifying the UE to perform the cell change.

[0307] Step 4: The UE derives a new security key based on the security-related parameters of the target cell in the candidate target cell configuration information pre-configured by the network.

[0308] Step 4a: If no security-related parameters are configured for the target cell in the continuous cell change configuration information, the UE continues to use the old key.

[0309] Step 5: After accessing the target cell, the UE uses the new security key to exchange signaling / data with the target cell; or continues to use the old key to exchange signaling / data with the target cell;

[0310] Step 6: After executing the cell change command, the UE continues to maintain the configuration information of the candidate target cells supporting continuous cell changes for subsequent cell changes.

[0311] Step 7: The target cell reconfigures security-related parameters for the UE for subsequent cell changes. Step 7 is optional and can be omitted if the network finds that no security-related parameters need to be updated. The security-related parameters include one or more of the following:

[0312] keySetChangeIndicator;

[0313] NCC;

[0314] Parameter: nas-Container.

[0315] It should be noted that the target cell reconfiguration of security-related parameters also follows the same rule: security-related parameters are only configured for candidate target cells that need to update keys when performing cell change, and security-related parameters are not configured for other candidate target cells.

[0316] The network device can reconfigure security-related parameters using DCI commands, MAC CE commands, or RRC signaling.

[0317] It is also necessary to send the new / old security parameter information (NCC value) and / or the new security key to the corresponding target base station through interface signaling.

[0318] In addition, the subsequent cell change process may involve interface signaling interaction, and the source base station needs to send the candidate target cell configuration information to the target base station through interface signaling.

[0319] In some embodiments, when the security-related information is first group identification information, determining the security key corresponding to the target cell based on the security-related information includes:

[0320] When the first group identification information of the source cell is the same as the first group identification information of the target cell, determining that the security key corresponding to the target cell is the current security key; or,

[0321] When the first group identification information of the source cell is different from the first group identification information of the target cell, the security key is updated to obtain the security key corresponding to the target cell.

[0322] Specifically, by comparing the security related information corresponding to the source cell and the target cell, ie, the first group identification information, it is determined whether the key update is required.

[0323] For example, compare the first group identification information of the source cell with the first group identification information of the target cell. If they are the same, it is determined that there is no need to update the key during this cell change, and continue to use the old key, that is, the current security key, as the security key corresponding to the target cell.

[0324] For another example, the first group identification information of the source cell is compared with the first group identification information of the target cell. If they are different, the key needs to be updated during this cell change.

[0325] The following further illustrates the security processing method provided in the above embodiment through specific examples:

[0326] Example 4:

[0327] Each time the cell changes, the UE calculates a new security key on its own.

[0328] Step 1: The network device configures the configuration information and / or security-related information of the candidate target cell supporting continuous cell change for the UE.

[0329] The security-related information includes first group identification information configured for each candidate target cell, and the first group identification information is used by the UE to determine whether a key update is required each time a cell change is performed.

[0330] Step 2: The network sends a cell change command to the UE, informing the UE to perform the cell change.

[0331] Step 3: The UE determines whether a key needs to be updated during this cell change based on the first group identification information of the source cell and the target cell, which is divided into at least one of the following situations:

[0332] If the first group identification information of the source cell and the target cell is the same, the UE does not need to update the key during this cell change;

[0333] If the first group identification information of the source cell and the target cell is different, the UE needs to update the key and derive a new security key during this cell change.

[0334] Step 4: After executing the cell change command, the UE continues to maintain the configuration information of the candidate target cells supporting continuous cell changes for subsequent cell changes.

[0335] Step 5: If the key needs to be updated, the source base station sends the new security key and / or security parameter information (NCC value) to the target base station.

[0336] It should be noted that there is no restriction on the time sequence between any step from step 1 to step 4 and step 5, that is, step 5 can be executed at any time.

[0337] Example 5:

[0338] Each time the cell changes, the UE determines whether a key update is required based on the first group identification information.

[0339] First, the network device configures a first group identification information for each candidate cell, such as configuring the same first group identification information value for each candidate cell under each SN, and configuring different first group identification information values ​​for candidate cells under different SNs.

[0340] When the UE performs a cell change on the SCG side, the UE determines whether the source primary secondary cell (PSCell) and the target PSCell have the same first group identification information: if the first group identification information of the source PSCell and the target PSCell are the same, it indicates that the source cell and the target cell are under the same SN, and there is no need to update the key when performing a cell change from the source cell to the target cell.

[0341] If the first group identification information of the source PSCell cell and the target PSCell cell is different, it indicates that the source cell and the target cell are cells under different SNs. The key needs to be updated when performing a cell change from the source cell to access the target cell. The UE calculates a new security key counter (sk-counter) value and generates a new SCG side security key through the MCG side security key and the new sk-counter value, which is used for signaling / data interaction between the UE and the target PSCell after accessing the target PSCell.

[0342] The security processing method provided by the embodiment of the present disclosure uses the first group identification information as security-related information, so that the UE can determine whether to update the key and calculate the new security key based on the first group identification information of the source cell and the first group identification information of the target cell.

[0343] In some embodiments, the method further comprises:

[0344] In a case where the second group identification information of the source cell is different from the second group identification information of the target cell, after the security key is updated, the value of the security parameter information is increased by one; or

[0345] In a case where the second group identification information of the source cell is identical to the second group identification information of the target cell, after the security key is updated, it is determined that the value of the security parameter information remains unchanged.

[0346] Specifically, after comparing and determining that the first group identification information of the source cell is different from the first group identification information of the target cell, it is determined that the security key needs to be updated, and then the second group identification information of the source cell is compared and determined whether it is the same as the second group identification information of the target cell, so as to determine whether the security parameter information needs to be changed after the security key is updated.

[0347] For example, if the first group identification information of the source cell is different from the first group identification information of the target cell, the UE determines that a key update is required. If a comparison shows that the second group identification information of the source cell is different from the second group identification information of the target cell, the UE increases the value of the security parameter information by one after the key update.

[0348] For another example, if the first group identification information of the source cell is different from the first group identification information of the target cell, the UE determines that a key update is required. If a comparison is then performed and the second group identification information of the source cell is found to be the same as the second group identification information of the target cell, the value of the security parameter information remains unchanged after the key update.

[0349] Among them, the initial security parameter information, that is, the initial NCC value, can be sent to the UE in advance, or sent to the UE in the first cell change command, or sent to the UE in the candidate target cell configuration. The UE needs to maintain this NCC value during the cell change process. After each cell change key update, it is determined whether the NCC value needs to be updated based on the second group identification information. If necessary, the NCC value is increased by one.

[0350] If the first group identification information of the source cell is different from the first group identification information of the target cell, and the second group identification information of the source cell is the same as the second group identification information of the target cell, the value of the security parameter information remains unchanged after the key is updated. In one case, this means that the next cell change is to derive a new key using a horizontal key derivation method (if a new security key needs to be derived), that is, the next time the UE changes the cell, (optionally) the UE compares the NCC value corresponding to the generation of the current source cell security key with the NCC value currently stored in the UE. If they are the same, the UE determines that the new security key is derived horizontally. The calculation method of the horizontal key derivation method is that the UE uses the key of the current cell, the PCI value of the target cell, and the absolute frequency information of the target cell to calculate and derive the new key.

[0351] If the first group identification information of the source cell is different from the first group identification information of the target cell, and the second group identification information of the source cell is different from the second group identification information of the target cell, the value of the security parameter information after the key is updated is increased by one. In one case, this means that the next cell change is to derive a new key in a vertical key derivation manner (if a new security key needs to be derived), that is, the next time the UE changes the cell, (optionally) the UE compares the NCC value corresponding to the generation of the current source cell security key with the NCC value currently stored in the UE. If they are different, the UE determines that the new security key is derived in a vertical manner. The calculation method of the vertical key derivation method is that the UE calculates and derives the new security key based on the NH value, the PCI value of the target cell, and the absolute frequency information of the target cell.

[0352] The following further illustrates the security processing method provided in the above embodiment through specific examples:

[0353] Example 6:

[0354] Each time the cell changes, the UE calculates a new security key on its own.

[0355] This example is based on the judgment result of the first group identification information in Example 4. If the judgment result in Example 4 is that the first group identification information of the source cell and the first group identification information of the target cell are different, then the key needs to be updated, and further based on the second group identification information, it is determined whether the security parameter information has changed.

[0356] Specifically, the security-related information includes configuring a second group identification information for each candidate target cell. The second group identification information is used by the UE to determine whether it is necessary to increase the security parameter information (NCC value) maintained by the UE by one after each cell change. If the second group identification information of the source cell and the second group identification information of the target cell are the same, then after this cell change, the UE does not need to increase the security parameter information (NCC value) by one, that is, the UE maintains the current security parameter information (NCC value); if the second group identification information of the source cell and the target cell are different, then after this cell change, the UE needs to increase the security parameter information (NCC value) by one.

[0357] The security processing method provided by the embodiment of the present disclosure, after determining that the key needs to be updated through the first group identification information, further determines whether the security parameter information needs to be increased by one based on the second group identification information, thereby ensuring the accuracy of subsequent key generation, and ensuring the key update and security parameter information update in the continuous cell change scenario, reducing the frequent reconfiguration actions caused by key update, reducing signaling overhead, and reducing the waste of air interface resources.

[0358] In some embodiments, determining a security key corresponding to the target cell based on security-related information includes:

[0359] Determine a security key counter list corresponding to the target cell from the security-related information, or generate a security key counter list corresponding to the target cell based on the security-related information;

[0360] The security key corresponding to the target cell is determined based on the security key counter value of the source cell and the security key counter list corresponding to the target cell.

[0361] Specifically, the UE may also determine the security key corresponding to the target cell based on the security key counter list corresponding to the target cell in combination with the security key counter value of the source cell.

[0362] The security key counter list (sk-counter list) corresponding to the target cell may be obtained from the security-related information, that is, the security key counter list is directly configured by the network; or the security key counter list corresponding to the target cell may also be generated based on the security-related information.

[0363] For example, the network device configures a security key counter list for each candidate target cell. There are no repeated security key counter values ​​in the security key counter lists under different SNs. Based on the security key counter list corresponding to the target cell and the security key counter value of the source cell, it is known whether the source cell and the target cell belong to the same cell under the same SN, thereby determining the security key corresponding to the target cell.

[0364] For another example, a security key counter list is obtained based on the security key counter initial value and the global step size contained in the security-related information, and then based on the security key counter list corresponding to the target cell and the security key counter value of the source cell, it is determined whether the source cell and the target cell belong to the same SN, thereby determining the security key corresponding to the target cell.

[0365] The security processing method provided by the embodiment of the present disclosure obtains a security key counter list corresponding to the target cell through network configuration or UE using intermediate information, and then determines whether to perform a key update based on the security key counter list and the security key counter value of the source cell, thereby determining the security key corresponding to the target cell. This avoids frequent reconfiguration or reinitialization operations caused by key updates, reduces signaling overhead, and reduces waste of air interface resources.

[0366] In some embodiments, determining the security key corresponding to the target cell based on the security key counter value of the source cell and the security key counter list corresponding to the target cell includes:

[0367] In a case where the security key counter value of the source cell is in the security key counter list corresponding to the target cell, determining that the security key corresponding to the target cell is the current security key; or,

[0368] When the security key counter value of the source cell is not in the security key counter list corresponding to the target cell, the security key is updated to obtain the security key corresponding to the target cell.

[0369] Specifically, after obtaining the security key counter list corresponding to the target cell, it is determined whether the security key counter list corresponding to the target cell has the security key counter value of the source cell, and whether the source cell and the target cell are cells under the same SN. If so, the key does not need to be updated for this cell change; if not, the key needs to be updated for this cell change.

[0370] For example, a security key counter list corresponding to each candidate target cell is obtained through network configuration, or a security key counter list corresponding to the target cell is generated based on the initial value of the security key counter and the global step size. The security key counter lists of candidate target cells under the same SN are the same, while the security key counter lists of candidate target cells under different SNs are different, and there are no duplicate security key counter values ​​in the security key counter lists of candidate target cells under different SNs. If the security key counter value of the source cell is in the security key counter list corresponding to the target cell, there is no need to update the key, and the current security key is used as the security key corresponding to the target cell.

[0371] If the security key counter list corresponding to the target cell does not contain the security key counter value of the source cell, a key update is required to obtain the security key corresponding to the target cell.

[0372] The following further illustrates the security processing method provided in the above embodiment through specific examples:

[0373] Example 7:

[0374] A security key counter list (sk-counter list) is configured for each candidate target cell. The network ensures that the sk-counter lists of candidate target cells under the same SN are the same, and the sk-counter list values ​​of candidate target cells under different SNs are different. There are no duplicate security key counter (sk-counter) values ​​in the sk-counter lists under different SNs. For example, the sk-counter lists of candidate target cells under SN1 are all configured as {1,2,3,4,5,6}, the sk-counter lists of candidate target cells under SN2 are all configured as {7,8,9,10,11,12}, and the sk-counter lists of candidate target cells under SN3 are all configured as {13,14,15,16,17,18}.

[0375] When the UE performs a cell change, if the sk-counter used by the source cell is in the target cell sk-counter list, the UE determines that the source cell and the target cell belong to the same SN and does not update the key.

[0376] If the sk-counter used by the source cell is not in the sk-counter list of the target cell, the UE selects the sk-counter in the sk-counter list of the target cell and generates a new SCG-side security key based on this sk-counter and the MCG-side security key. This key is used for signaling / data interaction with the target PSCell after the UE accesses the target PSCell. The UE deletes the used sk-counter in the sk-counter list of the source cell and the sk-counter value in the sk-counter list of other candidate PSCells with the same SN.

[0377] The security processing method provided by the embodiment of the present disclosure determines whether a key update is required by judging whether the security key counter value of the source cell is in the security key counter list corresponding to the target cell, thereby determining the security key corresponding to the target cell. The candidate target cell configuration information can be continuously used for subsequent cell changes, avoiding frequent reconfiguration or reinitialization operations caused by key updates, reducing signaling overhead, and reducing waste of air interface resources.

[0378] In some embodiments, determining the security key corresponding to the target cell based on the security key counter value of the source cell and the security key counter list corresponding to the target cell includes:

[0379] When the last security key counter value in the security key counter list corresponding to the target cell is equal to the security key counter value of the source cell, determining the security key corresponding to the target cell as the current security key; or

[0380] When the last security key counter value in the security key counter list corresponding to the target cell is greater than the security key counter value of the source cell, the security key is updated to obtain the security key corresponding to the target cell.

[0381] Specifically, after obtaining the security key counter list corresponding to the target cell, determining whether the last security key counter value in the security key counter list corresponding to the target cell is equal to the security key counter value of the source cell, and determining whether the source cell and the target cell are cells under the same SN. If so, no key update is required for this cell change; if not, a key update is required for this cell change. The last security key counter value in the security key counter list corresponding to the target cell is not less than the security key counter value of the source cell.

[0382] For example, a security key counter list corresponding to each candidate target cell is obtained through network configuration, or a security key counter list corresponding to the target cell is generated based on the initial value of the security key counter and the global step size. The security key counter lists of candidate target cells under the same SN are the same, while the security key counter lists of candidate target cells under different SNs are different, and there are no duplicate security key counter values ​​in the security key counter lists of candidate target cells under different SNs. If the last security key counter value in the security key counter list corresponding to the target cell is equal to the security key counter value of the source cell, it is determined that no key update is required, and the current security key is used as the security key corresponding to the target cell.

[0383] If the last security key counter value in the security key counter list corresponding to the target cell is greater than the security key counter value of the source cell, it is determined that a key needs to be updated to obtain the security key corresponding to the target cell.

[0384] The security processing method provided by the embodiment of the present disclosure determines whether a key update is required by comparing the last security key counter value in the security key counter list corresponding to the target cell with the security key counter value of the source cell, thereby determining the security key corresponding to the target cell, avoiding frequent reconfiguration or reinitialization operations caused by key updates, reducing signaling overhead, and reducing waste of air interface resources.

[0385] In some embodiments, generating a security key counter list corresponding to the target cell based on the security-related information includes:

[0386] A security key counter list corresponding to the target cell is generated based on the security key counter initial value and the global step size included in the security-related information.

[0387] Specifically, the security key counter list corresponding to the target cell may be generated by the security key counter initial value and global step size included in the security-related information.

[0388] For example, the network device configures a security key counter starting value for each candidate target cell, and each time the cell changes, the latest value in the security key counter list of the target cell (the first time is the security key counter starting value) is added to a global step size to obtain an latest security key counter list, that is, the UE maintains this latest security key counter list for each candidate target cell, and subsequent cell changes are based on the latest security key counter value in this security key counter list plus the global step size to obtain a new security key counter list.

[0389] For another example, each time a cell changes, the UE starts counting from the initial security key counter value of the target cell to obtain a security key counter list. The UE uses the initial security key counter value plus the global step size to calculate until the latest security key counter value is not less than the currently applied security key counter value, thereby obtaining a security key counter list. That is, the UE does not maintain a security key counter list. Each time a cell changes, the UE starts counting from the initial security key value of the target cell until a security key counter value is calculated that is not less than the currently applied security key counter value, thereby obtaining a security key counter list.

[0390] The following further illustrates the security processing method provided in the above embodiment through specific examples:

[0391] Example 8:

[0392] A sk-counter starting value is configured for each candidate cell. The network ensures that the sk-counter starting value of candidate cells under the same SN is the same, and the sk-counter starting value of candidate cells under different SNs is different. A global step size is configured. The sk-counter initial value and the global step size are used to ensure that the sk-counter values ​​under different SNs are different. For example, the sk-counter initial value configured under SN1 is {1}, the sk-counter initial value configured under SN2 is {5}, the sk-counter initial value configured under SN3 is {9}, and the global step size is {10}. The method by which the UE determines whether a key update is required includes at least one of the following:

[0393] (1) The UE directly generates a fixed-length sk-counter list for each candidate cell based on the initial value and the global step size; the last sk-counter value in the sk-counter list of the target cell generated each time is the sk-counter value of the first target cell whose sk-counter value is not less than the sk-counter value of the source cell; the subsequent process of determining the security key corresponding to the target cell based on the sk-counter list corresponding to the target cell is the same as Example 7 and is not repeated here.

[0394] (2) The UE generates the sk-counter value of the target cell based on the initial value and the global step size. If the sk-counter value is not less than the currently used sk-counter value, the next sk-counter value will not be calculated. That is, the generated sk-counter value of the target cell is the sk-counter value of the first target cell that is not less than the sk-counter value of the source cell. Specifically, when the UE performs a cell change, the UE calculates a new sk-counter value by adding the sk-counter starting value of the target cell to the global step size. The new sk-counter value must be greater than or equal to the current sk-counter value.

[0395] For (2), if the new sk-counter value is equal to the current sk-counter value, the UE determines that the source cell and the target cell are cells under the same SN, and the key does not need to be updated when changing from the source cell to the target cell. If the new sk-counter value is greater than the current sk-counter value, the UE determines that the source cell and the target cell are not cells under the same SN, and the key needs to be updated when changing from the source cell to the target cell. The calculated sk-counter value and the MCG side security key are used to generate a new SCG side security key (K gNB ) is used for signaling / data interaction between the UE and the target PSCell after the UE accesses the target PSCell.

[0396] The security processing method provided by the embodiment of the present disclosure generates a security key counter list in a variety of ways, thereby using different judgment methods to determine whether the key needs to be updated, and is flexibly applied to various demand scenarios.

[0397] In some embodiments, the first group identification information or the second group identification information or the security key counter list is included in candidate target cell configuration information.

[0398] Specifically, the first group identification information or the second group identification information or the security key counter list (which may be the initial value of the security key counter) received by the UE can be included in the candidate target cell configuration information, that is, a first group identification information, and / or second group identification information, and / or a security key counter list (which may be the initial value of the security key counter) is configured for each candidate target cell in the continuous cell change configuration information.

[0399] When the UE receives the initial value of the security key counter, it is necessary to derive the security key counter list based on the initial value of the security key counter combined with the global step size, wherein the global step size used to obtain the security key counter list is a global variable, and the global step size is not in the candidate target cell configuration information.

[0400] In some embodiments, the method further comprises:

[0401] Receive candidate target cell configuration information and / or security-related information sent by the network device.

[0402] Specifically, in a continuous cell change scenario, the network device configures candidate target cell configuration information to the UE, where the candidate target cell configuration information is used for the continuous cell change. The candidate target cell configuration information may include the security-related information. At this time, the UE receives the candidate target cell configuration information sent by the network device and determines the security key corresponding to the target cell based on the security-related information included in the candidate target cell configuration information.

[0403] The security-related information may also be included in a cell change command. The UE receives candidate target cell configuration information and the cell change command from the network device, and determines the security key corresponding to the target cell based on the security-related information included in the cell change command. Furthermore, the security-related information may also be sent to the UE before the UE receives the cell change command or after the UE accesses the target cell.

[0404] The candidate target cell configuration information and security-related information may be sent in the same signaling or in different signalings.

[0405] When the UE only receives the candidate target cell configuration information sent by the network device but does not receive the security-related information or the network device does not send the security-related information, the UE uses the current security key to perform signaling / data interaction with the target cell.

[0406] The security processing method provided by the embodiments of the present disclosure allows network devices to send security-related information in a variety of ways and is flexibly applied to various demand scenarios.

[0407] In some embodiments, the network device sends security-related information to the terminal in one or more of the following situations:

[0408] The core network updates the security key of the target cell based on the AMF key;

[0409] The core network updates the AMF key;

[0410] Traditional switchover, conditional switchover, or dual-active protocol stack switchover occurs.

[0411] Specifically, if the security context has changed, the network device needs to reconfigure the security related information to the UE, that is, send new security related information to the UE. For example, after the network device sends the security related information to the UE, when the core network uses the Access and Mobility Management Function (AMF) key (i.e., K AMF ) recalculate the new security key (such as deriving a new K gNB or derive a new NH value), the network device needs to reconfigure security-related information to the UE.

[0412] For another example, after the network device sends security related information to the UE, when the core network regenerates a new AMF key (i.e., K AMF ), the network device needs to reconfigure security-related information to the UE.

[0413] For another example, after the network device sends security-related information to the UE, when a traditional handover, a conditional handover (CHO), or a dual active protocol stack handover (DAPS HO) occurs, the network device needs to reconfigure the security-related information to the UE.

[0414] The security processing method provided by the embodiment of the present disclosure determines the security key corresponding to the target cell based on security-related information, wherein the target cell is a candidate target cell that supports continuous cell changes, thereby ensuring key updates in the continuous cell change scenario, avoiding the need for frequent RRC reconfiguration or reinitialization of LTM due to key updates, reducing signaling overhead, and reducing waste of air interface resources.

[0415] FIG2 is a second flow chart of a security processing method provided by an embodiment of the present disclosure. As shown in FIG2 , an embodiment of the present disclosure provides a security processing method, the execution subject of which may be a network device, such as a base station. The method includes:

[0416] Step 201: Send candidate target cell configuration information and / or security-related information to the terminal; the security-related information is used to determine a security key corresponding to the target cell; the target cell is a candidate target cell that supports continuous cell change.

[0417] In some embodiments, the security-related information includes one or more of the following:

[0418] Security parameter information;

[0419] Security update instructions;

[0420] first group identification information;

[0421] second group identification information;

[0422] Security key counter list.

[0423] In some embodiments, the security update indication information includes one or more of the following:

[0424] Information indicating whether a key update is required for this cell change;

[0425] Information indicating whether the value of the security parameter information corresponding to this cell change needs to be increased by one;

[0426] Information indicating whether the value of the security parameter information after the key update corresponding to this cell change needs to be increased by one.

[0427] In some embodiments, the security-related information is sent by one or more of the following signaling:

[0428] RRC signaling;

[0429] MAC CE signaling;

[0430] DCI signaling.

[0431] In some embodiments, sending security-related information to the terminal includes:

[0432] Send security-related information to the terminal in one or more of the following situations:

[0433] The core network updates the security key of the target cell based on the AMF key;

[0434] The core network updates the AMF key;

[0435] Traditional switchover, conditional switchover, or dual-active protocol stack switchover occurs.

[0436] This mainly refers to the situation mentioned above where the network will reconfigure new security related information to the UE. For example, the network sends security related information to the UE, and when the core network updates the AMF key (i.e. K AMF ), or the core network derives a new security key based on the AMF key (such as deriving a new K gNB or derive a new NH value), or a traditional handover / conditional handover / dual-active protocol stack handover occurs, the network will send new security-related information to the UE.

[0437] Specifically, the security processing method provided by the embodiment of the present disclosure can refer to the above-mentioned security processing method embodiment in which the execution subject is the terminal, and can achieve the same technical effect. The parts and beneficial effects of this embodiment that are the same as the above-mentioned corresponding method embodiments will not be described in detail here.

[0438] FIG3 is a schematic diagram of the structure of a terminal provided by an embodiment of the present disclosure. As shown in FIG3 , the terminal includes a memory 303, a transceiver 301, and a processor 302, wherein:

[0439] The memory 303 is used to store computer programs; the transceiver 301 is used to send and receive data under the control of the processor 302; the processor 302 is used to read the computer program in the memory 303 and perform the following operations:

[0440] Determine a security key corresponding to the target cell based on the security related information;

[0441] The target cell is a candidate target cell that supports continuous cell change.

[0442] In FIG3 , the bus architecture may include any number of interconnected buses and bridges, specifically various circuits connected together by one or more processors represented by processor 302 and memory represented by memory 303. The bus architecture may also connect various other circuits such as peripheral devices, voltage regulators, and power management circuits, which are well known in the art and are therefore not described further herein. The bus interface provides an interface. The transceiver 301 may be a plurality of components, i.e., a transmitter and a receiver, providing a unit for communicating with various other devices on a transmission medium, such as a wireless channel, a wired channel, an optical cable, and the like. For different user devices, the user interface 304 may also be an interface capable of connecting external or internal devices as required, and the connected devices include, but are not limited to, a keypad, a display, a speaker, a microphone, a joystick, and the like.

[0443] The processor 302 is responsible for managing the bus architecture and general processing, and the memory 303 can store data used by the processor 302 when performing operations.

[0444] In some embodiments, the processor 302 may be a central processing unit (CPU), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA), or a complex programmable logic device (CPLD). The processor may also adopt a multi-core architecture.

[0445] The processor calls the computer program stored in the memory to execute any of the methods provided by the embodiments of the present disclosure according to the obtained executable instructions. The processor and the memory can also be arranged physically separately.

[0446] In some embodiments, the security-related information includes one or more of the following:

[0447] Security parameter information;

[0448] Security update instructions;

[0449] first group identification information;

[0450] second group identification information;

[0451] Security key counter list.

[0452] In some embodiments, when the security-related information is security parameter information and / or security update indication information, determining the security key corresponding to the target cell based on the security-related information includes:

[0453] The security key corresponding to the target cell is determined based on the security parameter information and / or security update indication information included in the configuration information of the target cell.

[0454] In some embodiments, the security update indication information includes one or more of the following:

[0455] Information indicating whether a key update is required for this cell change;

[0456] Information indicating whether the value of the security parameter information corresponding to this cell change needs to be increased by one;

[0457] Information indicating whether the value of the security parameter information after the security key update corresponding to this cell change needs to be increased by one.

[0458] In some embodiments, when the security-related information is first group identification information, determining the security key corresponding to the target cell based on the security-related information includes:

[0459] When the first group identification information of the source cell is the same as the first group identification information of the target cell, determining that the security key corresponding to the target cell is the current security key; or,

[0460] When the first group identification information of the source cell is different from the first group identification information of the target cell, the security key is updated to obtain the security key corresponding to the target cell.

[0461] In some embodiments, the processor is further configured to read the computer program in the memory and perform the following operations:

[0462] In a case where the second group identification information of the source cell is different from the second group identification information of the target cell, after the security key is updated, the value of the security parameter information is increased by one; or

[0463] In a case where the second group identification information of the source cell is identical to the second group identification information of the target cell, after the security key is updated, it is determined that the value of the security parameter information remains unchanged.

[0464] In some embodiments, determining a security key corresponding to the target cell based on security-related information includes:

[0465] Determine a security key counter list corresponding to the target cell from the security-related information, or generate a security key counter list corresponding to the target cell based on the security-related information;

[0466] The security key corresponding to the target cell is determined based on the security key counter value of the source cell and the security key counter list corresponding to the target cell.

[0467] In some embodiments, determining the security key corresponding to the target cell based on the security key counter value of the source cell and the security key counter list corresponding to the target cell includes:

[0468] In a case where the security key counter value of the source cell is in the security key counter list corresponding to the target cell, determining that the security key corresponding to the target cell is the current security key; or,

[0469] When the security key counter value of the source cell is not in the security key counter list corresponding to the target cell, the security key is updated to obtain the security key corresponding to the target cell.

[0470] In some embodiments, determining the security key corresponding to the target cell based on the security key counter value of the source cell and the security key counter list corresponding to the target cell includes:

[0471] When the last security key counter value in the security key counter list corresponding to the target cell is equal to the security key counter value of the source cell, determining the security key corresponding to the target cell as the current security key; or

[0472] When the last security key counter value in the security key counter list corresponding to the target cell is greater than the security key counter value of the source cell, the security key is updated to obtain the security key corresponding to the target cell.

[0473] In some embodiments, generating a security key counter list corresponding to the target cell based on the security-related information includes:

[0474] A security key counter list corresponding to the target cell is generated based on the security key counter initial value and the global step size included in the security-related information.

[0475] In some embodiments, the first group identification information or the second group identification information or the security key counter list is included in candidate target cell configuration information.

[0476] In some embodiments, the processor is further configured to read the computer program in the memory and perform the following operations:

[0477] Receive candidate target cell configuration information and / or security-related information sent by the network device.

[0478] In some embodiments, the security-related information is sent by one or more of the following signaling:

[0479] RRC signaling;

[0480] MAC CE signaling;

[0481] DCI signaling.

[0482] It should be noted here that the above-mentioned terminal provided in the embodiment of the present disclosure can implement all the method steps implemented by the method embodiment in which the execution subject is the terminal, and can achieve the same technical effect. The parts and beneficial effects of this embodiment that are the same as those of the method embodiment will not be described in detail here.

[0483] FIG4 is a schematic diagram of the structure of a network device provided by an embodiment of the present disclosure. As shown in FIG4 , the network device includes a memory 403, a transceiver 401, and a processor 402, wherein:

[0484] The memory 403 is used to store computer programs; the transceiver 401 is used to send and receive data under the control of the processor 402; the processor 402 is used to read the computer program in the memory 403 and perform the following operations:

[0485] Send candidate target cell configuration information and / or security-related information to the terminal; the security-related information is used to determine the security key corresponding to the target cell; the target cell is a candidate target cell that supports continuous cell change.

[0486] In FIG4 , the bus architecture may include any number of interconnected buses and bridges, specifically linking together various circuits of one or more processors represented by processor 402 and memory represented by memory 403. The bus architecture may also link together various other circuits such as peripheral devices, voltage regulators, and power management circuits, which are well known in the art and are therefore not further described herein. The bus interface provides an interface. The transceiver 401 may be a plurality of components, i.e., a transmitter and a receiver, providing a unit for communicating with various other devices over a transmission medium, such as a wireless channel, a wired channel, an optical cable, or the like. The processor 402 is responsible for managing the bus architecture and general processing, and the memory 403 may store data used by the processor 402 when performing operations.

[0487] The processor 402 may be a central processing unit (CPU), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA), or a complex programmable logic device (CPLD). The processor may also adopt a multi-core architecture.

[0488] In some embodiments, the security-related information includes one or more of the following:

[0489] Security parameter information;

[0490] Security update instructions;

[0491] first group identification information;

[0492] second group identification information;

[0493] Security key counter list.

[0494] In some embodiments, the security update indication information includes one or more of the following:

[0495] Information indicating whether a key update is required for this cell change;

[0496] Information indicating whether the value of the security parameter information corresponding to this cell change needs to be increased by one;

[0497] Information indicating whether the value of the security parameter information after the key update corresponding to this cell change needs to be increased by one.

[0498] In some embodiments, the security-related information is sent by one or more of the following signaling:

[0499] RRC signaling;

[0500] MAC CE signaling;

[0501] DCI signaling.

[0502] In some embodiments, sending security-related information to the terminal includes:

[0503] Send security-related information to the terminal in one or more of the following situations:

[0504] The core network updates the security key of the target cell based on the AMF key;

[0505] The core network updates the AMF key;

[0506] Traditional switchover, conditional switchover, or dual-active protocol stack switchover occurs.

[0507] Specifically, the above-mentioned network device provided in the embodiment of the present disclosure can implement all the method steps implemented by the method embodiment in which the execution subject is the network device, and can achieve the same technical effect. The parts and beneficial effects of this embodiment that are the same as the method embodiment will not be described in detail here.

[0508] FIG5 is a schematic diagram of a structure of a secure processing device provided by an embodiment of the present disclosure. As shown in FIG5 , an embodiment of the present disclosure provides a secure processing device, including a determination module 501, wherein:

[0509] The determination module 501 is configured to determine a security key corresponding to a target cell based on security-related information; the target cell is a candidate target cell that supports continuous cell change.

[0510] In some embodiments, the security-related information includes one or more of the following:

[0511] Security parameter information;

[0512] Security update instructions;

[0513] first group identification information;

[0514] second group identification information;

[0515] Security key counter list.

[0516] In some embodiments, when the security-related information is security parameter information and / or security update indication information, the determining module includes:

[0517] The first determining unit is configured to determine a security key corresponding to the target cell based on the security parameter information and / or security update indication information included in the configuration information of the target cell.

[0518] In some embodiments, the security update indication information includes one or more of the following:

[0519] Information indicating whether a key update is required for this cell change;

[0520] Information indicating whether the value of the security parameter information corresponding to this cell change needs to be increased by one;

[0521] Information indicating whether the value of the security parameter information after the security key update corresponding to this cell change needs to be increased by one.

[0522] In some embodiments, when the security-related information is first group identification information, the determining module includes:

[0523] A second determining unit is configured to, when the first group identification information of the source cell is the same as the first group identification information of the target cell, determine that the security key corresponding to the target cell is the current security key; or

[0524] The acquiring unit is configured to update the security key when the first group identification information of the source cell is different from the first group identification information of the target cell, and obtain the security key corresponding to the target cell.

[0525] In some embodiments, the determining module further includes:

[0526] a calculation unit, configured to, when the second group identification information of the source cell is different from the second group identification information of the target cell, increase the value of the security parameter information by one after updating the security key; or

[0527] The third determining unit is configured to determine that the value of the security parameter information remains unchanged after the security key is updated when the second group identification information of the source cell is the same as the second group identification information of the target cell.

[0528] In some embodiments, the determining module includes:

[0529] a fourth determining unit, configured to determine a security key counter list corresponding to the target cell from the security-related information, or to generate a security key counter list corresponding to the target cell based on the security-related information;

[0530] The fifth determining unit is configured to determine the security key corresponding to the target cell based on the security key counter value of the source cell and the security key counter list corresponding to the target cell.

[0531] In some embodiments, the fifth determining unit includes:

[0532] A first determining subunit is configured to, when the security key counter value of the source cell is in the security key counter list corresponding to the target cell, determine that the security key corresponding to the target cell is the current security key; or

[0533] The first acquisition subunit is configured to update the security key if the security key counter value of the source cell is not in the security key counter list corresponding to the target cell, and obtain the security key corresponding to the target cell.

[0534] In some embodiments, the fifth determining unit includes:

[0535] A second determining subunit is configured to determine, when the last security key counter value in the security key counter list corresponding to the target cell is equal to the security key counter value of the source cell, that the security key corresponding to the target cell is the current security key; or

[0536] The second acquisition subunit is configured to update the security key to obtain the security key corresponding to the target cell when the last security key counter value in the security key counter list corresponding to the target cell is greater than the security key counter value of the source cell.

[0537] In some embodiments, the fourth determining unit includes:

[0538] The third acquisition subunit is configured to generate a security key counter list corresponding to the target cell based on the security key counter initial value and the global step size included in the security-related information.

[0539] In some embodiments, the first group identification information or the second group identification information or the security key counter list is included in candidate target cell configuration information.

[0540] In some embodiments, further comprising:

[0541] The receiving module is configured to receive candidate target cell configuration information and / or security-related information sent by a network device.

[0542] In some embodiments, the security-related information is sent by one or more of the following signaling:

[0543] RRC signaling;

[0544] MAC CE signaling;

[0545] DCI signaling.

[0546] Specifically, the above-mentioned security processing device provided by the embodiment of the present disclosure can implement all the method steps implemented by the above-mentioned method embodiment in which the execution subject is the terminal, and can achieve the same technical effect. The parts and beneficial effects of this embodiment that are the same as the method embodiment will not be described in detail here.

[0547] FIG6 is a second structural diagram of a secure processing device provided by an embodiment of the present disclosure. As shown in FIG6 , an embodiment of the present disclosure provides a secure processing device, including a sending module 601 .

[0548] The sending module 601 is used to send candidate target cell configuration information and / or security-related information to the terminal; the security-related information is used to determine the security key corresponding to the target cell; the target cell is a candidate target cell that supports continuous cell change.

[0549] In some embodiments, the security-related information includes one or more of the following:

[0550] Security parameter information;

[0551] Security update instructions;

[0552] first group identification information;

[0553] second group identification information;

[0554] Security key counter list.

[0555] In some embodiments, the security update indication information includes one or more of the following:

[0556] Information indicating whether a key update is required for this cell change;

[0557] Information indicating whether the value of the security parameter information corresponding to this cell change needs to be increased by one;

[0558] Information indicating whether the value of the security parameter information after the key update corresponding to this cell change needs to be increased by one.

[0559] In some embodiments, the security-related information is sent by one or more of the following signaling:

[0560] RRC signaling;

[0561] MAC CE signaling;

[0562] DCI signaling.

[0563] In some embodiments, the sending module includes:

[0564] A sending unit is configured to send security-related information to a terminal in one or more of the following situations:

[0565] The core network updates the security key of the target cell based on the AMF key;

[0566] The core network updates the AMF key;

[0567] Traditional switchover, conditional switchover, or dual-active protocol stack switchover occurs.

[0568] Specifically, the above-mentioned security processing device provided by the embodiment of the present disclosure can implement all the method steps implemented by the method embodiment in which the execution subject is a network device, and can achieve the same technical effect. The parts and beneficial effects of this embodiment that are the same as the method embodiment will not be described in detail here.

[0569] It should be noted that the division of units / modules in the above-mentioned embodiments of the present disclosure is schematic and is merely a logical functional division. In actual implementation, other division methods may be used. Furthermore, the functional units in the various embodiments of the present disclosure may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit. The above-mentioned integrated units may be implemented in the form of hardware or software functional units.

[0570] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a processor-readable storage medium. Based on this understanding, the technical solution of the present disclosure is essentially or the part that contributes to the relevant technology or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor to execute all or part of the steps of the method described in each embodiment of the present disclosure. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0571] In some embodiments, a non-transitory readable storage medium is further provided, wherein the non-transitory readable storage medium stores a computer program, and the computer program is used to enable a processor to execute the security processing methods provided by the above-mentioned method embodiments.

[0572] Specifically, the above-mentioned non-transitory readable storage medium provided by the embodiment of the present disclosure can implement all the method steps implemented by the above-mentioned method embodiments, and can achieve the same technical effects. The parts and beneficial effects of this embodiment that are the same as the method embodiment will not be described in detail here.

[0573] It should be noted that the non-transitory readable storage medium can be any available medium or data storage device that can be accessed by the processor, including but not limited to magnetic storage (such as floppy disks, hard disks, magnetic tapes, magneto-optical disks (MO), etc.), optical storage (such as CDs, DVDs, BDs, HVDs, etc.), and semiconductor storage (such as ROMs, EPROMs, EEPROMs, non-volatile memories (NAND FLASH), solid-state drives (SSDs)), etc.

[0574] In some embodiments, a processor-readable storage medium is further provided, wherein the processor-readable storage medium stores a computer program, and the computer program is used to enable the processor to execute the security processing methods provided by the above-mentioned method embodiments.

[0575] Specifically, the processor-readable storage medium provided in the embodiment of the present disclosure can implement all the method steps implemented in the above-mentioned method embodiments and can achieve the same technical effects. The parts and beneficial effects of this embodiment that are the same as those of the method embodiment will not be described in detail here.

[0576] In some embodiments, a computer-readable storage medium is further provided, wherein the computer-readable storage medium stores a computer program, and the computer program is used to enable a computer to execute the security processing methods provided by the above-mentioned method embodiments.

[0577] Specifically, the above-mentioned computer-readable storage medium provided by the embodiment of the present disclosure can implement all the method steps implemented by the above-mentioned method embodiments, and can achieve the same technical effects. The parts and beneficial effects of this embodiment that are the same as the method embodiment will not be described in detail here.

[0578] In some embodiments, a communication device is further provided, in which a computer program is stored. The computer program is used to enable the communication device to execute the security processing methods provided by the above-mentioned method embodiments.

[0579] Specifically, the above-mentioned communication device provided by the embodiment of the present disclosure can implement all the method steps implemented by the above-mentioned method embodiments, and can achieve the same technical effects. The parts and beneficial effects of this embodiment that are the same as the method embodiment will not be described in detail here.

[0580] In some embodiments, a chip product is further provided, in which a computer program is stored. The computer program is used to enable the chip product to execute the security processing methods provided by the above-mentioned method embodiments.

[0581] Specifically, the above-mentioned chip product provided by the embodiment of the present disclosure can implement all the method steps implemented by the above-mentioned method embodiments, and can achieve the same technical effects. The parts and beneficial effects of this embodiment that are the same as the method embodiment will not be described in detail here.

[0582] It should also be noted that the terms "first," "second," and the like in the embodiments of the present disclosure are used to distinguish similar objects, and are not used to describe a specific order or precedence. It should be understood that the terms used in this manner are interchangeable where appropriate, such that the embodiments of the present disclosure can be implemented in an order other than that illustrated or described herein. Furthermore, the terms "first" and "second" generally distinguish objects of the same type, and do not limit the number of objects. For example, the first object can be one or more.

[0583] In the embodiments of the present disclosure, the term "and / or" describes the association relationship between associated objects, indicating that three relationships can exist. For example, A and / or B can represent three situations: A exists alone, A and B exist simultaneously, and B exists alone. The character " / " generally indicates that the associated objects are in an "or" relationship.

[0584] In the embodiments of the present disclosure, the term "plurality" refers to two or more than two, and other quantifiers are similar thereto.

[0585] The technical solution provided by the embodiments of the present disclosure can be applicable to a variety of systems, especially 5G systems or 6G systems. For example, the applicable system can be a global system of mobile communication (GSM) system, a code division multiple access (CDMA) system, a wideband code division multiple access (WCDMA) general packet radio service (GPRS) system, a long term evolution (LTE) system, a LTE frequency division duplex (FDD) system, a LTE time division duplex (TDD) system, an advanced long term evolution (LTE-A) system, a universal mobile telecommunication system (UMTS), a world-wide interoperability for microwave access (WiMAX) system, a 5G new air interface (NR) system, a 6G system, etc. These various systems include terminal equipment and network equipment. The system may also include a core network part, such as an evolved packet system (EPS), a 5G system (5GS), etc.

[0586] The terminal device involved in the embodiments of the present disclosure may be a device that provides voice and / or data connectivity to a user, a handheld device with wireless connection function, or other processing device connected to a wireless modem. In different systems, the name of the terminal device may also be different. For example, in a 5G system, the terminal device may be called User Equipment (UE). A wireless terminal device can communicate with one or more core networks (CN) via a radio access network (RAN). The wireless terminal device may be a mobile terminal device, such as a mobile phone (or "cellular" phone) and a computer with a mobile terminal device. For example, it may be a portable, pocket-sized, handheld, computer-built-in or vehicle-mounted mobile device that exchanges voice and / or data with a radio access network. For example, Personal Communication Service (PCS) phones, cordless phones, Session Initiated Protocol (SIP) phones, Wireless Local Loop (WLL) stations, Personal Digital Assistants (PDAs), and other devices. The wireless terminal device may also be referred to as a system, a subscriber unit, a subscriber station, a mobile station, a mobile station, a remote station, an access point, a remote terminal device, an access terminal device, a user terminal device, a user agent, or a user device, but is not limited in the embodiments of the present disclosure.

[0587] The network device involved in the embodiments of the present disclosure may be a base station, which may include multiple cells providing services to terminals. Depending on the specific application scenario, the base station may also be called an access point, or may be a device in an access network that communicates with a wireless terminal device through one or more sectors on an air interface, or may be called another name. The network device may be used to interchange received air frames with Internet Protocol (IP) packets, acting as a router between the wireless terminal device and the rest of the access network, wherein the rest of the access network may include an Internet Protocol (IP) communication network. The network device may also coordinate the attribute management of the air interface. For example, the network device involved in the embodiments of the present disclosure may be a base transceiver station (BTS) in the Global System for Mobile communications (GSM) or code division multiple access (CDMA), a network device (NodeB) in wide-band code division multiple access (WCDMA), an evolutionary Node B (eNB or e-NodeB) in the long term evolution (LTE) system, a 5G base station (gNB) in the 5G network architecture (next generation system), a home evolved Node B (HeNB), a relay node, a femto, a pico, etc., and is not limited in the embodiments of the present disclosure. In some network structures, the network device may include a centralized unit (CU) node and a distributed unit (DU) node, and the centralized unit and the distributed unit may also be geographically separated.

[0588] In the present disclosure, "determine B based on A" means that factor A must be considered when determining B. It is not limited to "determine B based on A alone", and should also include: "determine B based on A and C", "determine B based on A, C and E", "determine C based on A, and further determine B based on C", etc. It can also include using A as a condition for determining B, for example, "when A meets the first condition, use the first method to determine B"; for example, "when A meets the second condition, determine B"; for example, "when A meets the third condition, determine B based on the first parameter", etc. Of course, it can also be a condition that uses A as a factor in determining B, for example, "when A meets the first condition, use the first method to determine C, and further determine B based on C", etc.

[0589] Network devices and terminal devices can each use one or more antennas for Multiple Input Multiple Output (MIMO) transmission. MIMO transmission can be single-user MIMO (SU-MIMO) or multi-user MIMO (MU-MIMO). Depending on the form and number of antenna combinations, MIMO transmission can be 2D-MIMO, 3D-MIMO, FD-MIMO, or massive-MIMO. It can also use diversity transmission, precoding transmission, or beamforming transmission.

[0590] Those skilled in the art will appreciate that the embodiments of the present disclosure may be provided as methods, systems, or computer program products. Therefore, the present disclosure may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Furthermore, the present disclosure may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage and optical storage, etc.) containing computer-usable program code.

[0591] The present disclosure is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present disclosure. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer-executable instructions. These computer-executable instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device produce a device for implementing the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0592] These processor-executable instructions may also be stored in a processor-readable memory that can direct a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the processor-readable memory produce a product including an instruction device that implements the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0593] These processor-executable instructions may also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, whereby the instructions executed on the computer or other programmable device provide steps for implementing the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0594] Obviously, those skilled in the art may make various changes and modifications to the present disclosure without departing from the spirit and scope of the present disclosure. Thus, if these modifications and variations of the present disclosure fall within the scope of the claims of the present disclosure and their equivalents, the present disclosure is intended to include these modifications and variations.

Claims

1. A security processing method, applied to a terminal, comprising: Determine a security key corresponding to the target cell based on the security related information; The target cell is a candidate target cell that supports continuous cell change.

2. The safe processing method according to claim 1, wherein: The security related information includes one or more of the following: Security parameter information; Security update instructions; first group identification information; second group identification information; Security key counter list.

3. The safe processing method according to claim 1, wherein: In a case where the security-related information is security parameter information and / or security update indication information, the determining a security key corresponding to the target cell based on the security-related information includes: The security key corresponding to the target cell is determined based on the security parameter information and / or security update indication information included in the configuration information of the target cell.

4. The safe processing method according to claim 3, wherein: The security update indication information includes one or more of the following: Information indicating whether a key update is required for this cell change; Information indicating whether the value of the security parameter information corresponding to this cell change needs to be increased by one; Information indicating whether the value of the security parameter information after the security key update corresponding to this cell change needs to be increased by one.

5. The safe processing method according to claim 1, wherein: In a case where the security-related information is first group identification information, determining a security key corresponding to the target cell based on the security-related information includes: The first group identification information of the source cell and the first group identification information of the target cell In the same case, determining that the security key corresponding to the target cell is the current security key; or, When the first group identification information of the source cell is different from the first group identification information of the target cell, the security key is updated to obtain the security key corresponding to the target cell.

6. The safe processing method according to claim 5, wherein: The method further comprises: When the second group identification information of the source cell is different from the second group identification information of the target cell, after the security key is updated, the value of the security parameter information is increased by one; or, In a case where the second group identification information of the source cell is the same as the second group identification information of the target cell, after the security key is updated, it is determined that the value of the security parameter information remains unchanged.

7. The safe processing method according to claim 1, wherein: The determining the security key corresponding to the target cell based on the security-related information includes: Determine a security key counter list corresponding to the target cell from the security related information, or generate a security key counter list corresponding to the target cell based on the security related information; The security key corresponding to the target cell is determined based on the security key counter value of the source cell and the security key counter list corresponding to the target cell.

8. The safe processing method according to claim 7, wherein: The determining the security key corresponding to the target cell based on the security key counter value of the source cell and the security key counter list corresponding to the target cell includes: In a case where the security key counter value of the source cell is in the security key counter list corresponding to the target cell, determining that the security key corresponding to the target cell is the current security key; or, The security key counter value of the source cell is not within the security key counter value of the target cell. In the case of a key counter list, the security key is updated to obtain the security key corresponding to the target cell.

9. The safe processing method according to claim 7, wherein: The determining the security key corresponding to the target cell based on the security key counter value of the source cell and the security key counter list corresponding to the target cell includes: When the last security key counter value in the security key counter list corresponding to the target cell is equal to the security key counter value of the source cell, determining that the security key corresponding to the target cell is the current security key; or, When the last security key counter value in the security key counter list corresponding to the target cell is greater than the security key counter value of the source cell, the security key is updated to obtain the security key corresponding to the target cell.

10. The safe processing method according to claim 7, wherein: The generating a security key counter list corresponding to the target cell based on the security-related information includes: A security key counter list corresponding to the target cell is generated based on the security key counter initial value and the global step size included in the security-related information.

11. The safe processing method according to any one of claims 5 to 7, wherein: The first group identification information or the second group identification information or the security key counter list is included in candidate target cell configuration information.

12. The safe processing method according to claim 1, wherein: The method further comprises: Receive candidate target cell configuration information and / or security-related information sent by the network device.

13. The safe processing method according to claim 1, wherein: The security related information is sent by one or more of the following signaling: Radio Resource Control RRC signaling; Media Access Control Element MAC CE signaling; Downlink control information DCI signaling.

14. A security processing method, applied to a network device, comprising: Send candidate target cell configuration information and / or security-related information to the terminal; The security related information is used to determine the security key corresponding to the target cell; The target cell is a candidate target cell that supports continuous cell change.

15. The safe processing method according to claim 14, wherein: The security related information includes one or more of the following: Security parameter information; Security update instructions; first group identification information; second group identification information; Security key counter list.

16. The safe processing method according to claim 15, wherein: The security update indication information includes one or more of the following: Information indicating whether a key update is required for this cell change; Information indicating whether the value of the security parameter information corresponding to this cell change needs to be increased by one; Information indicating whether the value of the security parameter information after the key update corresponding to this cell change needs to be increased by one.

17. The safe processing method according to claim 14, wherein: The security related information is sent by one or more of the following signaling: RRC signaling; MAC CE signaling; DCI signaling.

18. The safe processing method according to claim 14, wherein: The sending of security related information to the terminal includes: In one or more of the following situations, security related information is sent to the terminal: The core network updates the security key of the target cell based on the access and mobility management function network element AMF key; The core network updates the AMF key; Traditional switchover or conditional switchover or dual-active protocol stack switchover occurs.

19. A terminal comprising a memory, a transceiver, and a processor; Memory for storing computer programs; a transceiver, for transmitting and receiving data under the control of the processor; A processor is configured to read the computer program in the memory and perform the following operations: Determine a security key corresponding to the target cell based on the security related information; The target cell is a candidate target cell that supports continuous cell change.

20. The terminal according to claim 19, wherein: The security related information includes one or more of the following: Security parameter information; Security update instructions; first group identification information; second group identification information; Security key counter list.

21. The terminal according to claim 19, wherein: In a case where the security-related information is security parameter information and / or security update indication information, the determining a security key corresponding to the target cell based on the security-related information includes: The security key corresponding to the target cell is determined based on the security parameter information and / or security update indication information included in the configuration information of the target cell.

22. The terminal according to claim 21, wherein: The security update indication information includes one or more of the following: Information indicating whether a key update is required for this cell change; Information indicating whether the value of the security parameter information corresponding to this cell change needs to be increased by one; Information indicating whether the value of the security parameter information after the security key update corresponding to this cell change needs to be increased by one.

23. The terminal according to claim 19, wherein: In a case where the security-related information is first group identification information, determining a security key corresponding to the target cell based on the security-related information includes: When the first group identification information of the source cell is the same as the first group identification information of the target cell, determining that the security key corresponding to the target cell is the current security key; or, When the first group identification information of the source cell is different from the first group identification information of the target cell, the security key is updated to obtain the security key corresponding to the target cell.

24. The terminal according to claim 23, wherein: The processor is further configured to read the computer program in the memory and perform the following operations: When the second group identification information of the source cell is different from the second group identification information of the target cell, after the security key is updated, the value of the security parameter information is increased by one; or, In a case where the second group identification information of the source cell is the same as the second group identification information of the target cell, after the security key is updated, it is determined that the value of the security parameter information remains unchanged.

25. The terminal according to claim 19, wherein: The determining the security key corresponding to the target cell based on the security-related information includes: Determine a security key counter list corresponding to the target cell from the security related information, or generate a security key counter list corresponding to the target cell based on the security related information; The security key corresponding to the target cell is determined based on the security key counter value of the source cell and the security key counter list corresponding to the target cell.

26. The terminal according to claim 25, wherein: The determining the security key corresponding to the target cell based on the security key counter value of the source cell and the security key counter list corresponding to the target cell includes: In a case where the security key counter value of the source cell is in the security key counter list corresponding to the target cell, determining that the security key corresponding to the target cell is the current security key; or, When the security key counter value of the source cell is not in the security key counter list corresponding to the target cell, the security key is updated to obtain the security key corresponding to the target cell.

27. The terminal according to claim 25, wherein: The determining the security key corresponding to the target cell based on the security key counter value of the source cell and the security key counter list corresponding to the target cell includes: When the last security key counter value in the security key counter list corresponding to the target cell is equal to the security key counter value of the source cell, determining that the security key corresponding to the target cell is the current security key; or, When the last security key counter value in the security key counter list corresponding to the target cell is greater than the security key counter value of the source cell, the security key is updated to obtain the security key corresponding to the target cell.

28. The terminal according to claim 25, wherein: The generating a security key counter list corresponding to the target cell based on the security-related information includes: A security key counter list corresponding to the target cell is generated based on the security key counter initial value and the global step size included in the security-related information.

29. The terminal according to any one of claims 23 to 25, wherein: The first group identification information or the second group identification information or the security key counter list is included in candidate target cell configuration information.

30. The terminal according to claim 19, wherein: The processor is further configured to read the computer program in the memory and perform the following operations: Receive candidate target cell configuration information and / or security-related information sent by the network device.

31. The terminal according to claim 19, wherein: The security related information is sent by one or more of the following signaling: RRC signaling; MAC CE signaling; DCI signaling.

32. A network device comprising a memory, a transceiver, and a processor; Memory for storing computer programs; a transceiver, for transmitting and receiving data under the control of the processor; A processor is configured to read the computer program in the memory and perform the following operations: Send candidate target cell configuration information and / or security related information to the terminal; the security related information is used to determine the security key corresponding to the target cell; the target cell is a candidate target cell that supports continuous cell change.

33. The network device according to claim 32, wherein: The security related information includes one or more of the following: Security parameter information; Security update instructions; first group identification information; second group identification information; Security key counter list.

34. The network device according to claim 33, wherein: The security update indication information includes one or more of the following: Information indicating whether a key update is required for this cell change; Information indicating whether the value of the security parameter information corresponding to this cell change needs to be increased by one; Information indicating whether the value of the security parameter information after the key update corresponding to this cell change needs to be increased by one.

35. The network device according to claim 32, wherein: The security related information is sent by one or more of the following signaling: RRC signaling; MAC CE signaling; DCI signaling.

36. The network device according to claim 32, wherein: The sending of security related information to the terminal includes: In one or more of the following situations, security related information is sent to the terminal: The core network updates the security key of the target cell based on the AMF key; The core network updates the AMF key; Traditional switchover or conditional switchover or dual-active protocol stack switchover occurs.

37. A secure processing device comprising: A determination module, configured to determine a security key corresponding to a target cell based on security related information; The target cell is a candidate target cell that supports continuous cell change.

38. The secure processing device according to claim 37, wherein: The security related information includes one or more of the following: Security parameter information; Security update instructions; first group identification information; second group identification information; Security key counter list.

39. The secure processing device according to claim 37, wherein: In a case where the security related information is security parameter information and / or security update indication information, the determining module includes: The first determining unit is configured to determine a security key corresponding to the target cell based on the security parameter information and / or security update indication information included in the configuration information of the target cell.

40. The secure processing device according to claim 39, wherein: The security update indication information includes one or more of the following: Information indicating whether a key update is required for this cell change; Indicates whether the value of the security parameter information corresponding to this cell change needs to be increased by one. interest; Information indicating whether the value of the security parameter information after the security key update corresponding to this cell change needs to be increased by one.

41. The secure processing device of claim 37, wherein: In the case where the security related information is first group identification information, the determining module includes: A second determining unit is configured to determine, when the first group identification information of the source cell is the same as the first group identification information of the target cell, that the security key corresponding to the target cell is the current security key; or, The acquisition unit is used to update the security key when the first group identification information of the source cell is different from the first group identification information of the target cell, and obtain the security key corresponding to the target cell.

42. The secure processing device according to claim 41, wherein: The determination module also includes: a calculation unit, configured to, when the second group identification information of the source cell is different from the second group identification information of the target cell, increase the value of the security parameter information by one after updating the security key; or, The third determining unit is configured to determine that the value of the security parameter information remains unchanged after the security key is updated when the second group identification information of the source cell is the same as the second group identification information of the target cell.

43. The secure processing device of claim 37, wherein: The determination module comprises: a fourth determining unit, configured to determine a security key counter list corresponding to the target cell from the security-related information, or to generate a security key counter list corresponding to the target cell based on the security-related information; The fifth determining unit is configured to determine the security key corresponding to the target cell based on the security key counter value of the source cell and the security key counter list corresponding to the target cell.

44. The secure processing device according to claim 43, wherein: The fifth determining unit includes: A first determining subunit is configured to determine, when the security key counter value of the source cell is in the security key counter list corresponding to the target cell, that the security key corresponding to the target cell is the current security key; or, The first acquisition subunit is configured to update the security key to obtain the security key corresponding to the target cell when the security key counter value of the source cell is not in the security key counter list corresponding to the target cell.

45. The secure processing device of claim 43, wherein: The fifth determining unit includes: A second determining subunit is configured to determine that the security key corresponding to the target cell is the current security key when the last security key counter value in the security key counter list corresponding to the target cell is equal to the security key counter value of the source cell; or The second acquisition subunit is used to update the security key to obtain the security key corresponding to the target cell when the last security key counter value in the security key counter list corresponding to the target cell is greater than the security key counter value of the source cell.

46. ​​The secure processing device of claim 43, wherein: The fourth determining unit includes: The third acquisition subunit is configured to generate a security key counter list corresponding to the target cell based on the security key counter initial value and the global step size included in the security-related information.

47. A secure processing device according to any one of claims 41 to 43, wherein: The first group identification information or the second group identification information or the security key counter list is included in candidate target cell configuration information.

48. The secure processing device of claim 37, wherein: Also includes: The receiving module is used to receive candidate target cell configuration information and / or security related information sent by the network device.

49. The secure processing device of claim 37, wherein: The security related information is sent by one or more of the following signaling: Radio Resource Control RRC signaling; Media Access Control Element MAC CE signaling; Downlink control information DCI signaling.

50. A secure processing device comprising: A sending module, used to send candidate target cell configuration information and / or security related information to the terminal; The security related information is used to determine the security key corresponding to the target cell; The target cell is a candidate target cell that supports continuous cell change.

51. The secure processing device of claim 50, wherein: The security related information includes one or more of the following: Security parameter information; Security update instructions; first group identification information; second group identification information; Security key counter list.

52. The secure processing device of claim 51, wherein: The security update indication information includes one or more of the following: Information indicating whether a key update is required for this cell change; Information indicating whether the value of the security parameter information corresponding to this cell change needs to be increased by one; Information indicating whether the value of the security parameter information after the key update corresponding to this cell change needs to be increased by one.

53. The secure processing device of claim 50, wherein: The security related information is sent by one or more of the following signaling: RRC signaling; MAC CE signaling; DCI signaling.

54. The secure processing device of claim 50, wherein: The sending module comprises: A sending unit is used to send security related information to the terminal in one or more of the following situations: The core network updates the security key of the target cell based on the access and mobility management function network element AMF key; The core network updates the AMF key; Traditional switchover or conditional switchover or dual-active protocol stack switchover occurs.

55. A non-transitory readable storage medium storing a computer program, wherein the computer program is used to cause a processor to execute the security processing method according to any one of claims 1 to 13.

56. A non-transitory readable storage medium storing a computer program, wherein the computer program is used to cause a processor to execute the security processing method according to any one of claims 14 to 18.

Images