Data security protection method and communication apparatus

Abstract

The present application provides a data security protection method and a communication apparatus. The method comprises: on the basis of a first key, a distributed unit (DU) performs security protection on first data to obtain second data, the first data comprising a low-layer radio resource control (RRC) message, and the security protection comprising encryption protection and / or integrity protection; and the DU sends the second data to a terminal. The solution can reduce the transmission delay of low-layer RRC messages, thus improving transmission efficiency.

Description

Data security protection method and communication device

[0001] This application claims priority to the Chinese patent application filed with the China Patent Office on September 7, 2023, with application number 202311156354.0 and application name “Data Security Protection Method and Communication Device”, the entire contents of which are incorporated by reference into this application. Technical Field

[0002] The present application relates to the field of communications, and more particularly, to a data security protection method and a communication device. Background Art

[0003] A radio access network (RAN) can include multiple RAN nodes, which implement different RAN functions. Access network nodes can include centralized units (CUs) and distributed units (DUs). The CU is primarily responsible for implementing the non-real-time wireless high-layer protocol stack functions of the RAN. The DU is primarily responsible for implementing the RAN's physical layer functions and real-time functions.

[0004] Currently, due to security requirements, when a DU decides to configure a terminal, it must encapsulate the configuration information in a radio resource control (RRC) container, which is then transparently transmitted to the terminal by the CU. This means the DU first sends the information to the CU, which then encapsulates it into an RRC message and sends it to the terminal via the DU. This results in a longer transmission delay for the RRC message generated by the DU, leading to lower transmission efficiency.

[0005] Summary of the Invention

[0006] The embodiments of the present application provide a data security protection method and a communication device, which can reduce the transmission delay of low-layer RRC messages and improve transmission efficiency.

[0007] In a first aspect, a data security protection method is provided, which can be executed by a distributed unit DU in an access network.

[0008] The method includes: a DU performs security protection on first data based on a first key to obtain second data, wherein the first data includes a radio resource control (RRC) message from a lower layer, and the security protection includes encryption protection and / or integrity protection. The DU sends the second data to a terminal.

[0009] Based on the above solution, this application proposes to enhance the functionality of the DU to provide security protection. The DU can, based on a first key, perform security protection on first data containing a low-layer RRC message and send it to the terminal. This can prevent the low-layer RRC message from being transmitted from the DU to the CU, encapsulated by the CU, and then sent to the terminal via the DU while ensuring security, thereby reducing transmission latency.

[0010] In the present application, the network side may send an RRC message to the terminal, wherein the low-layer RRC message may be information determined or generated by the DU and requiring encryption protection and / or integrity protection; or, the low-layer RRC message may be information related to at least one layer of configuration information among the RLC layer, the MAC layer, and the PHY layer; or, the low-layer RRC message may be information related to at least one layer of the RLC layer, the MAC layer, and the PHY layer, and requiring encryption protection and / or integrity protection; or, the low-layer RRC message may be information requiring encryption protection and / or integrity protection at one of the RLC layer, the MAC layer, and the PHY layer.

[0011] Exemplarily, the first key may be referred to as a DU key, or may be referred to as a root key of the DU. The first key is used to derive an encryption key and / or an integrity protection key. The encryption key is used to encrypt and protect the first data, and the integrity protection key is used to protect the integrity of the first data.

[0012] In one implementation, the method further includes: the DU generating the first key based on the access stratum key and a first parameter, where the first parameter includes one or more of the following:

[0013] DU key count value, F1AP identifier allocated by DU to the terminal, F1AP identifier allocated by CU to the terminal, cell radio network temporary identifier C-RNTI, identifier of the radio bearer corresponding to the first data, or identifier of the logical channel corresponding to the first data.

[0014] According to the above solution, the DU can generate the first key based on the access layer key and the first parameter, thereby achieving security protection for the low-layer RRC message.

[0015] In another implementation, the method further includes: the DU receiving first information from a centralized unit CU, where the first information is used to indicate the first key.

[0016] According to the above solution, the DU can obtain the first key from the CU to implement security protection for low-layer RRC messages.

[0017] In combination with the first aspect, in certain implementations of the first aspect, the first data corresponds to a first logical channel, and the first logical channel is a logical channel corresponding to a low-layer RRC message; or, the wireless bearer associated with the first logical channel is a wireless bearer corresponding to the RRC message.

[0018] According to the above solution, the first logical channel corresponding to the first data can be a logical channel corresponding to a low-layer RRC message, or can be a logical channel associated with a radio bearer corresponding to the low-layer RRC message. This allows the terminal to determine, after receiving the second data, that the first key is used to perform security protection on the second data to obtain the first data.

[0019] In conjunction with the first aspect, in certain implementations of the first aspect, the method further includes: the DU determining that the logical channel corresponding to the low-layer RRC message is the first logical channel. The DU sends second information to the CU, where the second information is used to indicate that the logical channel corresponding to the low-layer RRC message is the first logical channel.

[0020] According to the above scheme, the DU can determine the logical channel corresponding to the low-layer RRC message and notify the CU so that the CU can notify the terminal so that the terminal and the DU reach a consensus on the logical channel corresponding to the low-layer RRC message.

[0021] In combination with the first aspect, in some implementations of the first aspect, the header field of the second data includes third information, and the third information is used to indicate that the second data includes the RRC message, or to indicate that the second data is associated with the first key.

[0022] According to the above solution, the terminal can determine, based on the third information in the header field of the second data, to use the first key to protect the second data, thereby obtaining the first data. This allows the DU and the terminal to reach a consensus on the first key to be used for the second data, thereby achieving reliable transmission of the first data.

[0023] In combination with the first aspect, in certain implementations of the first aspect, the DU performs security protection on the first data based on the first key to obtain the second data, including: the DU performs security protection on the first data based on the first key and adopts the first security algorithm corresponding to the security protection to obtain the second data.

[0024] In conjunction with the first aspect, in certain implementations of the first aspect, the method further includes: the DU receiving fourth information from the CU, the fourth information being used to indicate security capabilities supported by the terminal, and the DU determining the first security algorithm based on the security capabilities supported by the terminal.

[0025] Exemplarily, the security capabilities supported by the terminal may include capabilities of security algorithms supported by the terminal.

[0026] According to the above solution, the DU can obtain the security capabilities supported by the terminal from the CU. The DU determines to use the first security algorithm to protect the low-layer RRC messages based on the security capabilities supported by the terminal. This enables the DU to select a security algorithm that matches the terminal's capabilities and to protect the low-layer RRC messages sent to the terminal.

[0027] In conjunction with the first aspect, in certain implementations of the first aspect, the method further includes: the DU receiving fifth information from the CU, the fifth information being used to indicate a security algorithm set. The DU determining the first security algorithm based on security capabilities supported by the terminal includes: the DU determining the first security algorithm from the security algorithm set based on the security capabilities supported by the terminal.

[0028] In combination with the first aspect, in some implementations of the first aspect, the method further includes: the DU sending sixth information to the CU, where the sixth information is used to indicate the first security algorithm.

[0029] According to the above solution, after the DU determines the first security algorithm, it can notify the CU, so that the CU notifies the terminal of the first security algorithm determined by the DU, so that the DU and the terminal reach a consensus on the first security algorithm and realize reliable transmission of low-layer RRC messages.

[0030] In combination with the first aspect, in some implementations of the first aspect, the method further includes: the DU receiving seventh information from the CU, where the seventh information is used to indicate the first security algorithm.

[0031] In a second aspect, a data transmission method is provided, which can be executed by a terminal or a module (such as a chip) configured in (or used for) a terminal. The following description takes the execution of the method by a terminal as an example.

[0032] The method includes: a terminal receiving second data, where the second data is obtained based on security protection of first data; the terminal performing security protection on the second data based on a first key to obtain first data, where the first data includes a low-layer radio resource control (RRC) message, and the security protection includes encryption protection and / or integrity protection.

[0033] Specifically, the terminal performs security protection on the second data based on the first key to obtain the first data, which may include: the terminal decrypts the second data based on an encryption key derived from the first key to obtain the first data; and / or the terminal performs integrity protection on the second data based on an integrity protection key derived from the first key to obtain the first data.

[0034] In conjunction with the second aspect, in certain implementations of the second aspect, the method further includes: the terminal generating the first key based on the access layer key and the first parameter, where the first parameter includes one or more of the following:

[0035] DU key count value, F1AP identifier allocated by DU to the terminal, F1AP identifier allocated by CU to the terminal, cell radio network temporary identifier C-RNTI, identifier of the radio bearer corresponding to the first data, or identifier of the logical channel corresponding to the first data.

[0036] In combination with the second aspect, in some implementations of the second aspect, the method further includes: the terminal receiving eighth information from a centralized unit CU, where the eighth information is used to indicate the first parameter.

[0037] In conjunction with the second aspect, in certain implementations of the second aspect, the method further includes: the terminal receiving ninth information from the CU, the ninth information being used to indicate that the logical channel corresponding to the low-layer RRC message is a first logical channel. The terminal determines, based on the second data including data of the first logical channel, to use the first key to perform security protection on the second data.

[0038] In conjunction with the second aspect, in certain implementations of the second aspect, the method further includes: the terminal receiving tenth information from the CU, the tenth information being used to indicate a radio bearer corresponding to the low-layer RRC message. The terminal determines, based on the second data including data of a first logical channel, and the radio bearer associated with the first logical channel being the radio bearer, to use the first key to perform security protection on the second data.

[0039] In combination with the second aspect, in some implementations of the second aspect, the header field of the second data includes third information, and the third information is used to indicate that the second data includes the low-layer RRC message, or to indicate that the second data is associated with the first key.

[0040] In combination with the second aspect, in certain implementations of the second aspect, the terminal performs security protection on the second data based on the first key to obtain the first data, including: the terminal performs security protection on the second data based on the first key and adopts the first security algorithm corresponding to the security protection to obtain the first data.

[0041] In combination with the second aspect, in some implementations of the second aspect, the method further includes: the terminal receiving eleventh information from the CU, where the eleventh information is used to indicate the first security algorithm.

[0042] In a third aspect, a data security protection method is provided, which can be executed by a CU in an access network.

[0043] The method includes: a centralized unit CU sends twelfth information to a DU, the twelfth information is used by the DU to determine a first key, the first key is used for security protection of the low-layer RRC message, the security protection includes security protection and / or integrity protection. The CU sends a first parameter to a terminal, the first parameter is used by the terminal to determine the first key, the first parameter includes one or more of the following:

[0044] DU key count value, F1AP identifier allocated by DU to the terminal, F1AP identifier allocated by CU to the terminal, cell radio network temporary identifier C-RNTI, identifier of the radio bearer corresponding to the first data, or identifier of the logical channel corresponding to the first data.

[0045] In combination with the third aspect, in certain implementations of the third aspect, the method further includes: the CU determines the first key based on the access layer key and the first parameter, wherein the twelfth information includes the first key.

[0046] In combination with the third aspect, in some implementations of the third aspect, the twelfth information includes an access layer key, or the twelfth information includes the access layer key and the first parameter.

[0047] In conjunction with the third aspect, in certain implementations of the third aspect, the method further includes: receiving, by the CU, second information from the DU, the second information being used to indicate that the logical channel corresponding to the low-layer RRC message is a first logical channel. The CU sends, by the UE, ninth information to the terminal, the ninth information being used to indicate that the logical channel is the first logical channel.

[0048] In combination with the third aspect, in certain implementations of the third aspect, the method further includes: the CU sending tenth information to the terminal, where the tenth information is used to indicate a radio bearer corresponding to the low-layer RRC message.

[0049] In conjunction with the third aspect, in certain implementations of the third aspect, the method further includes: the CU sending fourth information to the DU, the fourth information being used to indicate security capabilities supported by the terminal. The CU receiving sixth information from the DU, the sixth information being used to indicate a first security algorithm, the first security algorithm being an algorithm used for security protection of the low-layer RRC message. The CU sending eleventh information to the terminal, the eleventh information being used to indicate the first security algorithm.

[0050] In combination with the third aspect, in certain implementations of the third aspect, the method further includes: the CU sending fifth information to the DU, where the fifth information is used to indicate a security algorithm set, and the security algorithm set is used by the DU to determine the first security algorithm.

[0051] In conjunction with the third aspect, in certain implementations of the third aspect, the method further includes: the CU sending seventh information to the DU, the seventh information being used to indicate a first security algorithm, where the first security algorithm is an algorithm used for security protection of the low-layer RRC message. The CU sending eleventh information to the terminal, where the eleventh information is used to indicate the first security algorithm.

[0052] In a fourth aspect, a communication device is provided. In one design, the device may include a module corresponding to each of the methods / operations / steps / actions described in the first aspect or any one of the embodiments of the first aspect. The module may be a hardware circuit, software, or a combination of a hardware circuit and software. In one design, the device includes: a processing unit, configured to perform security protection on first data based on a first key to obtain second data, the first data including a low-layer radio resource control RRC message, the security protection including encryption protection and / or integrity protection. A transceiver unit, configured to send the second data to a terminal.

[0053] In combination with the fourth aspect, in certain implementations of the fourth aspect, the DU generates the first key based on the access layer key and the first parameter, wherein the first parameter can refer to the description of the first aspect and will not be repeated here.

[0054] In combination with the fourth aspect, in some implementations of the fourth aspect, the transceiver unit is further used to receive first information from a centralized unit CU, where the first information is used to indicate the first key.

[0055] In conjunction with the fourth aspect, in certain implementations of the fourth aspect, the processing unit is further configured to determine that the logical channel corresponding to the low-layer RRC message is the first logical channel. The transceiver unit is further configured to send second information to the CU, where the second information is configured to indicate that the logical channel corresponding to the low-layer RRC message is the first logical channel.

[0056] In combination with the fourth aspect, in certain implementations of the fourth aspect, the processing unit is specifically used to perform the security protection on the first data based on the first key and adopt a first security algorithm corresponding to the security protection to obtain the second data.

[0057] In conjunction with the fourth aspect, in certain implementations of the fourth aspect, the transceiver unit is further configured to receive fourth information from the CU, the fourth information being configured to indicate security capabilities supported by the terminal. The processing unit is further configured to determine the first security algorithm based on the security capabilities supported by the terminal.

[0058] In conjunction with the fourth aspect, in certain implementations of the fourth aspect, the transceiver unit is further configured to receive fifth information from the CU, where the fifth information is used to indicate a security algorithm set. The processing unit is specifically configured to determine the first security algorithm in the security algorithm set based on security capabilities supported by the terminal.

[0059] In a fifth aspect, a communication device is provided. In one design, the device may include a module corresponding to each of the methods / operations / steps / actions described in the second aspect or any one of the embodiments of the second aspect. The module may be a hardware circuit, software, or a combination of a hardware circuit and software. In one design, the device includes: a transceiver unit for receiving second data, where the second data is obtained based on security protection of the first data. A processing unit for performing security protection on the second data based on a first key to obtain first data, where the first data includes a low-layer radio resource control RRC message, and the security protection includes encryption protection and / or integrity protection.

[0060] In conjunction with the fifth aspect, in certain implementations of the fifth aspect, the processing unit is further configured to generate the first key based on the access layer key and a first parameter. The first parameter may be described in the second aspect and will not be repeated here.

[0061] In combination with the fifth aspect, in certain implementations of the fifth aspect, the transceiver unit is further used to receive eighth information from a centralized unit CU, where the eighth information is used to indicate the first parameter.

[0062] In conjunction with the fifth aspect, in certain implementations of the fifth aspect, the transceiver unit is further configured to receive ninth information from the CU, where the ninth information is configured to indicate that the logical channel corresponding to the low-layer RRC message is the first logical channel. The processing unit is further configured to determine, based on the second data including data of the first logical channel, to use the first key to perform security protection on the second data.

[0063] In conjunction with the fifth aspect, in certain implementations of the fifth aspect, the transceiver unit is further configured to receive tenth information from the CU, the tenth information being used to indicate the radio bearer corresponding to the low-layer RRC message. The processing unit is further configured to determine, based on the second data including data of a first logical channel, the radio bearer associated with the first logical channel being the radio bearer, to use the first key to perform security protection on the second data.

[0064] In combination with the fifth aspect, in certain implementations of the fifth aspect, the processing unit is specifically used to perform security protection on the second data based on the first key and adopt a first security algorithm corresponding to the security protection to obtain the first data.

[0065] In combination with the fifth aspect, in certain implementations of the fifth aspect, the transceiver unit is further used to receive eleventh information from the CU, where the eleventh information is used to indicate the first security algorithm.

[0066] In the sixth aspect, a communication device is provided. In one design, the device may include a module corresponding to the method / operation / step / action described in the third aspect or any one of the embodiments of the third aspect. The module may be a hardware circuit, software, or a combination of a hardware circuit and software. In one design, the device includes: a processing unit for determining twelfth information, the twelfth information is used by the DU to determine a first key, the first key is used for security protection of the low-layer RRC message, and the security protection includes security protection and / or integrity protection. A transceiver unit for sending the twelfth information to the DU. The transceiver unit is also used to send a first parameter to the terminal, the first parameter is used by the terminal to determine the first key. The first parameter can refer to the description in the third aspect and will not be repeated here.

[0067] In combination with the sixth aspect, in certain implementations of the sixth aspect, the processing unit is further used to determine the first key based on the access layer key and the first parameter, wherein the twelfth information includes the first key.

[0068] In conjunction with the sixth aspect, in certain implementations of the sixth aspect, the transceiver unit is further configured to receive second information from the DU, the second information being used to indicate that the logical channel corresponding to the low-layer RRC message is the first logical channel. The transceiver unit is further configured to send ninth information to the terminal, the ninth information being used to indicate that the logical channel corresponding to the low-layer RRC message is the first logical channel.

[0069] In combination with the sixth aspect, in certain implementations of the sixth aspect, the transceiver unit is further used to send tenth information to the terminal, where the tenth information is used to indicate the radio bearer corresponding to the low-layer RRC message.

[0070] In conjunction with the sixth aspect, in certain implementations of the sixth aspect, the transceiver unit is further configured to send fourth information to the DU, the fourth information being used to indicate security capabilities supported by the terminal. The transceiver unit is further configured to receive sixth information from the DU, the sixth information being used to indicate a first security algorithm, the first security algorithm being an algorithm used for security protection of the low-layer RRC message. The transceiver unit is further configured to send eleventh information to the terminal, the eleventh information being used to indicate the first security algorithm.

[0071] In combination with the sixth aspect, in certain implementations of the sixth aspect, the transceiver unit is further used to send fifth information to the DU, where the fifth information is used to indicate a security algorithm set, and the security algorithm set is used by the DU to determine the first security algorithm.

[0072] In conjunction with the sixth aspect, in certain implementations of the sixth aspect, the transceiver unit is further configured to send seventh information to the DU, where the seventh information is used to indicate a first security algorithm, where the first security algorithm is an algorithm used for security protection of the low-layer RRC message. The transceiver unit is further configured to send eleventh information to the terminal, where the eleventh information is used to indicate the first security algorithm.

[0073] In a seventh aspect, a communication device is provided, comprising a processor. The processor can implement the method in any possible implementation of the first to third aspects and the first to third aspects above. Optionally, the communication device further comprises a memory, the processor is coupled to the memory, and can be used to execute instructions in the memory to implement the method in any possible implementation of the first to third aspects and the first to third aspects above. Optionally, the communication device further comprises a communication interface, and the processor is coupled to the communication interface. In an embodiment of the present application, the communication interface can be a transceiver, a pin, a circuit, a bus, a module, or other types of communication interfaces, without limitation.

[0074] In one implementation, the communication apparatus is a communication device (such as a terminal or an access network device). When the communication apparatus is a communication device, the communication interface may be a transceiver or an input / output interface.

[0075] In another implementation, the communication device is a chip configured in a communication device. When the communication device is a chip configured in a communication device, the communication interface may be an input / output interface.

[0076] Optionally, the transceiver may be a transceiver circuit. Optionally, the input / output interface may be an input / output circuit.

[0077] In an eighth aspect, a processor is provided, comprising: an input circuit, an output circuit, and a processing circuit. The processing circuit is configured to receive a signal through the input circuit and transmit a signal through the output circuit, so that the processor executes the method of any possible implementation of the first to third aspects and any possible implementation of the first to third aspects.

[0078] In a specific implementation, the processor may be one or more chips, the input circuit may be an input pin, the output circuit may be an output pin, and the processing circuit may be a transistor, a gate circuit, a trigger, or various logic circuits. The input signal received by the input circuit may be, for example, but not limited to, received and input by a receiver, and the signal output by the output circuit may be, for example, but not limited to, output to and transmitted by a transmitter. The input circuit and the output circuit may be the same circuit, which functions as an input circuit and an output circuit at different times. The embodiments of the present application do not limit the specific implementation of the processor and various circuits.

[0079] In the ninth aspect, a computer program product is provided, which includes: a computer program (also referred to as code, or instructions), which, when executed, enables a computer to execute the method in the above-mentioned first to third aspects and any possible implementation of the first to third aspects.

[0080] In the tenth aspect, a computer-readable storage medium is provided, which stores a computer program (also referred to as code, or instructions) which, when run on a computer, enables the computer to execute the method in the above-mentioned first to third aspects and any possible implementation of the first to third aspects.

[0081] In an eleventh aspect, a communication system is provided, comprising the aforementioned at least one DU and the aforementioned at least one CU. Optionally, the communication system further comprises the aforementioned at least one terminal. BRIEF DESCRIPTION OF THE DRAWINGS

[0082] FIG1 is a schematic diagram of a communication system architecture provided by an embodiment of the present application;

[0083] FIG2 is a schematic structural diagram of an access network device provided in an embodiment of the present application;

[0084] FIG3 is a schematic diagram of a protocol stack provided in an embodiment of the present application;

[0085] FIG4 is a schematic diagram of the protocol stack of the CU and DU provided in an embodiment of the present application;

[0086] FIG5 is another schematic diagram of the protocol stack of the CU and DU provided in an embodiment of the present application;

[0087] FIG6 is a schematic diagram of the data encryption process provided in an embodiment of the present application;

[0088] FIG7 is a schematic diagram of data integrity protection provided by an embodiment of the present application;

[0089] FIG8 is a schematic diagram of a key derivation architecture provided in an embodiment of the present application;

[0090] FIG9 is a schematic flow chart of a data security protection method provided in an embodiment of the present application;

[0091] FIG10 is another schematic flow chart of a data security protection method provided in an embodiment of the present application;

[0092] FIG11 is another schematic flow chart of a data security protection method provided in an embodiment of the present application;

[0093] FIG12 is a schematic block diagram of an example of a communication device provided in an embodiment of the present application;

[0094] FIG13 is a schematic structural diagram of another example of a communication device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0095] The technical solution in this application will be described below with reference to the accompanying drawings.

[0096] In the embodiments of this application, " / " can indicate that the objects associated with each other are in an "or" relationship. For example, A / B can mean A or B. "And / or" can be used to describe the existence of three relationships between the associated objects. For example, "A and / or B" can mean: A exists alone, A and B exists simultaneously, and B exists alone. A and B can be singular or plural. To facilitate the description of the technical solutions of the embodiments of this application, the words "first" and "second" can be used to distinguish them in the embodiments of this application. The words "first" and "second" do not limit the quantity or order of execution, and the words "first" and "second" do not necessarily mean different. In the embodiments of this application, words such as "exemplary" or "for example" are used to indicate examples, illustrations, or explanations. Any embodiment or design described as "exemplary" or "for example" should not be construed as preferred or advantageous over other embodiments or designs. The use of words such as "exemplary" or "for example" is intended to present the relevant concepts in a concrete way to facilitate understanding. In the embodiments of the present application, at least one (kind) can also be described as one (kind) or multiple (kinds), and multiple (kinds) can be two (kinds), three (kinds), four (kinds) or more (kinds), and this application does not limit it.

[0097] The technical solutions of the embodiments of the present application can be applied to various communication systems, such as long-term evolution (LTE) systems, fifth-generation (5G) communication systems, such as new radio (NR) in 5G communication systems, wireless fidelity (WiFi) systems, and the communication method provided in this application can also be applied to sixth-generation (6G) communication systems and other communication systems evolved after 5G, future communication systems, or other communication systems. This application is not limited to this.

[0098] Figure 1 is a schematic diagram illustrating a possible, non-limiting system. As shown in Figure 1 , communication system 10 includes a RAN 100 and a core network (CN) 200. RAN 100 includes at least one RAN node (e.g., 110a and 110b in Figure 1 , collectively referred to as 110) and at least one terminal (e.g., 120a-120j in Figure 1 , collectively referred to as 120). RAN 100 may also include other RAN nodes, such as wireless relay equipment and / or wireless backhaul equipment (not shown in Figure 1 ). Terminal 120 is wirelessly connected to an access network node (or RAN node) 110. Access network node 110 is connected to core network 200 via wireless or wired connections. The core network equipment in core network 200 and access network node 110 in RAN 100 can be separate physical devices, or they can be a single physical device that integrates core network logical functions and radio access network logical functions.

[0099] The RAN 100 may be a cellular system related to the Third Generation Partnership Project (3GPP), such as a 4G or 5G mobile communication system, or a future-oriented evolutionary system (such as a 6G mobile communication system). The RAN 100 may also be an open access network (O-RAN or ORAN), a cloud radio access network (CRAN), or a wireless fidelity (WiFi) system. The RAN 100 may also be a communication system that integrates two or more of the above systems.

[0100] Access network node 110, sometimes also referred to as access network equipment, RAN entity, or access node, constitutes part of the communication system and facilitates wireless access for terminals. Multiple access network nodes 110 in the communication system 10 can be of the same type or different types. In some scenarios, the roles of access network node 110 and terminal 120 are relative. For example, network element 120i in Figure 1 can be a helicopter or drone, which can be configured as a mobile base station. For terminal 120j accessing RAN 100 via network element 120i, network element 120i is a base station; however, for base station 110a, network element 120i is a terminal. Access network node 110 and terminal 120 are sometimes referred to as communication devices. For example, network elements 110a and 110b in Figure 1 can be understood as communication devices with base station functionality, and network elements 120a-120j can be understood as communication devices with terminal functionality.

[0101] In one possible scenario, the access network node may be a base station, an evolved NodeB (eNodeB), an access point (AP), a transmission reception point (TRP), a next generation NodeB (gNB), a next generation base station in a sixth generation (6G) mobile communication system, a base station in a future mobile communication system, or an access node in a WiFi system. The access network node may be a macro base station (such as 110a in FIG1 ), a micro base station or an indoor station (such as 110b in FIG1 ), a relay node or a donor node, or a wireless controller in a CRAN scenario. Optionally, the access network node may also be a server, a wearable device, a vehicle or an onboard device, etc. For example, the access network device in the vehicle to everything (V2X) technology may be a road side unit (RSU). All or part of the functions of the access network node in this application may also be implemented by software functions running on hardware, or by virtualization functions instantiated on a platform (such as a cloud platform). The access network node in this application may also be a logical node, a logical module or software that can implement all or part of the access network node functions.

[0102] In another possible scenario, multiple access network nodes collaborate to assist the terminal in achieving wireless access, and different access network nodes respectively implement part of the functions of the access network equipment. For example, as shown in Figure 2, the access network node can be a centralized unit (CU), a distributed unit (DU), a CU-control plane (CP), a CU-user plane (UP), or a radio unit (RU). The CU and DU can be set separately, or they can be included in the same network element, such as a baseband unit (BBU). The RU can be included in a radio frequency device or radio frequency unit, such as a remote radio unit (RRU), an active antenna unit (AAU), or a remote radio head (RRH).

[0103] In different systems, CU (or CU-CP and CU-UP), DU or RU may also have different names, but those skilled in the art can understand their meanings. For example, in the ORAN system, CU may also be called O-CU (Open CU), DU may also be called O-DU, CU-CP may also be called O-CU-CP, CU-UP may also be called O-CU-UP, and RU may also be called O-RU. For the convenience of description, this application uses CU, CU-CP, CU-UP, DU and RU as examples for description. Any unit of CU (or CU-CP, CU-UP), DU and RU in this application can be implemented by a software module, a hardware module, or a combination of a software module and a hardware module.

[0104] A terminal may also be referred to as a terminal device, user equipment (UE), mobile station, or mobile terminal. A terminal can be widely used in various scenarios for communication. These scenarios include, but are not limited to, at least one of the following: enhanced mobile broadband (eMBB), ultra-reliable low-latency communication (URLLC), massive machine-type communications (mMTC), device-to-device (D2D), vehicle-to-everything (V2X), machine-type communication (MTC), Internet of Things (IoT), virtual reality, augmented reality, industrial control, autonomous driving, telemedicine, smart grid, smart furniture, smart office, smart wearables, smart transportation, sensing terminals, terminals integrating communication and sensing, or smart cities. The terminal can be a mobile phone (such as 120a, 120j and 120e in Figure 1), a tablet computer, a computer with wireless transceiver function (such as 120g in Figure 1), customer-premises equipment (CPE), a smart point of sale (POS) machine, a wearable device, a vehicle (such as 120b in Figure 1), a drone, a helicopter, an airplane (such as 120i in Figure 1), a ship, a robot, a robotic arm, a sensor, a perception device, or a smart home device (such as 120h in Figure 1), etc.

[0105] The communication between the access network device and the terminal follows a certain protocol layer structure. As shown in Figure 3, the protocol layer structure may include a control plane protocol layer structure and a user plane protocol layer structure. For example, the control plane protocol layer structure may include the functions of at least one of the following protocol layers: radio resource control (RRC) layer, packet data convergence protocol (PDCP) layer, radio link control (RLC) layer, media access control (MAC) layer or physical (PHY) layer. For example, the user plane protocol layer structure may include the functions of at least one of the following protocol layers: PDCP layer, RLC layer, MAC layer or physical layer, etc. In one possible implementation, a service data adaptation protocol (SDAP) layer may also be included above the PDCP layer.

[0106] The protocol layer structure between the access network device and the terminal can be regarded as the access stratum (AS) structure. Optionally, a non-access stratum (NAS) may exist above the AS to enable the access network device to forward information from the core network device to the terminal, or to enable the access network device to forward information from the terminal to the core network device. In this case, it can be considered that there is a logical interface between the terminal and the core network device. The access network device can forward information between the terminal and the core network device in a transparent manner. For example, NAS signaling can be mapped to or included in RRC signaling as an element of RRC signaling.

[0107] The following focuses on the RRC layer and PDCP layer related to the embodiments of the present application. The RRC layer is mainly responsible for the control plane processes related to the radio access network. Its main functions include but are not limited to the following:

[0108] -AS and NAS related system message broadcast;

[0109] -Transmitting paging messages from core network or access network equipment to notify the terminal of the received connection request. When the terminal is not connected to a cell and is in the RRC idle (RRC_IDLE) state, the system pages the terminal;

[0110] - Establish, maintain, and release RRC connections between terminals and access network equipment, including adding, modifying, and releasing carrier aggregation (CA) and dual connection (DC);

[0111] - Security features including key management;

[0112] - Establish, configure, maintain and release signaling radio bearers (SRBs) and data radio bearers (DRBs);

[0113] - Mobility management, including but not limited to handover, context information transfer, cell selection and reselection, control of cell selection and reselection, inter-system mobility, etc.;

[0114] -Quality of service (QoS) management function;

[0115] -Measurement reporting and reporting control: create, modify, send measurement information and receive measurement reports;

[0116] - Radio link failure (RLF) detection and recovery;

[0117] -Forwarding of NAS messages.

[0118] The PDCP layer's primary functions include, but are not limited to, adding sequence numbers (SNs) to data units, internet protocol (IP) header compression, integrity protection, encryption, adding a PDCP header to data, and retransmission. Data processing at the receiving end is the reverse of the transmitting end's: PDCP header removal, decryption, integrity verification, reordering, and header decompression.

[0119] In some deployments, an access network node may include a CU and a DU. The CU may implement some protocol layer functions of the access network device, while the DU may implement some protocol layer functions of the access network device. As shown in Figure 4, the CU may be responsible for processing non-real-time protocols and services. For example, the CU may implement the functions of the RRC layer, SDAP layer, and PDCP layer. The DU may be responsible for processing physical layer protocols and real-time services. For example, it may implement the functions of the RLC layer, MAC layer, and PHY layer. A DU may be connected to only one CU or to multiple CUs, and a CU may be connected to multiple DUs. The CU and DUs may communicate via the F1 interface. The CU may further include a CU-CP and a CU-UP, as shown in Figure 5. The CU-CP may be responsible for control plane functions, such as implementing the RRC layer and PDCP layer control plane functions (PDCP-C). The CU-UP may be responsible for user plane functions, such as implementing the SDAP layer and PDCP layer user plane functions (PDCP-U). The CU-CP and CU-UP communicate via the E1 interface. The CU-CP may communicate with the core network on behalf of the access network device via the NG interface and with the DU via the F1-C interface. CU-UP can communicate with DU through the F1-U interface, but the present application is not limited to this.

[0120] This application does not limit the specific technology and specific device form adopted by the terminal. It should be understood that in this application, "sending information / data to... (such as a terminal)" can be understood as the destination end of the information being the terminal. It can include sending information / data directly or indirectly to the terminal. "Receiving information / data from... (such as a terminal)" can be understood as the source end of the information being the terminal, which can include receiving information / data directly or indirectly from the terminal. The information / data may be subjected to necessary processing between the source end and the destination end of the information / data transmission, such as format changes, etc., but the destination end can understand the valid information / data from the source end. Similar expressions in this application can be understood similarly and will not be repeated here.

[0121] In this application, "sending information / data" refers only to the direction of information / data transmission, including direct transmission over the air interface and indirect transmission by the processing unit through the air interface. "Sending" can also be understood as the "output" of the module interface. "Receiving information / data" refers only to the direction of information / data transmission, including direct reception over the air interface and indirect reception by the processing unit through the air interface. "Receiving" can also be understood as the "input" of the module interface.

[0122] The following is an introduction to the relevant technologies and terms involved in the embodiments of this application.

[0123] 1. Data security protection

[0124] Data security protection includes encryption protection and integrity protection, which are introduced below.

[0125] 1. Data encryption protection

[0126] Data encryption protection means that the data sender converts the data sent through a key stream, and the data receiver uses the same parameters to perform a reverse conversion to restore the data, thereby achieving the purpose of using ciphertext for transmission over the air interface to enhance data transmission security.

[0127] Taking 5G system encryption protection as an example, as shown in Figure 6, the PDCP layer can determine the NR encryption algorithm (NEA) based on higher-layer parameters. Encryption algorithms include NEA0, NEA1, NEA2, and NEA3. The input parameters of the encryption algorithm include the encryption key, PDCP packet count (Count), bearer identifier (Bearer ID), transmission direction (Direction), and the required key stream length (Length). A transmission direction of 0 indicates uplink, i.e., from the UE to the gNB, and a transmission direction of 1 indicates downlink, i.e., from the gNB to the UE. The transmitter generates a key stream based on the input parameters based on the encryption algorithm. This key stream is XORed with the input plaintext data stream to generate a ciphertext data stream. At the receiver, the same key stream is generated using the same input parameters and XORed with the ciphertext data stream to recover the plaintext data stream.

[0128] Among them, the uplink and downlink each correspond to a PDCP packet count value. The total length of the count value is 32 bits, consisting of the hyper frame number (HFN) as the high bit and the PDCP SN as the low bit. Only the PDCP SN will be added to the PDU for transmission. The HFN is maintained by the transmitter and receiver. The length of the HFN is 32-the length of the PDCP SN. When the PDCP packet count value corresponding to the uplink or downlink rolls over, a key update will be triggered to prevent the generation of duplicate key streams.

[0129] 2. Data integrity protection

[0130] Air interface integrity protection uses regularly changing parameters and transmitted data to calculate a message authentication code for integrity (MAC-I). During reception, the same parameters and the same rules are used to calculate an expected message authentication code for integrity (XMAC-I). The MAC-I and XMAC-I are then verified to determine if the data has been received completely, thereby protecting data integrity.

[0131] Taking the integrity protection of the 5G system as an example, as shown in Figure 7, the PDCP layer can determine the integrity protection algorithm (NR integrity algorithm, NIA) based on the high-level parameters. The integrity protection algorithms include NIA0, NIA1, NIA2, and NIA3. The input parameters of the integrity protection algorithm include the integrity protection key, PDCP packet count (Count), bearer ID, transmission direction, and the message itself to be integrity protected. Based on the input parameters of the integrity protection algorithm, the sender calculates a 32-bit (taking the 128-bit NIA algorithm as an example) MAC-I. Then, the MAC-I is attached to the message when sending the message. The receiving end uses the same method to calculate the XMAC-I of the received message and verifies the integrity of the message by comparing the MAC-I and XMAC-I.

[0132] 2. Hierarchical Key Derivation

[0133] Keys are an important input to encryption and integrity protection algorithms. These keys follow a hierarchical key derivation mechanism. Figure 8 shows a schematic diagram of key derivation in a 5G system. Table 1 lists the various keys and their derivation methods.

[0134] Table 1

[0135] The UE consists of the USIM (universal subscriber identity module) and ME (mobile equipment). The USIM provides user identity identification, and the ME provides applications and services, including deriving keys for the NAS and AS layers.

[0136] gNB based on the access layer key K gNBand security algorithms, and manage the key lifecycle such as generating or updating keys according to the key hierarchical derivation mechanism. Currently, the CU of the access network device can generate an RRC message and send it to the terminal. Each radio bearer (RB), except SRB0, corresponds to a PDCP entity. SRB0 does not have a corresponding PDCP entity. The RRC message is encrypted and integrity protected at the PDCP layer. When the DU decides to configure the terminal, the DU needs to encapsulate the configuration information in the RRC container and transparently transmit it to the terminal by the CU, that is, the DU is first sent to the CU, which encapsulates it into an RRC message and sends it to the terminal. The situations in which the DU configures the terminal may include but are not limited to the following:

[0137] -DU configures cell group information for the terminal. The cell group information is used to configure the primary cell group or the secondary cell group. The cell group includes a MAC entity, a set of logical information associated with the RLC entity, a special cell and one or more secondary cells.

[0138] -The DU makes a decision and indicates the decision result to the terminal. For example, the DU determines the target cell based on the layer 1 (L1) measurement result, or the DU infers a prediction result based on artificial intelligence (AI) / machine learning (ML) and uses the prediction result as the decision result.

[0139] In the present application, the network side may send an RRC message to the terminal, wherein the low-layer RRC message may be information determined or generated by the DU and requiring encryption protection and / or integrity protection; or the low-layer RRC message may be information related to configuration information of at least one layer among the RLC layer, MAC layer, and PHY layer; or the low-layer RRC message may be information related to at least one layer among the RLC layer, MAC layer, and PHY layer and requiring encryption protection and / or integrity protection; or the low-layer RRC message may be information requiring encryption protection and / or integrity protection at one of the RLC layer, MAC layer, and PHY layer. The terminal may also send an RRC message to the network side, wherein the low-layer RRC message may be information related to configuration information of at least one layer among the RLC layer, MAC layer, and PHY layer; or the low-layer RRC message may be information related to at least one layer among the RLC layer, MAC layer, and PHY layer and requiring encryption protection and / or integrity protection; or the low-layer RRC message may be information requiring encryption protection and / or integrity protection at one of the RLC layer, MAC layer, and PHY layer.

[0140] As previously described, low-layer RRC messages need to be transmitted from the DU to the CU, encapsulated by the CU, and then sent to the terminal via the DU. This results in a long transmission delay for low-layer RRC messages and low transmission efficiency. This is primarily due to the DU's lack of security protection. Therefore, this application proposes enhancing the DU's functionality to include security protection. The DU can perform security protection on low-layer RRC messages before sending them to the terminal, reducing the transmission delay and improving transmission efficiency.

[0141] 9 is a schematic flow chart of a data security protection method 900 provided in an embodiment of the present application. The method 900 includes but is not limited to the following steps S901 and S902.

[0142] S901, DU performs security protection on first data based on a first key to obtain second data, where the first data includes a low-layer RRC message, and the security protection includes encryption protection and / or integrity protection.

[0143] For example, the low-layer RRC message may be used to configure a cell group for the terminal, or the low-layer RRC message may be used to notify the terminal of a decision result obtained by the DU, such as a target cell of the terminal determined based on an L1 measurement result. However, the present application is not limited thereto, and the low-layer RRC message may also be an RRC message determined or generated by the RLC layer, MAC layer, or PHY layer for other functions and requiring security protection.

[0144] When the data includes a low-layer RRC message, the DU performs security protection on the data and then sends it to the terminal. Specifically, the DU performs security protection on the first data based on the first key to obtain the second data. The DU may obtain the first key in the following ways, but is not limited to.

[0145] In one embodiment, the CU sends first information to the DU, where the first information indicates a first key. The first key can be referred to as the DU's key, or as the DU's root key (the root key is used to derive an encryption key and / or an integrity protection key). Accordingly, the DU receives the first information from the CU and determines the first key based on the first information. The first key is used by the DU to generate an encryption key and / or an integrity protection key, and the encryption key is different from the integrity protection key.

[0146] If the first key is used to derive an encryption key, the DU may use the encryption key derived from the first key to encrypt and protect the first data. And / or, if the first key is used to derive an integrity protection key, the first DU may use the integrity protection key derived from the first key to integrity protect the first data. If the first key is used to derive both the encryption key and the integrity protection key, the DU may derive the encryption key and the integrity protection key based on the first key. The DU may use the encryption key derived from the first key to encrypt the first data to obtain third data, and then use the integrity protection key derived from the first key to integrity protect the third data to obtain second data.

[0147] The first key may be an access layer key, or may be derived / generated by the CU based on the access layer key and a first parameter, wherein the first parameter includes one or more of the following:

[0148] DU key count value, F1AP identifier assigned by DU to the terminal, F1AP identifier assigned by CU to the terminal, cell radio network temporary identifier (C-RNTI) of the terminal, identifier of the radio bearer corresponding to the first data, or identifier of the logical channel corresponding to the first data.

[0149] For example, the CU may maintain a DU key count value, generate the first key based on the access layer key and the DU key count value, and send the first key to the DU through the first information, so that the DU performs security protection on the first data based on the first key.

[0150] Specifically, the CU can maintain the DU key count value in the access layer security context. The CU sets the DU key count value to 0 when establishing the access layer context. The CU increases the DU key count value by 1 each time it calculates the first key. When the DU key count value rolls over, the CU triggers an update of the access layer key to avoid duplication of the first key.

[0151] The terminal generates the first key in the same way. When the terminal needs to generate the first key, the CU sends the eighth information to the terminal, where the eighth information is used to indicate the current DU key count value. The terminal receives the eighth information from the CU and determines the current DU key count value based on the eighth information, so that the terminal generates the first key based on the access layer key and the DU key count value, so that the terminal can use it for security protection related to the first data, such as decryption and / or integrity protection verification of the second data obtained by the terminal.

[0152] For another example, the first parameter includes but is not limited to one or more of the following: a DU key count value, an F1AP identifier assigned by the DU to the terminal, an F1AP identifier assigned by the CU to the terminal, the C-RNTI of the terminal, a radio bearer ID corresponding to the first data, or an identifier of a logical channel corresponding to the first data. The CU can generate a first key based on the access layer key and the first parameter, and send it to the DU through the first information, so that the DU performs security protection on the first data based on the first key. Accordingly, the CU sends an eighth information to the terminal, and the eighth information is used to indicate the first parameter, so that the terminal can generate a first key based on the same parameter, thereby deriving an encryption key and / or integrity protection key corresponding to the low-layer RRC message based on the first key, so that the terminal can use it to protect the security of the first data.

[0153] In another embodiment, the DU generates a first key based on the access layer key and a first parameter, wherein the first parameter includes one or more of the following:

[0154] DU key count value, F1AP identifier allocated by DU to the terminal, F1AP identifier allocated by CU to the terminal, C-RNTI of the terminal, identifier of the radio bearer corresponding to the first data, or identifier of the logical channel corresponding to the first data.

[0155] For example, the CU may send twelfth information to the DU, where the twelfth information includes an access layer key, and the DU may generate a first key based on the access layer key and the first parameter. If the first parameter includes a DU key count value, the twelfth information also includes the DU key count value. The DU derives an encryption key and / or an integrity protection key based on the first key generated by the DU. The DU may use the integrity protection key derived from the first key to perform security protection on the first data to obtain the second data. And / or, the DU may use the encryption protection key derived from the first key to perform security protection on the first data to obtain the second data. If the first key and the key used to derive the encryption key are also used to derive the integrity protection key, the DU may derive the encryption key and the integrity protection key based on the first key, and the DU may use the encryption key derived from the first key to encrypt the first data to obtain the third data, and then use the integrity protection key derived from the first key to perform integrity protection on the third data to obtain the second data.

[0156] The above describes how the DU can obtain the first key from the CU, or generate the first key. This allows the DU to perform security protection on data containing low-layer RRC messages based on the first key and then send it directly to the terminal without passing it to the CU, which then performs security protection and returns it to the DU for further transmission to the terminal. This can reduce the transmission delay of low-layer RRC messages and improve transmission efficiency.

[0157] Optionally, as an alternative implementation of S901, the DU may obtain the DU's encryption key and / or integrity protection key from the CU. The DU encrypts the first data based on the encryption key, and / or the DU may perform integrity protection on the first data based on the integrity protection key to obtain the second data.

[0158] The CU can obtain the encryption key and / or integrity protection key of the DU based on the first key. For example, the first key can be an access layer key, or it can be derived / generated by the CU based on the access layer key and the first parameter. After deriving the encryption protection key of the DU and / or the integrity protection key of the DU based on the first key, the CU sends it to the DU to perform encryption protection and / or integrity protection on the first data. When the CU generates the encryption key and integrity protection key of the DU, in addition to being based on the first key, it can also refer to other parameters for derivation, so that the encryption key and the integrity protection key are different. This application does not limit this.

[0159] S902: The DU sends second data to the terminal.

[0160] Accordingly, the terminal receives the second data from the DU. The terminal can determine that the second data carries a low-layer RRC message, and the terminal uses the first key to perform security protection on the second data to obtain the first data. The method for the terminal to obtain the first key can refer to the above description.

[0161] The terminal can derive an encryption key and / or an integrity protection key based on the first key. The terminal uses the first key to perform security protection on the second data to obtain the first data, including: the terminal uses the encryption key derived from the first key to decrypt the second data to obtain the first data; and / or the terminal uses the integrity protection key derived from the first key to perform an integrity check on the second data to obtain the first data. If the first key is used to derive both the encryption key and the integrity protection key, the terminal can derive the encryption key and the integrity protection key based on the first key. The terminal can use the integrity protection key derived from the first key to perform an integrity check on the second data to obtain third data, and then use the encryption key derived from the first key to decrypt the third data to obtain the first data.

[0162] The manner in which the terminal determines that the second data corresponds to the first key may include, but is not limited to, the following implementations.

[0163] In a first implementation manner, the terminal may determine the first key through key information associated with a radio bearer used to transmit a low-layer RRC message.

[0164] The DU associates / maps the second data including the low-layer RRC message to the first logical channel. The DU maps the first logical channel to a radio bearer used to transmit the second data. The radio bearer may be a signaling radio bearer (SRB) or a data radio bearer (DRB). Further, the radio bearer may be a dedicated radio bearer. The dedicated radio bearer may be understood as a radio bearer used only to transmit the second data including the low-layer RRC message, or a radio bearer used only to transmit the low-layer RRC message. The terminal may determine, based on the radio bearer information for transmitting the second data, to use the first key to perform security protection on the second data.

[0165] The CU may send tenth information to the terminal, where the tenth information is used to indicate radio bearer information corresponding to the second data, where the radio bearer information includes one or more of radio bearer identification information, security configuration information corresponding to the radio bearer including key information, and logical channel identification information to which the radio bearer is mapped / associated. The terminal determines, based on the tenth information, key information associated with the low-layer RRC message or the radio bearer corresponding to the second data, and may determine, based on the key information, the first key associated with the radio bearer.

[0166] The RLC layer of the DU associates / maps the logical channel corresponding to the low-layer RRC message to the corresponding radio bearer. One RLC entity corresponds to one logical channel of one terminal, and one logical channel corresponds to one radio bearer. The CU sends RLC bearer configuration information to the terminal to indicate the correspondence between the radio bearer identifier and the logical channel identifier. For example, the RLC bearer configuration information can be recorded as RLC-BearerConfig. The RLC bearer configuration information can be included in the above-mentioned tenth information, or can be included in other information. The CU indicates the association relationship between the first logical channel and the radio bearer used to transmit the low-layer RRC message to the terminal through RLC-BearerConfig. For example, the RLC-BearerConfig can be expressed as follows:

[0167] Among them, the logical channel identification information (i.e., logicalChannelIdentity as above) is used to indicate the logical channel identification LogicalChannelIdentity. If the identification is the identification of the first logical channel, and the radio bearer identification information associated with the logical channel is configured through the service bearer information (i.e., servedRadioBearer as above), the radio bearer can be an SRB, or it can be a DRB. If the first logical channel is associated with an SRB, servedRadioBearer indicates the identification SRB-Identity of the SRB associated with the first logical channel through srb-Identity. Alternatively, if the first logical channel is associated with a DRB, servedRadioBearer indicates the identification DRB-Identity of the DRB associated with the first logical channel through drb-Identity. The RB associated with the first logical channel is the radio bearer corresponding to the low-layer RRC message.

[0168] Based on the RLC bearer configuration information from the CU, the terminal can determine the logical channel associated / mapped to the radio bearer corresponding to the lower-layer RRC message, or determine the radio bearer to which the logical channel corresponding to the lower-layer RRC message is associated / mapped. The above-mentioned RLC-BearerConfig may also include other information not shown, which is not limited in this application.

[0169] The tenth information may include identification information of a dedicated RB, and the terminal may determine that the key corresponding to the radio bearer is the first key based on the dedicated RB information. For another example, the tenth information may include an identification and security configuration information of an RB, and the RB may be an SRB or a DRB. The security configuration information indicates that the key corresponding to the radio bearer is the first key, and the terminal may determine that the key corresponding to the radio bearer is the first key based on the tenth information.

[0170] After the terminal receives the second data, it can determine the first logical channel associated / mapped with the second data, map the first logical channel to the corresponding radio bearer (RB), and based on the RB identification information and the key information used by the RB indicated by the tenth information, or based on the dedicated RB identification information, the terminal can determine to use the first key to perform security protection on the second data, thereby obtaining the first data.

[0171] In a second implementation, the terminal may determine the first key through key information associated with a first logical channel associated / mapped to the second data, where the first logical channel is a logical channel corresponding to a low-layer RRC message.

[0172] Optionally, the CU may send a ninth message to the terminal, where the ninth message is used to indicate the logical channel information corresponding to the low-layer RRC message, and the logical channel information may include identification information of the first logical channel. Optionally, the CU may notify the terminal through the ninth message that the first logical channel is a dedicated logical channel corresponding to the low-layer RRC message. Alternatively, the logical channel information may include identification information of the first logical channel and indication information that the first logical channel is associated with the first key. Based on the ninth message, the terminal determines that the first logical channel is the logical channel corresponding to the low-layer RRC message. After receiving the second data, the terminal associates / maps the second data to the first logical channel, determines to use the first key to perform security protection on the second data, and thereby obtains the first data.

[0173] Optionally, the DU allocates the first logical channel as the logical channel corresponding to the low-layer RRC message. The DU sends second information to the CU, where the second information is used to indicate the logical channel identification information corresponding to the low-layer RRC message (that is, the logical channel identification information indicates the identification of the first logical channel). The second information may also indicate that the first logical channel is associated with the first key. After the CU determines that the first logical channel is the logical channel of the low-layer RRC message based on the second information, the CU may send ninth information to the terminal to notify the terminal.

[0174] Optionally, the logical channel can be a logical channel dedicated to low-layer RRC message transmission. The dedicated logical channel can be a predefined rule or consensus between the DU and the CU. The DU does not need to send the second information to the CU to indicate the first logical channel information. The dedicated logical channel can be a predefined rule or consensus between the DU and the UE. The DU does not need to send the second information to the CU, and the CU does not need to send the ninth information to the UE.

[0175] In a third embodiment, a header field of the second data includes third information, where the third information is used to indicate that the second data includes a low-layer RRC message, or is used to indicate that the second data is associated with / uses a first key. This header field is not encrypted and / or integrity protected and may be a PDCP header field (if the DU has a PDCP entity / function), an RLC header field, or a MAC header field.

[0176] For example, the terminal receives the second data, obtains the third information contained in the header field of the second data, indicates that the second data includes a low-layer RRC message according to the third information, or determines that the second data uses the first key according to the third information, so as to determine that the first key is used to perform security protection on the second data, and obtain the first data.

[0177] According to the above solution, the DU can perform security protection on the first data including the low-layer RRC message based on the first key and send the first data to the terminal, thereby reducing transmission delay while ensuring security.

[0178] In the implementation of this application, the DU performs security protection on the first data based on the first key to obtain the second data. Specifically, the DU may perform security protection on the first data based on the first key using the first security algorithm to obtain the second data. The first security algorithm is specifically the security algorithm corresponding to the low-layer RRC message, which may also be referred to as the security algorithm used by the DU. For example, the security protection may include encryption protection, and the first security algorithm includes the encryption protection algorithm corresponding to the low-layer RRC message, or the encryption protection algorithm used by the DU. And / or, the security protection may include integrity protection, and the first security algorithm includes the integrity protection algorithm corresponding to the low-layer RRC message, or the integrity protection algorithm used by the DU.

[0179] The manner in which the DU obtains the first security algorithm includes but is not limited to the following two implementations.

[0180] In one implementation, the DU determines the first security algorithm based on security capabilities supported by the terminal.

[0181] The security capabilities supported by the terminal include the capabilities of the security algorithms supported by the terminal. The terminal can report the security capabilities supported by the terminal to the CU. For example, the terminal may be pre-configured with one or more security algorithms, and the terminal supports the use of the one or more security algorithms for security protection. Alternatively, the terminal may be pre-configured with capability parameters related to the security algorithms supported by the terminal.

[0182] The CU may send fourth information to the DU, where the fourth information indicates the security capabilities supported by the terminal. The DU determines the security capabilities supported by the terminal based on the fourth information, and then determines the first security algorithm based on the security capabilities supported by the terminal. Alternatively, the DU may obtain the security capabilities supported by the terminal from the terminal to determine the first security algorithm. Alternatively, the DU may determine the first security algorithm based on a predefined minimum security capability supported by the terminal.

[0183] The DU can determine the first security algorithm corresponding to the security capabilities supported by the terminal from the security algorithm set. The security algorithm set can be predefined locally on the DU or obtained by the DU from the CU. The security algorithms in the security algorithm set can be sorted by priority or not.

[0184] For example, Figure 10 is a schematic flowchart of the DU obtaining a security algorithm set from the CU and determining the first security algorithm corresponding to the low-layer RRC message based on the security capabilities supported by the terminal indicated by the CU, which specifically includes but is not limited to the following S1001 to S1005.

[0185] S1001. The CU sends fifth information to the DU, where the fifth information is used to indicate a security algorithm set.

[0186] Accordingly, the DU receives the fifth information from the CU and determines a security algorithm set according to the fifth information.

[0187] For example, the CU may configure the security algorithm set for the DU when establishing the F1 interface with the DU. For example, the security algorithms in the security algorithm set may be sorted by priority, such as in ascending order or in descending order, or may not be configured with a priority. However, the present application is not limited thereto, and the CU may also configure the security algorithm set for the DU after establishing the F1 interface with the DU.

[0188] S1002: The DU sends fourth information to the CU, where the fourth information is used to indicate security capabilities supported by the terminal.

[0189] Accordingly, the DU receives the fourth information from the CU and determines the security capabilities supported by the terminal based on the fourth information. The CU may send the fourth information to the DU after obtaining the security capabilities supported by the terminal. Alternatively, the CU may send the fourth information to the DU in response to the DU's terminal capability information request, which is not limited in this application.

[0190] S1003: The DU determines a first security algorithm in a security algorithm set according to security capabilities supported by the terminal. The first security algorithm is a security algorithm used by a low-layer RRC message.

[0191] If a security algorithm set contains multiple security algorithms supported by the terminal, and the security algorithms in the security algorithm set are configured with priorities, the DU selects the security algorithm with the highest priority among the multiple security algorithms supported by the terminal, and the security algorithm with the highest priority is designated as the first security algorithm. Alternatively, the DU may select a security algorithm from the multiple security algorithms supported by the terminal as the first security algorithm based on implementation.

[0192] S1004. The DU sends sixth information to the CU, where the sixth information is used to indicate the first security algorithm.

[0193] After determining the first security algorithm, the DU notifies the CU via the sixth message. Accordingly, after receiving the sixth message and confirming that the low-layer RRC message uses the first security algorithm, the CU executes S1005 . The CU sends the eleventh message indicating the first security algorithm to the terminal. The terminal confirms the security algorithm corresponding to the low-layer RRC message based on the eleventh message. In this manner, the DU determines to use the first security algorithm based on the security capabilities supported by the terminal and reaches a consensus with the terminal. This enables the DU to securely protect the low-layer RRC message using the first security algorithm and then send it to the terminal, thereby reducing transmission latency while ensuring security.

[0194] In another implementation, the CU may determine that the security protection of the low-layer RRC message adopts the first security algorithm, and the CU sends the seventh information to the DU and the eleventh information to the terminal to respectively notify the DU and the terminal that the security protection of the low-layer RRC message adopts the first security algorithm, so that the DU and the terminal reach a consensus.

[0195] The above describes how, when the network sends a low-layer RRC message to a terminal, the DU performs security protection on the low-layer RRC message before sending it to the terminal, and how the DU obtains the security algorithm corresponding to the low-layer RRC message. The terminal can also send low-layer RRC messages to the network. The following describes how, when the terminal sends a low-layer RRC message to the network, the terminal performs security protection on the low-layer RRC message before sending it to the network, and how the terminal obtains the security algorithm corresponding to the low-layer RRC message.

[0196] 11 is a schematic flow chart of a data security protection method 1100 provided in an embodiment of the present application. The method 1100 includes but is not limited to the following steps S1101 and S1102.

[0197] S1101, the UE performs security protection on fourth data based on the first key to obtain fifth data, where the fourth data includes a low-layer RRC message, and the security protection includes encryption protection and / or integrity protection.

[0198] For example, the low-layer RRC message may be used to indicate request information, configuration information, or auxiliary information from at least one layer of the terminal RLC layer, MAC layer, and PHY layer, but the present application is not limited thereto.

[0199] The terminal performs security protection on the fourth data based on the first key to obtain the fifth data. The network side and the terminal derive / generate the first key in the same manner, and the terminal may obtain the first key in the following manners, but is not limited to:

[0200] In one embodiment, the first key may be an access layer key, or may be derived / generated based on the access layer key and a first parameter. The first parameter includes one or more of the following:

[0201] DU key count value, F1AP identifier assigned by DU to the terminal, F1AP identifier assigned by CU to the terminal, cell radio network temporary identifier (C-RNTI) of the terminal, identifier of the radio bearer corresponding to the fourth data, or identifier of the logical channel corresponding to the fourth data.

[0202] For example, the first parameter is the DU key count value. When the terminal needs to generate the first key, the CU sends the eighth information to the terminal, and the eighth information is used to indicate the current DU key count value. The terminal receives the eighth information from the CU and determines the current DU key count value based on the eighth information, so that the terminal generates the first key based on the access layer key and the DU key count value, so that the terminal can use it for security protection related to the fourth data, such as the terminal encrypts and / or integrity protects the fourth data to obtain the fifth data.

[0203] For another example, the first parameter includes but is not limited to one or more of the DU key count value, the F1AP identifier assigned by the DU to the terminal, the F1AP identifier assigned by the CU to the terminal, the C-RNTI of the terminal, the radio bearer ID corresponding to the fourth data, or the identifier of the logical channel corresponding to the fourth data. The CU sends the eighth information to the terminal, and the eighth information is used to indicate the first parameter, so that the terminal can generate a first key based on the same parameter, and thereby derive the encryption key and / or integrity protection key corresponding to the low-layer RRC message based on the first key, so that the terminal can use it to protect the security of the fourth data.

[0204] If the first key is used to derive an encryption key, the terminal encrypts the fourth data based on the encryption key. And / or, if the first key is used to derive an integrity protection key, the terminal performs integrity protection on the fourth data based on the integrity protection key to obtain fifth data. Specifically, if the first key is used to derive both the encryption key and the integrity protection key, the terminal may encrypt the fourth data using the encryption key derived from the first key to obtain sixth data, and then perform integrity protection on the sixth data using the integrity protection key derived from the first key to obtain fifth data.

[0205] S1102: The terminal sends fifth data to the DU.

[0206] Accordingly, the DU receives the fifth data from the terminal. The DU may determine that the fifth data carries a low-layer RRC message, and the DU may use the first key to perform security protection on the fifth data to obtain the fourth data.

[0207] The DU may derive an encryption key and / or an integrity protection key based on the first key, and then use the first key to perform security protection on the fifth data to obtain fourth data, including: if the first key is used to derive the integrity protection key, the DU uses the integrity protection key derived from the first key to perform an integrity check on the fifth data to obtain fourth data. And / or, if the first key is used to derive the encryption key, the DU uses the encryption key derived from the first key to perform an integrity check on the sixth data to obtain fourth data. If the first key is used to derive both the encryption key and the integrity protection key, the DU derives the encryption key and the integrity protection key based on the first key, and the DU may use the integrity key derived from the first key to perform an integrity check on the fifth data to obtain sixth data. The terminal then decrypts the sixth data using the encryption key derived from the first key to obtain fourth data.

[0208] The manner in which the terminal indicates to the DU that the fifth data corresponds to the first key may include, but is not limited to, the following implementation manners.

[0209] In one implementation, the terminal may associate / map the fifth data to the indicated radio bearer.

[0210] The terminal may receive tenth information from the CU, where the tenth information is used to indicate radio bearer information corresponding to the low-layer RRC message, and the radio bearer-related information includes one or more of radio bearer identification information, security configuration information corresponding to the radio bearer including key information, and logical channel information to which the radio bearer is mapped / associated, as described in the embodiment shown in FIG9 . The logical channel corresponding to the low-layer RRC message is the first logical channel, and the terminal may associate the fifth data with the first logical channel, and associate / map the first logical channel to the radio bearer indicated by the tenth information, or associate the fifth data with the radio bearer indicated by the tenth information according to the key information corresponding to the radio bearer indicated by the tenth information, and associate / map the radio bearer to the first logical channel, thereby sending the fifth data to the DU, so that the DU can determine that the fifth data corresponds to the first key based on the radio bearer of the fifth data.

[0211] In another implementation, the terminal may associate / map the fifth data to a first logical channel, where the first logical channel is a logical channel corresponding to a low-layer RRC message.

[0212] Optionally, the first logical channel may be a logical channel dedicated to low-layer RRC message transmission. The dedicated logical channel may be a predefined rule or consensus between the DU and the UE, and the UE directly associates / maps the fifth data to the first logical channel.

[0213] Optionally, the terminal may receive ninth information from the CU, where the ninth information is used to indicate the logical channel information corresponding to the low-layer RRC message, and the logical channel information may include identification information of the first logical channel. Optionally, the CU may notify the terminal through the ninth information that the first logical channel is a dedicated logical channel corresponding to the low-layer RRC message. Alternatively, the logical channel information may include identification information of the first logical channel and indication information that the first logical channel is associated with the first key. Based on the ninth information, the terminal determines that the first logical channel is the logical channel corresponding to the low-layer RRC message. The terminal associates / maps the fifth data to the first logical channel and sends it to the DU. The DU may determine that the fifth data corresponds to the first key based on the fact that the logical channel associated / mapped with the fifth data is the first logical channel.

[0214] In another embodiment, a header field of the fifth data includes third information, and the third information is used to indicate that the fifth data includes a low-layer RRC message. Alternatively, the third information is used to indicate that the fifth data is associated with / uses the first key. This header field is not encrypted and / or integrity protected. This header field can be a PDCP header field (if the DU has a PDCP entity / function), an RLC header field, or a MAC header field. The terminal sends the fifth data to the DU, so that the DU determines that the fifth data corresponds to the first key based on the header field of the fifth data.

[0215] According to the above solution, the terminal can perform security protection on the fourth data including the low-layer RRC message based on the first key and send the data to the DU, thereby reducing transmission delay while ensuring security.

[0216] In the implementation of this application, the terminal performs security protection on the fourth data based on the first key to obtain the fifth data. Specifically, the terminal may perform security protection on the fourth data based on the first key using the first security algorithm to obtain the fifth data. The first security algorithm is specifically the security algorithm corresponding to the low-layer RRC message, which may also be referred to as the security algorithm used by the DU. For example, the security protection may include encryption protection, and the first security algorithm includes the encryption protection algorithm corresponding to the low-layer RRC message, or the encryption protection algorithm used by the DU. And / or, the security protection may include integrity protection, and the first security algorithm includes the integrity protection algorithm corresponding to the low-layer RRC message, or the integrity protection algorithm used by the DU.

[0217] As described above, the DU or CU can determine that the security algorithm corresponding to the low-layer RRC message is the first security algorithm. The CU sends the eleventh information to the terminal. The eleventh information is used to indicate that the security protection corresponding to the low-layer RRC message adopts the first security algorithm. The terminal adopts the first security algorithm to perform security protection on the data containing the low-layer RRC message according to the eleventh information, so that the DU and the terminal reach a consensus and realize the security protection of the low-layer RRC message.

[0218] It is understandable that in order to implement the functions in the above embodiments, the access network nodes (such as CU, DU) and the terminals include hardware structures and / or software modules corresponding to the execution of each function. It should be easy for those skilled in the art to realize that, in combination with the units and method steps of each example described in the embodiments disclosed in this application, the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in a hardware or computer software driven hardware manner depends on the specific application scenario and design constraints of the technical solution.

[0219] Figures 12 and 13 are schematic diagrams of the structures of possible communication devices provided in embodiments of the present application. These communication devices can be used to implement the functions of the terminal or access network node (such as CU or DU) in the above method embodiments, and thus can also achieve the beneficial effects of the above method embodiments. In an embodiment of the present application, the communication device can be one of the terminals 120a-120j as shown in Figure 1, or it can be a network device 110a or 110b as shown in Figure 1, or it can be a module (such as a chip or chip system) applied to a terminal or network device.

[0220] The communication device 1200 includes a transceiver unit 1220, which can be used to receive or send information. The communication device 1200 can also include a processing unit 1210, which can be used to process instructions or data to implement corresponding operations.

[0221] It should be understood that when the communication device 1200 is a chip configured in (or used in) a communication device, the transceiver unit 1220 in the communication device 1200 can be the input / output interface or circuit of the chip, and the processing unit 1210 in the communication device 1200 can be the processor in the chip.

[0222] Optionally, the communication device 1200 may further include a storage unit, which may be used to store instructions or data, and the processing unit 1210 may execute the instructions or data stored in the storage unit to enable the communication device to implement corresponding operations.

[0223] The communication device 1200 can be used to implement the functions of the CU, DU or terminal in the method embodiments shown in Figure 9, Figure 10 or Figure 11 above.

[0224] When communication device 1200 is used to implement the functionality of a DU in the method embodiment shown in FIG9 : processing unit 1210 is configured to perform security protection on first data based on a first key to obtain second data, where the first data includes a radio resource control (RRC) message determined by the DU, and the security protection includes encryption protection and / or integrity protection. Transceiver unit 1220 is configured to send the second data to a terminal.

[0225] When the communication device 1200 is used to implement the functions of the terminal in the method embodiment shown in FIG9 : the transceiver unit 1220 is configured to receive second data, where the second data is obtained based on security protection of the first data. The processing unit 1210 is configured to perform security protection on the second data based on a first key to obtain first data, where the first data includes a radio resource control (RRC) message determined by a distributed unit DU, and the security protection includes encryption protection and / or integrity protection.

[0226] When the communication device 1200 is used to implement the functions of the CU in the method embodiment shown in Figure 9: the processing unit 1210 is configured to determine twelfth information, where the twelfth information is used by the DU to determine a first key, where the first key is used for security protection of the RRC message determined by the DU, where the security protection includes security protection and / or integrity protection. The transceiver unit 1220 is configured to send the twelfth information to the DU. The transceiver unit is also configured to send a first parameter to the terminal, where the first parameter is used by the terminal to determine the first key.

[0227] For a more detailed description of the processing unit 1210 and the transceiver unit 1220 , reference may be made to the relevant description in the method embodiment shown in FIG8 .

[0228] It should be understood that the transceiver unit 1220 in the communication device 1200 can be implemented through a communication interface (such as a transceiver, a transceiver circuit, an input / output interface, or a pin, etc.). When the communication interface is a transceiver, the transceiver can be composed of a receiver and / or a transmitter. The processing unit 1210 in the communication device 1200 can be implemented by at least one processor. The processing unit 1210 in the communication device 1200 can also be implemented by at least one logic circuit. Optionally, the communication device 1200 also includes a storage unit, which can be implemented by a memory.

[0229] As shown in Figure 13, communication device 1300 includes a processor 1310 and an interface circuit 1320. Processor 1310 and interface circuit 1320 are coupled to each other. It is understood that interface circuit 1320 can be a transceiver or an input / output interface. Optionally, communication device 1300 may also include a memory 1330 for storing instructions executed by processor 1310, input data required by processor 1310 to execute instructions, or data generated by processor 1310 after executing instructions.

[0230] In one implementation, the memory 1330 may also be integrated into the processor 1310 or independent of the processor 1310 .

[0231] When the communication device 1300 is used to implement the method shown in Figure 9, Figure 10 or Figure 11, the processor 1310 is used to implement the functions of the above-mentioned processing unit 1210, and the interface circuit 1320 is used to implement the functions of the above-mentioned transceiver unit 1220.

[0232] When the communication device is a chip used in a terminal, the terminal chip can implement the functions of the terminal in the above method embodiments. The terminal chip receives information from other modules in the terminal (such as a radio frequency module or antenna), and the information is sent by the network device to the terminal; or the terminal chip sends information to other modules in the terminal (such as a radio frequency module or antenna), and the information is sent by the terminal to the network device.

[0233] When the above-mentioned communication device is a module applied to a network device, the network device module can implement the functions of the DU or CU in the above-mentioned method embodiment. The network device module receives information from other modules in the network device (such as a radio frequency module or antenna), and the information is sent by the terminal to the network device; or the network device module sends information to other modules in the network device (such as a radio frequency module or antenna), and the information is sent by the network device to the terminal. The network device module here can be the baseband chip of the network device, or it can be a CU or DU.

[0234] It is understood that the processor in the embodiments of the present application may be a central processing unit (CPU), or may be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field programmable gate arrays (FPGA), or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. The general-purpose processor may be a microprocessor or any conventional processor.

[0235] The method steps in the embodiments of the present application can be implemented in hardware or in software instructions that can be executed by a processor. The software instructions can be composed of corresponding software modules, and the software modules can be stored in random access memory, flash memory, read-only memory, programmable read-only memory, erasable programmable read-only memory, electrically erasable programmable read-only memory, registers, hard disk, mobile hard disk, CD-ROM or any other form of storage medium well known in the art. An exemplary storage medium is coupled to the processor so that the processor can read information from the storage medium and write information to the storage medium. The storage medium can also be an integral part of the processor. The processor and storage medium can be located in an ASIC. In addition, the ASIC can be located in an access network device or a terminal. The processor and storage medium can also exist in an access network device or a terminal as discrete components.

[0236] According to the method provided in the embodiment of the application, the embodiment of the present application also provides a computer program product, which includes: computer program code, when the computer program code is executed by one or more processors, it enables the device including the processor to execute the method in the embodiment shown in Figure 9, Figure 10 or Figure 11.

[0237] In the above embodiments, all or part of the embodiments may be implemented using software, hardware, firmware, or any combination thereof. When implemented using software, all or part of the embodiments may be implemented in the form of a computer program product. The computer program product includes one or more computer programs or instructions. When the computer program or instructions are loaded and executed on a computer, the processes or functions described in the embodiments of the present application are performed in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, a network device, a user device, or other programmable device.

[0238] According to the method provided in the embodiments of the present application, the embodiments of the present application also provide a computer-readable storage medium, which stores the above-mentioned computer program or instructions. When the computer program or instructions are executed by one or more processors, the device including the processor executes the method in the embodiment shown in Figure 9, Figure 10 or Figure 11.

[0239] As described above, the computer program or instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer program or instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired or wireless means. The computer-readable storage medium can be any available medium that can be accessed by a computer, or a data storage device such as a server or data center that integrates one or more available media. The available medium can be a magnetic medium, such as a floppy disk, hard disk, or magnetic tape; an optical medium, such as a digital video disk; or a semiconductor medium, such as a solid-state drive. The computer-readable storage medium can be a volatile or non-volatile storage medium, or can include both volatile and non-volatile types of storage media.

[0240] According to the method provided in the embodiment of the present application, the embodiment of the present application also provides a communication system, including the one or more DUs described above. The system may further include the one or more CUs described above. The system may further include the one or more terminals described above.

[0241] In the several embodiments provided in this application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the devices described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the coupling or direct coupling or communication connection between each other shown or discussed can be through some interface, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0242] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this solution based on actual needs.

[0243] In the various embodiments of the present application, unless otherwise specified or there is a logical conflict, the terms and / or descriptions between different embodiments are consistent and can be referenced by each other. The technical features in different embodiments can be combined to form new embodiments according to their inherent logical relationships.

Claims

1. A data security protection method, characterized in that: include: The distributed unit DU performs security protection on the first data based on the first key to obtain second data, where the first data includes a low-layer radio resource control RRC message, and the security protection includes encryption protection and / or integrity protection; The DU sends the second data to the terminal.

2. The method according to claim 1, characterized in that The method further comprises: The DU generates the first key based on the access layer key and the first parameter, The first parameter includes one or more of the following: DU key count value, F1AP identifier allocated by DU to the terminal, F1AP identifier allocated by CU to the terminal, cell radio network temporary identifier C-RNTI, identifier of the radio bearer corresponding to the first data, or identifier of the logical channel corresponding to the first data.

3. The method according to claim 1, characterized in that The method further comprises: The DU receives first information from a centralized unit CU, where the first information is used to indicate the first key.

4. The method according to any one of claims 1 to 3, characterized in that The first data corresponds to a first logical channel, and the first logical channel is a logical channel corresponding to the underlying RRC message; or, a radio bearer associated with the first logical channel is a radio bearer corresponding to the underlying RRC message.

5. The method according to claim 4, characterized in that The method further comprises: The DU determines that the logical channel corresponding to the underlying RRC message is the first logical channel; The DU sends second information to the CU, where the second information is used to indicate that the logical channel corresponding to the underlying RRC message is the first logical channel.

6. The method according to any one of claims 1 to 3, characterized in that The header field of the second data includes third information, and the third information is used to indicate that the second data includes the underlying RRC message, or is used to indicate that the second data is associated with the first key.

7. The method according to any one of claims 1 to 5, characterized in that The DU performs security protection on the first data based on the first key to obtain second data, including: The DU performs the security protection on the first data based on the first key and adopts a first security algorithm corresponding to the security protection to obtain the second data.

8. The method according to claim 7, characterized in that The method further comprises: The DU receives fourth information from the CU, where the fourth information is used to indicate security capabilities supported by the terminal; The DU determines the first security algorithm according to security capabilities supported by the terminal.

9. The method according to claim 8, characterized in that The method further comprises: The DU receives fifth information from the CU, where the fifth information is used to indicate a security algorithm set; The DU determines the first security algorithm according to the security capabilities supported by the terminal, including: The DU determines the first security algorithm from the security algorithm set according to security capabilities supported by the terminal.

10. The method according to claim 8 or 9, characterized in that: The method further comprises: The DU sends sixth information to the CU, where the sixth information is used to indicate the first security algorithm.

11. The method according to claim 7, characterized in that The method further comprises: The DU receives seventh information from the CU, where the seventh information is used to indicate the first security algorithm.

12. A data security protection method, characterized in that: include: The terminal receives second data, where the second data is obtained based on security protection of the first data; The terminal performs security protection on the second data based on the first key to obtain first data, where the first data includes a low-layer radio resource control RRC message, and the security protection includes encryption protection and / or integrity protection.

13. The method according to claim 12, characterized in that The method further comprises: The terminal generates the first key based on the access layer key and the first parameter, The first parameter includes one or more of the following: DU key count value, F1AP identifier allocated by DU to the terminal, F1AP identifier allocated by CU to the terminal, cell radio network temporary identifier C-RNTI, identifier of the radio bearer corresponding to the first data, or identifier of the logical channel corresponding to the first data.

14. The method according to claim 12, characterized in that The method further comprises: The terminal receives eighth information from a centralized unit CU, where the eighth information is used to indicate the first parameter.

15. The method according to any one of claims 12 to 14, characterized in that The method further comprises: The terminal receives ninth information from the CU, where the ninth information is used to indicate that the logical channel corresponding to the underlying RRC message is the first logical channel; The terminal determines to use the first key to perform security protection on the second data based on the fact that the second data includes data of the first logical channel.

16. The method according to any one of claims 12 to 14, characterized in that The method further comprises: The terminal receives tenth information from the CU, where the tenth information is used to indicate a radio bearer corresponding to the underlying RRC message; The terminal determines to use the first key to perform security protection on the second data based on the fact that the second data includes data of a first logical channel and a radio bearer associated with the first logical channel is a radio bearer corresponding to the underlying RRC message.

17. The method according to any one of claims 12 to 14, characterized in that The header field of the second data includes third information, and the third information is used to indicate that the second data includes the underlying RRC message, or is used to indicate that the second data is associated with the first key.

18. The method according to any one of claims 12 to 17, characterized in that The terminal performs security protection on the second data based on the first key to obtain the first data, including: The terminal performs security protection on the second data based on the first key and adopts a first security algorithm corresponding to the security protection to obtain the first data.

19. The method according to claim 17, characterized in that The method further comprises: The terminal receives eleventh information from the CU, where the eleventh information is used to indicate the first security algorithm.

20. A data security protection method, characterized in that: include: The centralized unit CU sends twelfth information to the DU, where the twelfth information is used by the DU to determine a first key, where the first key is used for security protection of a low-layer RRC message, where the security protection includes security protection and / or integrity protection; The CU sends a first parameter to the terminal, where the first parameter is used by the terminal to determine the first key, and the first parameter includes one or more of the following: DU key count value, F1AP identifier allocated by DU to the terminal, F1AP identifier allocated by CU to the terminal, cell radio network temporary identifier C-RNTI, identifier of the radio bearer corresponding to the first data, or identifier of the logical channel corresponding to the first data.

21. The method according to claim 20, characterized in that The method further comprises: The CU determines the first key according to the access layer key and the first parameter, The twelfth information includes the first key.

22. The method according to claim 20, characterized in that The twelfth information includes an access layer key, or the twelfth information includes the access layer key and the first parameter.

23. The method according to any one of claims 20 to 22, characterized in that The method further comprises: The CU receives second information from the DU, where the second information is used to indicate that the logical channel corresponding to the low-layer RRC message is a first logical channel; The CU sends ninth information to the terminal, where the ninth information is used to indicate that the logical channel corresponding to the underlying RRC message is the first logical channel.

24. The method according to any one of claims 20 to 22, characterized in that The method further comprises: The CU sends tenth information to the terminal, where the tenth information is used to indicate a radio bearer corresponding to the underlying RRC message.

25. The method according to any one of claims 20 to 23, characterized in that The method further comprises: The CU sends fourth information to the DU, where the fourth information is used to indicate security capabilities supported by the terminal; The CU receives sixth information from the DU, where the sixth information is used to indicate a first security algorithm, where the first security algorithm is an algorithm adopted for security protection of the underlying RRC message; The CU sends eleventh information to the terminal, where the eleventh information is used to indicate the first security algorithm.

26. The method according to claim 25, characterized in that The method further comprises: The CU sends fifth information to the DU, where the fifth information is used to indicate a security algorithm set, and the security algorithm set is used by the DU to determine the first security algorithm.

27. The method according to any one of claims 20 to 23, characterized in that The method further comprises: The CU sends seventh information to the DU, where the seventh information is used to indicate a first security algorithm, where the first security algorithm is an algorithm adopted for security protection of the underlying RRC message; The CU sends eleventh information to the terminal, where the eleventh information is used to indicate the first security algorithm.

28. A communication device, characterized in that: Comprising a module for executing the method as claimed in any one of claims 1 to 11; or a module for executing the method as claimed in any one of claims 12 to 19; or a module for executing the method as claimed in any one of claims 20 to 27.

29. A communication device, characterized in that: The invention comprises a processor coupled to a memory, the memory being used to store a computer program, the processor being used to execute the computer program stored in the memory, so that the communication device performs the method as claimed in any one of claims 1 to 11; or the communication device performs the method as claimed in any one of claims 12 to 19; or the communication device performs the method as claimed in any one of claims 20 to 27.

30. A computer-readable storage medium comprising a computer program, which, when executed on a computer, causes the computer to perform the method according to any one of claims 1 to 27.

Images