Communication method and related apparatus

Abstract

The present application provides a communication method and a related apparatus, which can improve the user plane security protection performance. In the method, a session management function network element receives a session establishment request message from a terminal device and acquires a first user plane security policy corresponding to a session; sends to an access network device the first user plane security policy and an identifier for indicating the session; then acquires feature information of a service data flow of the terminal device and determines a second user plane security policy corresponding to the service data flow; and when the first user plane security policy and the second user plane security policy are inconsistent, sends to the access network device the second user plane security policy and a quality of service (QoS) flow identifier of a first QoS flow.

Description

A communication method and related device

[0001] This application claims priority to the Chinese patent application filed with the State Intellectual Property Office on September 7, 2023, with application number CN202311156906.8 and application name “A communication method and related devices”, the entire contents of which are incorporated by reference into this application. Technical Field

[0002] The present application relates to the field of communication technology, and in particular to a communication method and related devices. Background Art

[0003] In mobile communication systems, to ensure the security of service data transmission, access network equipment performs user-plane security protection on downlink service data from terminal devices, such as confidentiality protection and / or integrity protection. The access network equipment then transmits this protected downlink service data to the terminal device over the air interface between the access network equipment and the terminal device. Similarly, the terminal device performs user-plane security protection on uplink service data and transmits this protected uplink service data to the access network device over the air interface.

[0004] In existing technologies, access network devices and terminal devices use the same user plane security policy to provide user plane security protection for all service data carried in the same session. However, the service data carried in each session varies, and using the same user plane security policy may result in a degradation of user plane security protection performance.

[0005] Summary of the Invention

[0006] The present application provides a communication method and related devices to improve user plane security protection performance.

[0007] In a first aspect, an embodiment of the present application provides a communication method, which is applied to a session management function network element (which may also be referred to as a session management function). The method includes:

[0008] receiving a session establishment request message from a terminal device, wherein the session establishment request message is used to request establishment of a session;

[0009] In response to the session establishment request message, obtaining a first user plane security policy corresponding to the session, where the first user plane security policy is used to indicate whether to activate user plane security protection corresponding to the session;

[0010] Sending the first user plane security policy and an identifier indicating the session to an access network device;

[0011] Acquire characteristic information of a service data stream of the terminal device, where the service data stream is carried by the session and is used to transmit service data of the terminal device;

[0012] Determining, according to the characteristic information of the service data flow, a second user plane security policy corresponding to the service data flow, where the second user plane security policy is used to indicate whether to activate user plane security protection corresponding to the service data flow;

[0013] When the first user plane security policy is inconsistent with the second user plane security policy, the second user plane security policy and the QoS flow identifier of the first quality of service (QoS) flow are sent to the access network device, where the QoS flow identifier of the first QoS flow is used to indicate the first QoS flow in the session for carrying the business data flow.

[0014] In an embodiment of the present application, the service data flow (SDF) of a terminal device refers to a service data flow transmitted in the terminal device, and the service data flow is used to transmit the service data of the terminal device. The service data flow can be transmitted using a variety of protocols, including but not limited to the fast user datagram protocol (UDP) or the transmission control protocol (TCP). A session includes one or more QoS flows. The session management function network element assigns the QoS flow to the service data flow. The access network device maps the QoS flow to a data radio bearer (DRB). The DRB carries the service data flow.

[0015] In this embodiment of the present application, user plane security protection includes user plane integrity protection and / or user plane encryption protection, which may also be referred to as user plane encryption. User plane security protection for a session applies to all data radio bearers included in the session. User plane security protection for a service data flow applies to the DRB carrying the service data flow.

[0016] Through the above method, the session management function network element implements differentiated user plane security protection for the service data carried by the session, thereby improving the user plane security protection performance.

[0017] In one possible implementation, the session management function network element obtains characteristic information of the service data flow of the terminal device, including: the session management function network element receives a session modification request message from the terminal device, the session modification request message including the characteristic information of the service data flow of the terminal device. In a scenario where the terminal device initiates a session modification, the session management function network element can obtain the characteristic information of the service data flow of the terminal device from the session modification request message from the terminal device. This enriches the method by which the session management function network element obtains characteristic information of the service data flow, enhances the implementation flexibility of the solution, improves the user plane security protection performance, and meets the user plane security requirements in different service scenarios.

[0018] In one possible implementation, before the session management function network element receives a session modification request message from the terminal device, the terminal device determines whether the session can be carried on the service data flow based on the characteristic information of the service data flow and the relevant information of the session. The terminal device obtains the data network (DN) corresponding to the service data flow or the network slice selection assistance information (NSSAI) corresponding to the service data flow. The terminal device obtains the DN corresponding to the session or the NSSAI corresponding to the session. If the DN of the service data flow is the same as the DN of the session, or the NSSAI of the service data flow is the same as the NSSAI of the session, then the session can carry the service data flow, and the terminal device can trigger the modification of the QoS flow used to transmit the service data flow. After the terminal device triggers the modification of the QoS flow used to transmit the service data flow, the terminal device sends a session modification request message to the access network device, and the session modification request message includes the characteristic information of the service data flow.

[0019] In one possible implementation, the session modification request message includes a packet filter for the service data flow, where the packet filter for the service data flow indicates characteristic information of the service data flow. The packet filter for the service data flow is used to filter Internet Protocol (IP) data flows to implement classification processing of the service data flows. The packet filter can be used to determine which type of service, application, or scenario the classified service data flow belongs to.

[0020] In one possible implementation, the session management function network element obtains the characteristic information of the service data flow of the terminal device, including: receiving a message from a policy control function network element for requesting to update the policy information of the session, wherein the message for requesting to update the policy information of the session includes the characteristic information of the service data flow. The policy control function network element may also be referred to as a policy control function. The session management function network element obtains the characteristic information of the service data flow of the terminal device during a PCF session management policy association modification process between a policy control function (PCF) network element and the session management function network element.

[0021] Furthermore, the characteristic information of the service data flow is included in a policy and charging control (PCC) rule. The PCC rule includes a template of the service data flow, and the template of the service data flow includes the characteristic information of the service data flow. The PCC rule is sent by the policy control function network element to the session management function network element.

[0022] In the scenario where the policy control function network element triggers session modification, the session management function network element can obtain the characteristic information of the service data flow from the policy control function network element, enriching the way in which the session management function network element obtains the characteristic information of the service data flow, improving the implementation flexibility of the solution, improving the user plane security protection performance, and meeting the user plane security requirements in different service scenarios.

[0023] In one possible implementation, the session management function network element obtains characteristic information of the service data flow of the terminal device, including: the session management function network element obtains subscription data of the terminal device from a unified data management network element, where the subscription data includes characteristic information of the service data flow of the terminal device. The unified data management network element may also be referred to as a unified data management. Exemplarily, after the relevant data of the terminal device included in the subscription data changes, the unified data management network element sends the updated subscription data to the session management function network element. Alternatively, the session management function network element proactively obtains subscription data from the unified data management network element. For example, the session management function network element periodically sends identification information of the UE to the unified data management network element, and in response to the identification information of the UE, the unified data management network element sends subscription data to the session management function network element. In a scenario where the unified data management network element triggers a session modification, the session management function network element can obtain characteristic information of the service data flow from the unified data management network element. This enriches the manner in which the session management function network element obtains characteristic information of the service data flow, improves the implementation flexibility of the solution, enhances user plane security protection performance, and meets user plane security requirements in different service scenarios.

[0024] In one possible implementation, after obtaining characteristic information of a service data flow from a terminal device, the session management function network element determines whether the service data flow is carried on the session. If the session management function network element determines that the service data flow is carried on the session, the session management function network element obtains a first user plane security policy. If the session management function network element determines that the service data flow is carried on the session, the session management function network element obtains the first user plane security policy corresponding to the session, and then checks whether a second user plane security policy corresponding to the service data flow is consistent with the first user plane security policy.

[0025] In one possible implementation, the session management function network element sends a message to the unified data management network element requesting subscription data of the terminal device; the session management function network element receives the subscription data of the terminal device from the unified data management network element, the subscription data including a correspondence between characteristic information of a service data flow and a user plane security policy; and the session management function network element determines a second user plane security policy corresponding to the service data flow based on the subscription data. Exemplarily, the message sent by the session management function network element to the unified data management network element requesting subscription data of the terminal device carries identification information of the terminal device. The unified data management network element determines the corresponding subscription data based on the identification information of the terminal device, and then sends the subscription data to the session management function network element. The subscription data includes a correspondence between characteristic information of the service data flow and a user plane security policy. Based on the characteristic information of the service data flow, the session management function network element determines from the subscription data that the user plane security policy of the service data flow is the second user plane security policy. The session management function network element may obtain the subscription data of the terminal device from the unified data management network element, and then determine the second user plane security policy corresponding to the service data flow from the subscription data. The method for a session management function network element to determine the user plane security policy for a service data flow is enriched, improving the implementation flexibility of the solution, enhancing user plane security protection performance, and meeting user plane security requirements in different service scenarios. In one possible implementation, the session management function network element determines the second user plane security policy corresponding to the service data flow based on characteristic information of the service data flow, including: the session management function network element sends a message to the unified data management network element requesting the user plane security policy corresponding to the characteristic information of the service data flow; and the session management function network element receives the second user plane security policy from the unified data management network element. Exemplarily, the message sent by the session management function network element to the unified data management network element requesting the user plane security policy corresponding to the characteristic information of the service data flow carries the characteristic information of the service data flow, and the unified data management network element determines the corresponding second user plane security policy based on the characteristic information of the service data flow carried in the message. The unified data management network element feeds back the user plane security policy for the service data flow to the session management function network element as the second user plane security policy. The session management function network element may obtain the second user plane security policy corresponding to the service data flow from the unified data management network element. It enriches the way in which the session management function network element determines the user plane security policy of the service data flow, improves the implementation flexibility of the solution, enhances the user plane security protection performance, and meets the user plane security requirements in different service scenarios.

[0026] In one possible implementation, the session management function network element receives a policy and charging control rule from a policy control function network element, wherein the policy and charging control rule includes a correspondence between characteristic information of a service data flow and a user plane security policy; the session management function network element determines the second user plane security policy corresponding to the characteristic information of the service data flow based on the policy and charging control rule. Exemplarily, the session management function network element determines the second user plane security policy corresponding to the service data flow from the policy and charging control rule based on the characteristic information of the service data flow. The policy and charging control rule is a dynamic rule, and the session management function network element can dynamically obtain the policy and charging control rule. Modification of the policy and charging control rule can be triggered by the application function AF. This improves the implementation flexibility of the solution, and the session management function network element can determine the user plane security policy corresponding to the service data flow as the second user plane security policy in a variety of ways, thereby meeting the security requirements of different services.

[0027] In one possible implementation, the session management function network element determines the second user plane security policy corresponding to the characteristic information of the service data flow based on a local configuration policy. The session management function network element obtains a local configuration policy, and the local configuration policy includes the correspondence between the service data flow and the corresponding user plane security policy. For the session management function network element, the local configuration policy may also be referred to as the configuration policy of the session management function network element. The session management function network element determines the second user plane security policy corresponding to the service data flow from the configuration policy based on the characteristic information of the service data flow. The configuration policy may be a configuration policy at the session granularity, the configuration policy may also be a configuration policy at the QoS flow granularity, or the configuration policy may be a configuration policy at the service data flow granularity. The implementation flexibility of the solution is improved, and the session management function network element can determine the user plane security policy corresponding to the service data flow as the second user plane security policy in a variety of ways, thereby meeting the security requirements of different services.

[0028] In a possible implementation, before the session management function network element sends the second user plane security policy and the QoS flow identifier of the first QoS flow to the access network device, it also includes: the session management function network element creates the first QoS flow, and the session management function network element determines the service quality parameters of the first QoS flow according to the service quality requirements of the service data flow; the session management function network element sends the second user plane security policy and the QoS flow identifier of the first QoS flow to the access network device, including: the session management function network element sends the second user plane security policy, the QoS flow identifier of the first QoS flow, and the service quality parameters of the first QoS flow to the access network device.

[0029] Regarding quality of service (QoS) parameters, different QoS flows have different QoS parameters. The session management function network element provides the access network device with the QoS parameters corresponding to each QoS flow. The access network device then configures the DRB and maps the QoS flows to the DRB based on the QoS parameters. For example, multiple QoS flows with the same or similar QoS parameters can be mapped to the same DRB. The DRB is then used to transmit one or more QoS flows mapped to that DRB.

[0030] The session management function network element sends the service quality parameters of the first QoS flow to the access network device so that the service quality requirements of the service data flow are met when the service data flow is carried in the first QoS flow for transmission. The session management function network element explicitly notifies the RAN access network device that the user plane security policy of the first QoS flow is the second user plane security policy, thereby improving the implementation flexibility of the solution. The session management function network element creates a new first QoS flow and then sends the QoS flow identifier of the first QoS flow and the second user plane security policy to the access network device. The session management function network element configures the first QoS flow to use the second user plane security policy and then assigns the first QoS flow to the service data flow. The user plane security policy of the service data flow is the second user plane security policy. This avoids the problem of the user plane security policy of the QoS flow being inconsistent with the security requirements of the service data flow due to service data flows with different user plane security policies being carried in the QoS flow.

[0031] In one possible implementation, a session management function network element determines, from one or more QoS flows of a session, a QoS flow that meets a first condition as a first QoS flow. The first condition includes: the quality of service parameters of the QoS flow match the quality of service requirements of the service data flow, and the user plane security policy corresponding to the service data flow carried by the QoS flow is consistent with the second user plane security policy. This method avoids the problem of inconsistent user plane security policies between the QoS flow and the security requirements of the service data flow caused by service data flows with different user plane security policies being carried by the QoS flow.

[0032] The session management function network element can obtain the QoS requirements of the service data flow in various ways. For example, the session management function network element can obtain the QoS requirements of the service data flow from the terminal device. For example, the session management function network element receives a session modification request message from the terminal device, where the session modification request message includes the QoS requirements of the service data flow. Based on the obtained QoS requirements of the service data flow, the session management function network element determines whether the QoS parameters of the QoS flow meet the QoS requirements of the service data flow. For example, the session management function network element can obtain the QoS requirements of the service data flow from the policy control function network element. For example, the session management function network element receives policy and charging control rules from the policy control function network element. The policy and charging control rules include parameters for determining whether the policy and charging control rules are bound to the QoS flow. The policy and charging control rules may be determined by the policy control function network element based on the QoS requirements of the service data flow sent by the application function. The session management function network element determines whether the parameters of the QoS flow are consistent with the parameters in the policy and charging control rules. Please refer to clause 6.1.3.2.4 of TS23.502 of the 3rd Generation Partnership Project (3GPP) standard, which is not repeated here.

[0033] In one possible implementation, the characteristic information of a service data flow includes indication information for indicating the application layer security activation status of the service data flow. The application layer security activation status of the service data flow includes: whether the application layer of the service data flow is encrypted and / or integrity protected, or whether the application layer of the service data flow is not encrypted and / or integrity protected. Exemplarily, the indication information may be an application identifier. The session management function network element determines the application layer security activation status corresponding to the service data flow based on the application identifier.

[0034] If the indication information indicates that the service data flow is encrypted at the application layer and the first user plane security policy includes the requirement that user plane encryption be activated, the second user plane security policy includes the requirement that user plane encryption not be enabled. And / or, if the indication information indicates that integrity protection is already implemented at the application layer of the service data flow, the second user plane security policy includes the requirement that user plane integrity protection not be enabled. User plane encryption not being enabled can also be referred to as not requiring user plane encryption protection. User plane integrity protection not being enabled can also be referred to as not requiring user plane integrity protection.

[0035] In one possible implementation, the characteristic information of the service data stream includes the protocol used by the terminal device to transmit the service data stream. When the protocol used by the terminal device to transmit the service data stream is the Quick User Datagram Protocol Internet Connection (QUIC) protocol or the Multipath QUIC (MPQUIC) protocol, and the first user plane security policy includes that user plane encryption needs to be enabled, the second user plane security policy includes that user plane encryption does not need to be enabled.

[0036] In one possible implementation, the session management function network element sends first indication information to the access network device, where the first indication information is used to indicate that the user plane security policy of the first QoS flow is the second user plane security policy. The first indication information is carried in the control information of the first QoS flow, and implicitly indicates that the user plane security policy of the first QoS flow is the second user plane security policy through the control information of the first QoS flow. The network function or device that receives the control information of the first QoS flow determines that the user plane security policy of the QoS flow is the second user plane security policy based on the control information of the first QoS flow.

[0037] In one possible implementation, the first indication information is carried in the QoS flow identifier QFI of the first QoS flow. A first indication bit is added to the QFI, and the first indication bit is used to indicate that the user plane security policy of the first QoS flow is the second user plane security policy. For example, when the first indication bit is "1", it indicates that the user plane security policy of the first QoS flow is the second user plane security policy. For another example, when the first indication bit is "0", it indicates that the first QoS flow adopts the user plane security policy of the session to which the first QoS flow belongs.

[0038] Alternatively, the first indication information is carried in the QoS profile of the QoS template corresponding to the first QoS flow. The first indication information is added to the QoS profile of the first QoS flow, and the first indication information is used to indicate that the user plane security policy of the first QoS flow is the second user plane security policy. For example, when the first indication information is "1", it indicates that the user plane security policy of the first QoS flow is the second user plane security policy. For another example, when the first indication information is "0", it indicates that the first QoS flow adopts the user plane security policy of the session to which the first QoS flow belongs.

[0039] Alternatively, the first indication information is carried in the description information of the first QoS flow.

[0040] In one possible implementation, the session management function network element sends an access traffic guidance, switching, and splitting ASSSS rule to the terminal device, where the ASSSS rule includes a correspondence between the second user plane security policy and the first QoS flow. The session management function network element adds a correspondence between the first QoS flow and the second user plane security policy in the ASSSS rule, so that a UE receiving the ASSSS rule can determine that the first QoS flow corresponds to the second user plane security policy based on the ASSSS rule.

[0041] In a second aspect, an embodiment of the present application provides a communication method, which is applied to an access network device, and includes:

[0042] In the process of establishing a session of a terminal device, receiving a first user plane security policy corresponding to the session and an identifier for indicating the session from a session management function network element, where the first user plane security policy is used to indicate whether to activate user plane security protection corresponding to the session;

[0043] determining whether to activate user plane security protection of a data radio bearer (DRB) belonging to the session according to the first user plane security policy;

[0044] receiving a second user plane security policy and a QoS flow identifier of a first QoS flow from the session management function network element, where the second user plane security policy is used to indicate whether to activate user plane security protection corresponding to the service data flow, and the QoS flow identifier of the first QoS flow is used to indicate a first QoS flow in the session for carrying the service data flow;

[0045] Determine the first DRB corresponding to the first QoS flow in the session and the user plane security activation status of the first DRB according to the second user plane security policy and the QoS flow identifier of the first QoS flow.

[0046] Through the above method, the access network device allocates a first DRB to the first QoS flow based on the instruction of the session management function network element. The user plane security activation status of the first DRB is determined based on the second user plane security policy. In other words, the user plane security policy of the first DRB is the second user plane security policy, or the first DRB adopts the second user plane security policy. This ensures that the first DRB that adopts the second user plane security policy can carry the service data of the first QoS flow. Through the above method, the access network device implements differentiated user plane security protection for the service data carried by the session, thereby improving user plane security protection performance.

[0047] In a possible implementation, the determining, according to the second user plane security policy and the QoS flow identifier of the first QoS flow, the first DRB corresponding to the first QoS flow in the session and the user plane security activation status of the first DRB includes:

[0048] determining, according to the QoS flow identifier of the first QoS flow, that the first QoS flow is newly created;

[0049] Create the first DRB and determine the user plane security activation status of the first DRB according to the second user plane security policy; or, determine the DRB that meets the second condition from one or more DRBs of the session as the first DRB, and the second condition includes: the user plane security activation status of the DRB is determined according to the second user plane security policy.

[0050] After the access network device receives the QoS flow identifier of the first QoS flow from the session management function network element, it determines that the first QoS flow is a newly created QoS flow based on the QoS flow identifier of the first QoS flow. The access network device then creates a first DRB and determines the user plane security activation status of the first DRB based on the second user plane security policy, or the access network device determines a DRB that meets the second condition as the first DRB from one or more DRBs of the session, and the one or more DRBs of the session are created DRBs. The second condition includes: the user plane security activation status of the DRB is determined based on the second user plane security policy. In other words, the access network device determines the first DRB from one or more DRBs of the session that adopt the second user plane security policy. The access network device then allocates the first DRB to the first QoS flow to ensure that the first DRB that adopts the second user plane security policy can carry the service data of the first QoS flow.

[0051] In a possible implementation, the determining, according to the second user plane security policy and the QoS flow identifier of the first QoS flow, the first DRB corresponding to the first QoS flow in the session and the user plane security activation status of the first DRB includes:

[0052] determining, according to the QoS flow identifier of the first QoS flow, that the following conditions are met for the first QoS flow: 1) the first QoS flow has been created before the second user plane security policy and the QoS flow identifier of the first QoS flow are received from the session management function network element; 2) the first QoS flow corresponds to a second DRB, and the number of QoS flows corresponding to the second DRB is greater than 1;

[0053] creating the first DRB and determining the user plane security activation state of the first DRB according to the second user plane security policy; or,

[0054] Determine from one or more DRBs of the session that the DRB that meets the second condition is the first DRB, and the second condition includes: the user plane security activation status of the DRB is determined according to the second user plane security policy.

[0055] After the access network device receives the QoS flow identifier of the first QoS flow from the session management function network element, it determines that the first QoS flow meets the following conditions based on the QoS flow identifier of the first QoS flow: 1) The first QoS flow is an already created QoS flow, and the first QoS flow was created before the access network device received the second user plane security policy and the QoS flow identifier of the first QoS flow from the session management function network element. 2) The first QoS flow has been allocated a second DRB, and the number of QoS flows corresponding to the second DRB is greater than 1. In other words, in addition to corresponding to the first QoS flow, the second DRB also corresponds to other QoS flows. Then the access network device creates a first DRB, or the access network device determines the first DRB from one or more DRBs that adopt the second user plane security policy for the session. Then the access network device allocates the first DRB to the first QoS flow to ensure that the first DRB using the second user plane security policy can carry the service data of the first QoS flow.

[0056] In a possible implementation, the determining, according to the second user plane security policy and the QoS flow identifier of the first QoS flow, the first DRB corresponding to the first QoS flow in the session and the user plane security activation status of the first DRB includes:

[0057] Determining, based on the QoS flow identifier of the first QoS flow, that the following conditions are met: 1) the first QoS flow is created before the second user plane security policy and the QoS flow identifier of the first QoS flow are received from the session management function network element; 2) the first QoS flow corresponds to the first DRB, and the number of QoS flows corresponding to the first DRB is equal to 1;

[0058] Update the user plane security activation status of the first DRB according to the second user plane security policy.

[0059] After the access network device receives the QoS flow identifier of the first QoS flow from the session management function network element, it determines that the first QoS flow meets the following conditions based on the QoS flow identifier of the first QoS flow: 1) The first QoS flow is an already created QoS flow, and the first QoS flow has been created before the access network device receives the second user plane security policy and the QoS flow identifier of the first QoS flow from the session management function network element. 2) The first QoS flow has been allocated a first DRB, and the number of QoS flows corresponding to the first DRB is 1. In other words, the first DRB only corresponds to the first QoS flow. The access network device then updates the user plane security activation status of the first DRB according to the second user plane security policy. In other words, the access network device modifies the user plane security policy of the first DRB. After modification, the user plane security policy of the first DRB is the second user plane security policy, so as to ensure that the first DRB with the second user plane security policy can carry the service data of the first QoS flow.

[0060] In a possible implementation, the method further includes:

[0061] Send user plane security indication information corresponding to the first DRB to the terminal device, where the user plane security indication information is used to indicate whether to activate user plane security protection of the first DRB, and the user plane security indication information is determined based on the second user plane security protection policy.

[0062] The user plane security indication information corresponding to the first DRB is used to notify the terminal device that the user plane security policy of the first QoS flow is the second user plane security policy. In a possible implementation, the user plane security indication information corresponding to the first DRB can be carried in a radio resource control RRC reconfiguration message. Optionally, the RRC reconfiguration message also includes a mapping relationship between the first QoS flow and the first DRB. Through the mapping relationship between the first QoS flow and the first DRB, it is indicated that the user plane security policy of the first DRB is the second user plane security policy.

[0063] In one possible implementation, the instruction from the session management function network element includes the QoS flow identifier of the first QoS flow and the second user plane security policy. After receiving the QoS flow identifier and the second user plane security policy of the first QoS flow from the session management function network element, the access network device determines, based on the QoS flow identifier and the second user plane security policy of the first QoS flow, that the user plane security policy of the first QoS flow is the second user plane security policy. Based on the explicit instruction from the session management function network element, the access network device determines that the user plane security policy of the first QoS flow is the second user plane security policy.

[0064] In another possible implementation, an access network device receives first indication information from a session management function network element, where the first indication information indicates that the user plane security policy of a first QoS flow is the second user plane security policy. The access network device then determines, based on the first indication information, that the user plane security policy of the first QoS flow is the second user plane security policy. The first indication information is an implicit indication from the session management function network element. Based on the first indication information, the access network device determines that the user plane security policy of the first QoS flow is the second user plane security policy.

[0065] In one possible implementation, in response to an indication from the session management function network element, the access network device determines that the user plane security policy of the first quality of service QoS flow is the second user plane security policy, including: the access network device receives first indication information from the session management function network element, the first indication information being used to indicate that the user plane security policy of the first QoS flow is the second user plane security policy; the access network device determines, based on the first indication information, that the user plane security policy of the first QoS flow is the second user plane security policy. The first indication information is carried in the control information of the first QoS flow, and implicitly indicates, through the control information of the first QoS flow, that the user plane security policy of the first QoS flow is the second user plane security policy. The network function or device that receives the control information of the first QoS flow determines, based on the control information of the first QoS flow, that the user plane security policy of the first QoS flow is the second user plane security policy.

[0066] In one possible implementation, the first indication information is carried in the QoS flow identifier QFI of the first QoS flow. A first indication bit is added to the QFI, and the first indication bit is used to indicate that the user plane security policy of the first QoS flow is the second user plane security policy. For example, when the first indication bit is "1", it indicates that the user plane security policy of the first QoS flow is the second user plane security policy. For another example, when the first indication bit is "0", it indicates that the first QoS flow adopts the user plane security policy of the session to which the first QoS flow belongs.

[0067] Alternatively, the first indication information is carried in the QoS profile of the QoS template corresponding to the first QoS flow. The first indication information is added to the QoS profile of the first QoS flow, and the first indication information is used to indicate that the user plane security policy of the first QoS flow is the second user plane security policy. For example, when the first indication information is "1", it indicates that the user plane security policy of the first QoS flow is the second user plane security policy. For another example, when the first indication information is "0", it indicates that the first QoS flow adopts the user plane security policy of the session to which the first QoS flow belongs.

[0068] Alternatively, the first indication information is carried in the description information of the first QoS flow. The QoS flow description (QoS flow description) of the first QoS flow includes the first indication information.

[0069] In one possible implementation, the access network device determines that the user plane security policy of the first QoS flow is the second user plane security policy, including: the access network device obtains a configuration policy of the access network device, the configuration policy of the access network device includes a correspondence between the first QoS flow and the second user plane security policy; the access network device determines, based on the configuration policy of the access network device and the first indication information, that the first QoS flow adopts the second user plane security policy. The configuration policy can be a session-granular configuration policy, or the configuration policy can be a service data flow-granular configuration policy, which is not limited here.

[0070] In a third aspect, an embodiment of the present application provides a communication method, including:

[0071] The session management function network element obtains the network status;

[0072] The session management function network element determines, according to the network state, a second user plane security policy corresponding to the network state;

[0073] When the second user plane security policy is inconsistent with the user plane security policy of the session of the terminal device, the session management function network element instructs the access network device to perform user plane security protection on the first QoS flow according to the second user plane security policy, and the first QoS flow carries the service data flow.

[0074] In an embodiment of the present application, after the session management function network element obtains the network status, it determines the second user plane security policy corresponding to the network status. When the second user plane security policy is inconsistent with the user plane security policy of the session in which the terminal device carries the service data flow, the session management function network element instructs the access network device to perform user plane security protection on the first QoS flow according to the second user plane security policy, and the first QoS flow carries the service data flow. Using the method provided in the above embodiment, the session management function network element realizes the modification of the user plane security policy of the first QoS flow, so that the QoS flow can execute different user plane security policies, and realizes security protection based on the QoS flow under different security requirements, thereby meeting different user plane security policies of the service data flow. In addition, when the user plane security policy of the session is different from the user plane security policy of the first QoS flow, the SMF can also instruct each network function or terminal device to modify the user plane security policy of the first QoS flow to ensure that the core network, access network and terminal adopt the same security policy for the same first QoS flow.

[0075] In a possible implementation, the session management function network element obtains the network status, including:

[0076] The session management function network element obtains notification information, where the notification information comes from any one or more of the following network functions or devices: an access and mobility management function, an access network device, a policy control function network element, a network manager, or a terminal device;

[0077] The session management function network element determines the network status according to the notification information.

[0078] In a possible implementation, the network status includes a network security capability, and the session management function network element determines, based on the network status, the second user plane security policy corresponding to the network status, including:

[0079] The session management function network element determines, according to the network status, that the network security capability is improved;

[0080] In response to the improved network security capability, the session management function network element determines the second user plane security policy, where the security protection capability of the second user plane security policy is higher than the security protection capability of the first user plane security policy, and the first user plane security policy is the user plane security policy adopted by the first QoS flow before the network status changes.

[0081] In one possible implementation, the network status includes: the network returns to normal, wherein the network returns to normal includes: the congestion in the network returns to normal, the service resources provided by the network are improved, and / or the network functions in the network return to normal.

[0082] In a possible implementation, the network status includes a network security capability, and the session management function network element determines, based on the network status, the second user plane security policy corresponding to the network status, including:

[0083] The session management function network element determines, based on the network status, that the network security capability has decreased;

[0084] In response to the decline in the network security capability, the session management function network element determines the second user plane security policy, where the security protection capability of the second user plane security policy is lower than the security protection capability of the first user plane security policy, and the first user plane security policy is the user plane security policy adopted by the first QoS flow before the network status changes.

[0085] In one possible implementation, the network status includes: network abnormality, which includes: network congestion, natural disasters in the area where the network is deployed, reduced service resources provided by the network, and / or network function failure in the network.

[0086] In a possible implementation, the session management function network element determines, according to the network state, the second user plane security policy corresponding to the network state, including:

[0087] The session management function network element obtains the subscription data of the unified data management network element;

[0088] The session management function network element determines, based on the subscription data and the network status, that the user plane security policy corresponding to the network status is the second user plane security policy.

[0089] In a possible implementation, the session management function network element determines, according to the network state, the second user plane security policy corresponding to the network state, including:

[0090] The session management function network element obtains the policy and charging control PCC rules from the policy control function network element;

[0091] The session management function network element determines, according to the network state, from the PCC rule, a user plane security policy corresponding to the network state as the second user plane security policy.

[0092] In a possible implementation, the session management function network element determines, according to the network state, the second user plane security policy corresponding to the network state, including:

[0093] The session management function network element obtains a local configuration policy, where the local configuration policy includes a correspondence between the network state and the second user plane security policy;

[0094] The session management function network element determines, according to the network state, from the configuration policy, a user plane security policy corresponding to the network state as the second user plane security policy.

[0095] In a possible implementation manner, the session management function network element instructing the access network device to perform user plane security protection on the first QoS flow according to the second user plane security policy, including:

[0096] The session management function network element sends the QoS flow identifier of the first QoS flow and the second user plane security policy to the access network device.

[0097] In a possible implementation manner, the session management function network element instructing the access network device to perform user plane security protection on the first QoS flow according to the second user plane security policy, including:

[0098] The session management function network element sends first indication information to the access network device, where the first indication information is used to indicate that the user plane security policy of the first QoS flow is the second user plane security policy.

[0099] In a possible implementation manner, the first indication information is carried in the QoS flow identifier of the first QoS flow;

[0100] Alternatively, the first indication information is carried in a QoS profile template corresponding to the first QoS flow;

[0101] Alternatively, the first indication information is carried in the description information of the first QoS flow.

[0102] In one possible implementation, the session management function network element sends access traffic guidance, switching, and splitting ATSSS rules to the terminal device, and the ATSSS rules include the correspondence between the second user plane security policy and the first QoS flow.

[0103] In a fourth aspect, an embodiment of the present application provides a communication method, including:

[0104] The session management function network element receives a session establishment request from a terminal device, wherein the session establishment request includes a first session identifier and a second session identifier;

[0105] The session management function network element determines, according to the session establishment request, that a user plane security policy corresponding to a quality of service QoS flow is a first user plane security policy, and the QoS flow carries data of the terminal device;

[0106] The session management function network element creates a first session and a second session according to the session establishment request, wherein the first session corresponds to the first session identifier, the second session identifier corresponds to the second session identifier, the first session carries the QoS flow, and the user plane security policy of the first session is the first user plane security policy.

[0107] In this embodiment of the present application, after determining that the user plane security policy corresponding to a QoS flow is a first user plane security policy, the session management function network element establishes two protocol data unit (PDU) sessions, each carrying traffic corresponding to the first user plane security policy and other traffic. The PDU session carrying traffic corresponding to the first user plane security policy is protected by the first user plane security policy. This implements user plane security policy control at the granularity of QoS flows.

[0108] In a possible implementation, the method further includes:

[0109] The session management function network element sends the first session identifier and the first user plane security policy to the access network device;

[0110] The session management function network element sends the second session identifier and the user plane security policy of the second session to the access network device.

[0111] In a fifth aspect, the present application provides a communication device, which can implement the method in the above-mentioned first aspect or any possible implementation of the first aspect. The device includes corresponding units or modules for executing the above-mentioned method. The units or modules included in the device can be implemented by software and / or hardware. For example, the device can be a session management function network element, or the device can be a component in the session management function network element (such as a processor, a chip or a chip system, etc.), or the device can also be a logical module or software that can implement all or part of the session management function network element. The communication device includes one or more functional modules, and the one or more functional modules are used to execute the method in the above-mentioned first aspect or any possible implementation of the first aspect. Exemplarily, the communication device includes a transceiver module and a processing module.

[0112] In a sixth aspect of the present application, a communication device is provided, which can implement the method in the second aspect or any possible implementation of the second aspect. The device includes corresponding units or modules for executing the above method. The units or modules included in the device can be implemented by software and / or hardware. For example, the device can be an access network device, or the device can be a component in the access network device (such as a processor, a chip or a chip system, etc.), or the device can also be a logic module or software that can implement all or part of the access network device. The communication device includes one or more functional modules, and the one or more functional modules are used to execute the method in the second aspect or any possible implementation of the second aspect. Exemplarily, the communication device includes a transceiver module and a processing module.

[0113] In a seventh aspect, the present application provides a communication device, which can implement the method in the third aspect or any possible implementation of the third aspect. The device includes corresponding units or modules for executing the above method. The units or modules included in the device can be implemented by software and / or hardware. For example, the device can be a session management function network element, or the device can be a component in a session management function network element (such as a processor, a chip or a chip system, etc.), or the device can also be a logic module or software that can implement all or part of the session management function network element. The communication device includes one or more functional modules, and the one or more functional modules are used to execute the method in the third aspect or any possible implementation of the third aspect. Exemplarily, the communication device includes a transceiver module and a processing module.

[0114] In an eighth aspect of the present application, a communication device is provided, which can implement the method in the fourth aspect or any possible implementation of the fourth aspect. The device includes corresponding units or modules for executing the above method. The units or modules included in the device can be implemented by software and / or hardware. For example, the device can be a session management function network element, or the device can be a component in a session management function network element (such as a processor, a chip or a chip system, etc.), or the device can also be a logic module or software that can implement all or part of the session management function network element. The communication device includes one or more functional modules, and the one or more functional modules are used to execute the method in the fourth aspect or any possible implementation of the fourth aspect. Exemplarily, the communication device includes a transceiver module and a processing module.

[0115] A ninth aspect of an embodiment of the present application provides a communication device, comprising at least one processor coupled to a memory; the memory is used to store programs or instructions; the at least one processor is used to execute the program or instructions so that the device implements a method of any possible implementation method of the first to fourth aspects mentioned above.

[0116] The tenth aspect of an embodiment of the present application provides a communication device, including a communication interface for inputting and / or outputting signaling or data; a processor for executing a computer-executable program so that the device implements a method of any possible implementation method of the aforementioned first to fourth aspects.

[0117] In the eleventh aspect of an embodiment of the present application, a communication device is provided, comprising at least one logic circuit and an input / output interface; the input / output interface is used to input or output information; the logic circuit is used to execute a method as any possible implementation method in the first to fourth aspects mentioned above.

[0118] A twelfth aspect of an embodiment of the present application provides a computer program product, which includes a computer program. When the computer program runs on a computer, it enables the computer to execute the above-mentioned first to fourth aspects, and any possible implementation method.

[0119] A thirteenth aspect of an embodiment of the present application provides a chip system, which includes at least one processor for supporting a communication device to implement the above-mentioned first to fourth aspects, and any possible implementation method.

[0120] In one possible design, the chip system may further include a memory for storing program instructions and data necessary for the communication device. The chip system may be composed of a chip or may include a chip and other discrete components. Optionally, the chip system may further include an interface circuit for providing program instructions and / or data to the at least one processor.

[0121] A fourteenth aspect of an embodiment of the present application provides a communication system, which includes the communication device of the fifth aspect, the communication device of the sixth aspect, the communication device of the seventh aspect, or the communication device of the eighth aspect.

[0122] Among them, the technical effects brought about by any design method in the fifth to fourteenth aspects can refer to the technical effects brought about by the different implementation methods in the above-mentioned first to third aspects, and will not be repeated here.

[0123] It should be understood that, for components in a device, the “sending” mentioned above may be referred to as “output” and the “receiving” may be referred to as “input”. BRIEF DESCRIPTION OF THE DRAWINGS

[0124] FIG1 is a schematic diagram of a communication system according to an embodiment of the present application;

[0125] Figure 2a is a schematic diagram of a PDU session;

[0126] Figure 2b is a schematic diagram of an architecture for access traffic guidance, switching, and splitting;

[0127] FIG2c is a schematic diagram of another architecture for directing, switching, and splitting access traffic;

[0128] FIG3 is a flow chart of an embodiment of a communication method according to an embodiment of the present application;

[0129] FIG4 is a schematic structural diagram of a QFI in an embodiment of the present application;

[0130] FIG5 is a schematic diagram of a structure of a QoS flow description in an embodiment of the present application;

[0131] FIG6 is a flow chart of another embodiment of a communication method proposed in an embodiment of the present application;

[0132] FIG7 is a flow chart of another embodiment of a communication method proposed in an embodiment of the present application;

[0133] FIG8 is a schematic diagram of an application scenario in an embodiment of the present application;

[0134] FIG9 is a schematic diagram of an application scenario in an embodiment of the present application;

[0135] FIG10 is a schematic diagram of an application scenario in an embodiment of the present application;

[0136] FIG11 is a schematic diagram of a communication device provided by the present application;

[0137] FIG12 is another schematic diagram of a communication device provided by the present application;

[0138] FIG13 is another schematic diagram of the communication device provided by the present application;

[0139] FIG14 is another schematic diagram of the communication device provided in this application. DETAILED DESCRIPTION

[0140] The technical solutions in the embodiments of the present application will be described clearly and completely below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, not all of the embodiments. The terms "first", "second" and corresponding terminology labels in the specification and claims of this application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the terms used in this way are interchangeable where appropriate, and this is merely a way of distinguishing objects of the same properties when describing the embodiments of the present application. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, so that a process, method, system, product or device that includes a series of units is not necessarily limited to those units, but may include other units that are not clearly listed or inherent to these processes, methods, products or devices.

[0141] In the description of this application, unless otherwise specified, " / " means or, for example, A / B can mean A or B; "and / or" in this application is merely a description of the association relationship of associated objects, indicating that there can be three relationships, for example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In addition, in the description of this application, "at least one" refers to one or more items, and "multiple items" refers to two or more items. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single items or plural items. For example, at least one of a, b, or c can mean: a, b, c, ab, ac, bc, or abc, where a, b, c can be single or multiple.

[0142] The technical solutions of the embodiments of the present application can be applied to various communication systems, such as: long term evolution (LTE) system, LTE frequency division duplex (FDD) system, LTE time division duplex (TDD), universal mobile telecommunication system (UMTS), world-wide interoperability for microwave access (WiMAX) communication system, fifth generation (5G) system, new generation (NR) communication system or future sixth generation communication system, etc.

[0143] The part of various communication systems operated by operators can be called an operator network. The operator network can also be called a public land mobile network (PLMN) network, which is a network established and operated by the government or an operator approved by the government for the purpose of providing land mobile communication services to the public. It is mainly a public network in which mobile network operators (MNOs) provide mobile broadband access services to users. The operator network or PLMN network described in the embodiments of the present application can be a network that meets the requirements of the 3rd Generation Partnership Project (3GPP) standards, referred to as a 3GPP network. Usually, 3GPP networks are operated by operators, including but not limited to fifth-generation mobile communication networks, fourth-generation mobile communication networks or third-generation mobile communication technology networks. It also includes the future sixth-generation mobile communication network. For the convenience of description, the embodiments of the present application will be explained by taking the operator network as an example.

[0144] The terminal device in the embodiment of the present application may refer to user equipment (UE). The terminal device involved in the embodiment of the present application is a device with wireless transceiver function, which can communicate with one or more core networks (CN) via the access network device in the (radio) access network (R)AN). The terminal device may also be called an access terminal, terminal, user unit, user station, mobile station, mobile station, remote station, remote terminal, mobile device, user terminal, wireless network device, user agent or user device, etc. The terminal device can be deployed on land, including indoors or outdoors, handheld or vehicle-mounted; it can also be deployed on the water (such as ships, etc.); it can also be deployed in the air (such as airplanes, balloons and satellites, etc.). The terminal device can be a cellular phone, a cordless phone, a session initiation protocol (SIP) phone, a smart phone, a mobile phone, a wireless local loop (WLL) station, a personal digital assistant (PDA), a handheld device with wireless communication capabilities, a computing device or other device connected to a wireless modem, a vehicle-mounted device, a wearable device, a drone device or the Internet of Things, a terminal in the Internet of Vehicles, a terminal of any form in a 5G network and future networks, a relay user device or a terminal in a future evolved PLMN, etc., wherein the relay user device can be, for example, a 5G residential gateway (RG). For example, terminal devices can be virtual reality (VR) terminals, augmented reality (AR) terminals, wireless terminals used in industrial control, wireless terminals used in self-driving cars, wireless terminals used in remote medical care, wireless terminals used in smart grids, wireless terminals used in transportation safety, wireless terminals used in smart cities, and wireless terminals used in smart homes. Furthermore, UEs can also be terminal devices in the Internet of Things (IoT) system. The IoT is an important component of future information technology development. Its main technical feature is to connect objects to the network through communication technologies, thereby realizing an intelligent network that interconnects humans and machines, and things and things.IoT technology can achieve massive connections, deep coverage, and terminal power saving through, for example, narrowband (NB) technology. In addition, UE can also include sensors such as smart printers, train detectors, and gas stations. Its main functions include collecting data (part of the terminal equipment), receiving control information and downlink data from network equipment, and sending electromagnetic waves to transmit uplink data to network equipment. It should be understood that UE can be any device that can access the network. The UE and the access network device can communicate with each other using a certain air interface technology, which is not limited in the embodiments of the present application.

[0145] Please refer to Figure 1, which is a schematic diagram of a communication system according to an embodiment of the present application. As shown in Figure 1, the network includes an access and mobility management function (AMF) network element, a unified data management (UDM) network element, a radio access network (RAN), a policy control function network element, terminal equipment, a user plane function (UPF) network element, a data network, and the like.

[0146] It should be understood that Figure 1 is only a schematic description diagram, and the embodiments of the present application do not limit the number and types of network elements (or devices, or network functions) actually deployed in the network.

[0147] The main functions of the devices shown in Figure 1 are described as follows:

[0148] The wireless access network includes one or more access network devices. The access network devices in this application include but are not limited to: the next generation base station (gnodeB, gNB) in 5G, evolved node B (eNB), radio network controller (RNC), node B (NB), base station controller (BSC), base transceiver station (BTS), home base station (e.g., home evolved nodeB, or home node B, HNB), base band unit (BBU), transmission point (TRP), transmitting point (TP), mobile switching center, etc.

[0149] The unified data management network element (UDME) (also known as unified data management, unified data management network element entity, data management device, or unified data management network element device) is a core network device primarily responsible for processing terminal device identification, access authentication, registration, and mobility management. The UDM NE is a control plane device.

[0150] Policy control function network element (also known as policy control network element, policy control function, policy control equipment, policy control function network element entity, etc.): mainly responsible for billing at the session and service flow level, service quality bandwidth guarantee and mobility management, terminal device policy decision-making and other policy control function network elements.

[0151] Session management function (SMF) network element (also known as session management function): mainly performs session management, execution of control policies issued by PCF, selection of UPF, and allocation of Internet Protocol addresses for terminal devices.

[0152] The access and mobility management function network element (also known as access and mobility management function entity, access and mobility management device, access and mobility management function, access management device, mobility management device) is a type of core network equipment, mainly used for mobility management and access management, etc. It can be used to implement other functions of the mobility management entity (MME) in addition to session management, such as lawful interception, or access authorization (or authentication), user equipment registration, mobility management, tracking area update process, reachability detection, selection of session management network element, mobile state transition management, etc.

[0153] User plane functional network element (also known as user plane equipment, user plane functional network element, user plane network element, user plane functional entity): mainly includes the following functions: data packet routing and transmission, packet detection, service usage reporting, QoS processing, legal monitoring, uplink packet detection, downlink data packet storage and other user plane related functions.

[0154] The Application Function (AF) is similar to an application server, interacting with other 5G core network control plane NFs to provide business services. The AF can exist for different application services and can be owned by the operator or a trusted third party. For example, this network element's primary function is to inform the PCF of the latest third-party enterprise's business requirements for a specific application. Based on these requirements, the PCF generates corresponding Quality of Service (QoS) rules to ensure that the services provided by the network meet the third-party's requirements.

[0155] Network Exposure Function (NEF), not shown in the figure. NEF may also be referred to as network exposure device, network exposure function entity, network exposure function network element, network capability exposure function entity, network capability exposure function device, network capability exposure function network element, or network capability exposure device. NEF is primarily used to support the exposure of capabilities and events, such as securely exposing services and capabilities provided by 3GPP network functions to the outside world.

[0156] It should be understood that the RAN, SMF, PCF or AF in the embodiments of the present application may also be referred to as a communication device or communication equipment, which may be a general device or a dedicated device, and the present application does not make any specific limitations on this.

[0157] It should also be understood that the above naming is only used to distinguish different functions, and does not mean that these devices are independent physical devices. This application does not limit the specific form of the above devices. For example, they can be integrated into the same physical device, or they can be different physical devices. In actual deployment, network functions (or simply referred to as functions), network elements or devices can be combined. For example, the access and mobility management function network element can be combined with the session management function network element; the session management function network element can be combined with the user plane function network element. When two functions are combined, the interaction between the two functions provided in the embodiment of the present application becomes the internal operation of the combined function or can be omitted.

[0158] It is understandable that the above functions can be network elements in hardware devices, software functions running on dedicated hardware, or a combination of hardware and software, or virtualized functions instantiated on a platform (e.g., a cloud platform).

[0159] It should be noted that the naming of each device in Figure 1 (such as PCF, AMF, etc.) is only a name, and the name does not limit the function of the device itself. In 5G networks and other future networks, the above-mentioned devices may also have other names, and this application does not specifically limit this. For example, in a 6G network, some or all of the above-mentioned network elements may use the terminology in 5G, or may be named otherwise, etc., which are uniformly explained here and will not be repeated below.

[0160] It should be noted that the exemplary examples mentioned in this application do not represent the optimal ones; the first, second, etc. mentioned in this application are only used to distinguish different information, messages or other objects, and do not represent a sequential relationship; in addition, the various embodiments in this application can refer to and learn from each other, and the same or similar steps or nouns will not be repeated one by one.

[0161] In order to better describe the technical solutions of the embodiments of the present application, the technical terms related to the technical solutions of the embodiments of the present application will be described below.

[0162] 1. Session, quality of service flow (QoS flow) and data radio bearer (DRB).

[0163] Sessions enable the transmission of terminal device service data between the terminal device and the core network. A session can include one or more QoS flows. QoS flows are identified by a QoS flow identifier (QFI). The session management function network element assigns a QoS flow to a service data flow. In other words, the QoS flow is used to carry the service data flow.

[0164] The core network provides the access network device with the QoS parameters corresponding to each QoS flow. Based on the QoS parameters, the access network device configures the data radio bearer and maps the QoS flow to the DRB. For example, multiple QoS flows with the same or similar QoS parameters can be mapped to the same DRB, and the DRB is used to transmit the one or more QoS flows mapped to that DRB.

[0165] For example, refer to Figure 2a, which is a schematic diagram of a PDU session in fifth-generation mobile communication technology. The PDU session between the core network and the UE includes QoS flows 1-7 (Flow 1-Flow 7), a total of seven QoS flows, of which QoS flows 1-2 are carried on DRB1, QoS flows 3-4 are carried on DRB2, and QoS flows 5-7 are carried on DRB3.

[0166] 2. User plane security policy.

[0167] The terminal device and access network equipment implement session security protection based on the user plane security policy. This policy may include user plane integrity protection and / or user plane encryption protection. The user plane security policy for a session is determined during session establishment and applies throughout the lifetime of the session.

[0168] 2.1. User plane integrity protection in the user plane security policy can have three values:

[0169] 1) Required: User plane integrity protection must be used for all traffic in the session.

[0170] 2) Recommended: User plane integrity protection should be used for all traffic in the session.

[0171] 3) Not needed: No user plane integrity protection is performed on the session.

[0172] 2.2 User plane encryption protection in the user plane security policy can have three values:

[0173] 1) Required: All traffic on the session must be protected by user-plane encryption.

[0174] 2) Recommended: User plane encryption should be used for all traffic in the session.

[0175] 3) Not needed: No user plane encryption protection is performed on the session.

[0176] Current user plane security policies are usually session-granular, meaning that one or more QoS flows contained in a session all use the same user plane security policy. However, the service data carried by different QoS flows is different, and using the same user plane security policy may lead to a decline in user plane security protection performance.

[0177] For example, in the access traffic steering switching splitting (ATSS) scenario, if the service data in the QoS flow is transmitted using the multipath quick UDP internet connection (MPQUIC) protocol, since the MPQUIC protocol uses a mandatory encryption security mechanism, that is, the MPQUIC protocol stipulates that the terminal device and the UPF perform encryption protection and integrity protection on the data flow, if the user plane security policy corresponding to the session carrying the QoS flow requires user plane integrity protection and user plane encryption protection, then the QoS flow has the problem of redundant encryption.

[0178] The following describes the communication method proposed in the embodiment of the present application in conjunction with the accompanying drawings. First, please refer to Figure 3, which is a flow chart of an embodiment of the communication method in the embodiment of the present application. The communication method proposed in the embodiment of the present application includes:

[0179] S1. A session management function network element receives a session establishment request message from a terminal device, where the session establishment request message is used to request establishment of a session.

[0180] In step S1, illustratively, the session is a PDU session, and the session establishment request message is a "PDU Session Establishment Request" message.

[0181] S2. The session management function network element obtains the first user plane security policy in response to the session establishment request message.

[0182] In step S2, the session management function network element obtains, based on the session establishment request message, a user plane security policy for the session requested by the session establishment request message. For ease of description, the user plane security policy for the session is referred to as a first user plane security policy. The first user plane security policy is used to indicate whether to activate user plane security protection corresponding to the session.

[0183] Exemplarily, the session management function network element may obtain the first user plane security policy in a variety of ways. For example, the session management function network element determines the first user plane security policy based on subscription data of the terminal device from the unified data management network element. In another example, the session management function network element determines the first user plane security policy based on a local configuration policy of the session management function network element. In another example, the session management function network element determines the first user plane security policy based on a maximum data rate supported by the terminal device for user plane integrity protection of DRBs.

[0184] S3. The session management function network element sends the first user plane security policy and an identifier indicating the session to the access network device.

[0185] In step S3, the session management function network element sends a first user plane security policy and an identifier indicating the session to the access network device. Through the session identifier and the first user plane security policy, the access network device is notified that the user plane security policy corresponding to the session is the first user plane security policy. Accordingly, during the process of establishing a session with the terminal device, the access network device receives the first user plane security policy corresponding to the session and the identifier indicating the session from the session management function network element. The first user plane security policy is used to indicate whether to activate user plane security protection corresponding to the session. For example, the first user plane security policy is used to indicate activation of user plane security protection corresponding to the session, or the first user plane security policy is used to indicate deactivation of user plane security protection corresponding to the session. The access network device determines whether to activate user plane security protection for the data radio bearer (DRB) belonging to the session based on the first user plane security policy. For example, if the first user plane security policy includes that the session requires user plane integrity protection and that the session requires user plane encryption protection, the access network device determines that the DRB belonging to the session requires both user plane integrity protection and user plane encryption protection based on the first user plane security policy.

[0186] After the session management function network element sends the first user plane security policy and the identifier indicating the session to the access network device, step S4 is entered.

[0187] S4. The session management function network element obtains characteristic information of the service data flow of the terminal device.

[0188] In step S4, the service data flow of the terminal device refers to the service data flow transmitted between the terminal device and the service server. The service data flow involved in the embodiment of the present application may be a service data flow transmitted using UDP, transmission control protocol or other protocols. For example, the service data flow of the terminal device may be: a UDP service data flow in a PDU session established between the terminal device and the 5G core network (5G core, 5GC); or, a UDP service data flow in a packet data network (packet data network, PDN) connection established between the terminal device and the evolved packet core network (evolved packet core network, EPC) network.

[0189] The characteristic information of the business data flow described in the embodiments of the present application includes any one or more of the following information: the business type of the business data flow, the network transmission protocol of the business data flow, the Internet Protocol IP quintuple of the business data flow, or the application layer security activation status of the business data flow.

[0190] Exemplarily, the service types of the service data flow include, but are not limited to: instant messaging service, video service, web browsing service, audio service, extended reality (XR) service, or virtual reality (VR) service, etc.

[0191] Exemplarily, the network transmission protocol of the service data stream includes, but is not limited to: TCP protocol, UDP protocol, QUIC protocol, MPTCP protocol or MPQUIC protocol.

[0192] The QUIC protocol is a transport protocol based on the UDP transport layer protocol that can achieve multiplexing and secure transmission between the client and the server. For example, the client can be a terminal device and the server can be a service server that provides services to the client.

[0193] QUIC connections use transport layer security (TLS) to establish and maintain secure connections and end-to-end encryption. All data sent over QUIC connections is encrypted by default, which helps prevent data from eavesdropping and other forms of attacks.

[0194] MPQUIC is an extension of QUIC, allowing data to be transmitted over multiple paths. MPQUIC's security mechanisms are similar to those of QUIC, so data sent over MPQUIC is encrypted by default.

[0195] Exemplarily, the Internet Protocol (IP) quintuple of the service data flow includes: source IP address, destination IP address, source port number, destination port number, and network transmission protocol type.

[0196] Exemplarily, the application layer security activation status of the service data flow includes: the application layer of the service data flow is encrypted and / or integrity protected, or the application layer of the service data flow is not encrypted and / or not integrity protected.

[0197] In one implementation, the characteristic information of the service data flow includes any one or more of the following information: flow identification information of the service data flow, service data flow description information, application identification of the service data flow, identification of the session carrying the service data flow, and identification of the terminal device transmitting the service data flow. The application identification of the service data flow is specifically the identification of the application corresponding to the service data flow. Exemplarily, the identification of the session carrying the service data flow can be the identification of the PDU session carrying the service data flow.

[0198] In another possible implementation, characteristic information of a service data flow is indicated by packet filters of the service data flow. In other words, the packet filters of the service data flow include the characteristic information of the service data flow. The packet filters of the service data flow can be carried in various messages, such as a PDU session modification request message. Exemplarily, the session management function network element determines the characteristic information of the service data flow from the packet filters of the service data flow included in the PDU session modification request message.

[0199] The following describes how the session management function network element obtains characteristic information of the service data flow of the terminal device. Exemplarily, the session management function network element obtains characteristic information of the service data flow of the terminal device using any one or more of the following methods 1 to 3.

[0200] Mode 1: The session management function network element receives characteristic information of the service data flow of the terminal device sent by the terminal device.

[0201] For example, a terminal device sends a message to a session management function network element requesting to modify a session. In response, the session management function network element receives the message from the terminal device requesting to modify the session. The message includes characteristic information about the service data flow of the terminal device. Exemplarily, the message requesting to modify the session is a session modification request message.

[0202] Mode 2: The session management function network element receives the characteristic information of the service data flow of the terminal device sent by the policy control function network element PCF.

[0203] For example, the policy control function network element sends a message to the session management function network element requesting an update of policy information for the session, where the message includes characteristic information of the service data flow. Exemplarily, the message may be an "Npcf_SMPolicyControl_UpdateNotify request" message.

[0204] Exemplarily, the session management function network element obtains characteristic information of the service data flow in a session management (SM) policy association modification process initiated by the policy control function network element.

[0205] Regarding the PCF session management policy association modification process, the AF may trigger the PCF session management policy association modification process. In the above PCF session management policy association modification process, the AF sends the characteristic information of the service data flow to the PCF through the NEF. For example, the PCF obtains the characteristic information of the service data flow from the "Npcf_PolicyAuthorization_Create" message or the "Npcf_PolicyAuthorization_Update" message.

[0206] The following describes the process of modifying the PCF session management policy association triggered by AF:

[0207] (1) AF can initiate the QoS flow creation process.

[0208] First, the AF sends a "Nnef_AFsessionWithQoS_Create" request message to the NEF, which is used to request the establishment of an AF session. The request message includes one or more of the following information: UE address information, AF identification information, flow description information, external application identifier, QoS reference or individual QoS parameters, PDU set QoS parameters, protocol description, or alternative service requirements. The above one or more information includes feature information of the service data flow.

[0209] Secondly, the NEF performs an authorization check in response to the "Nnef_AFsessionWithQoS_Create" request message. The NEF then discovers the PCF and forwards the information carried in the "Nnef_AFsessionWithQoS_Create" request message to the PCF. The NEF sends the "Npcf_PolicyAuthorization_Create" request message to the PCF, which carries one or more of the above information. If the AF is considered to be trusted by the operator, the AF directly sends the "Npcf_PolicyAuthorization_Create" request message to the PCF, which carries one or more of the above information. The AF requests that resources be reserved for the AF's related sessions through the "Npcf_PolicyAuthorization_Create" request message.

[0210] Next, after receiving the "Npcf_PolicyAuthorization_Create" request message, the PCF determines whether the request message is authorized. If the request message is authorized, the PCF derives the QoS parameters required by the PCC rules based on the information carried in the request message. The PCF then determines whether to allow the QoS flow based on the PCF configuration and notifies the NEF of the determination result. If the NEF has subscribed to QoS monitoring events, the PCF generates a QoS monitoring policy for the service data flow based on the information provided by the NEF. If the AF is deemed to be trusted by the operator, the PCF directly sends an "Npcf_PolicyAuthorization_Create" response message to the AF.

[0211] (2) AF can initiate the QoS flow modification process.

[0212] For an established AF session, the AF can send an "Nnef_AFsessionWithQoS_Update" request message to the NEF. This message is used to update the reserved resources for the AF session. This message includes one or more of the following information: AF identifier, transaction reference ID, flow description information, QoS reference or single QoS parameter, PDU Set QoS parameter, protocol description, or alternative service requirements. This one or more of these information includes service data flow characteristics.

[0213] The AF may also provide one or more of the following parameters describing traffic characteristics: flow direction, burst arrival time of UE (uplink) or UPF (downlink), periodicity, time domain, lifetime, or period range.

[0214] Optionally, the NEF interacts with the PCF by triggering an "Npcf_PolicyAuthorization_Update" request message, and the NEF forwards the received information or parameters to the PCF.

[0215] Optionally, if the AF is considered to be trusted by the operator, the AF directly interacts with the PCF using an "Npcf_PolicyAuthorization_Update" request message, and the AF sends the above information or parameters to the PCF and updates the reserved resources of the AF session.

[0216] The PCF updates the PCC rules according to the "Npcf_PolicyAuthorization_Update" request message.

[0217] Mode 3: The session management function network element receives subscription data sent by the unified data management network element. The subscription data includes characteristic information of the service data flow of the terminal device.

[0218] For example, the UDM sends the subscription data of the terminal device to the SMF to obtain the subscription data, which includes the characteristic information of the service data flow. For example, the SMF obtains the subscription data from the UDM via the Nudm_SDM_Notification message. For details, see clause 4.3.3.2 of 3GPP standard TS 23.502, "The UDM updates the subscription data of SMF by Nudm_SDM_Notification (SUPI, Session Management Subscription Data)." This is not detailed here.

[0219] In one example, after a terminal device's subscription data changes, the unified data management network element sends the updated subscription data to the session management function network element. Alternatively, the session management function network element proactively obtains the terminal device's subscription data from the unified data management network element. For example, the session management function network element sends a message to the unified data management network element requesting the terminal device's subscription data. The message may include an identifier of the terminal device. In response to the message, the unified data management network element sends the subscription data of the terminal device to the session management function network element. Optionally, the session management function network element may periodically send a message to the unified data management network element requesting the terminal device's subscription data, thereby obtaining the latest terminal device subscription data.

[0220] S5. The session management function network element determines a second user plane security policy corresponding to the service data flow based on the characteristic information of the service data flow.

[0221] In step S5, after the session management function network element obtains the characteristic information of the service data flow, it can determine the second user plane security policy corresponding to the service data flow in various ways.

[0222] The following describes how the session management function network element determines the second user plane security policy corresponding to the service data flow. Exemplarily, the session management function network element uses any one or more of the following methods 1 to 4 to determine the second user plane security policy corresponding to the service data flow.

[0223] Method 1: The session management function network element sends a message to the unified data management network element requesting the terminal device's subscription data. In response, the session management function network element receives the terminal device's subscription data from the unified data management network element. This subscription data includes the mapping between the service data flow's characteristic information and the user plane security policy. Finally, based on the subscription data, the session management function network element determines a second user plane security policy corresponding to the service data flow's characteristic information.

[0224] Exemplarily, the session management function network element sends a message requesting subscription data for a terminal device to the unified data management network element. Optionally, the message includes identification information of the terminal device. In response to the message requesting subscription data for the terminal device, the unified data management network element sends the subscription data to the session management function network element. For example, the unified data management network element determines, based on the identification information of the terminal device in the message, subscription data corresponding to the identification information of the terminal device, and sends the subscription data to the session management function network element. The subscription data includes a second user plane security policy. After receiving the subscription data for the terminal device sent by the unified data management network element, the session management function network element determines from the subscription data that the user plane security policy corresponding to the characteristic information of the service data flow is the second user plane security policy.

[0225] Mode 2: The session management function network element sends a message to the unified data management network element for requesting a user plane security policy corresponding to the characteristic information of the service data flow; the session management function network element receives the second user plane security policy from the unified data management network element.

[0226] Exemplarily, the message for requesting a user plane security policy corresponding to the characteristic information of the service data flow includes the characteristic information of the service data flow. The unified data management network element determines a corresponding second user plane security policy in the subscription data based on the characteristic information of the service data flow carried in the message for requesting a user plane security policy corresponding to the characteristic information of the service data flow. The unified data management network element then sends the second user plane security policy to the session management function network element.

[0227] Method 3: The session management function network element receives the policy and charging control rules from the policy control function network element. The policy and charging control rules include the correspondence between the characteristic information of the service data flow and the user plane security policy; the session management function network element determines the second user plane security policy corresponding to the characteristic information of the service data flow based on the policy and charging control rules.

[0228] Exemplarily, the session management function (SMF) obtains a policy and charging control (PCC) rule from the policy control function (PCF). The SMF then determines the second user plane security policy corresponding to the service data flow from the PCC rule based on the characteristic information of the service data flow. The PCC rule is a dynamic rule that the SMF can dynamically obtain, and modifications to the PCC rule can be triggered by the AF.

[0229] The ATSSS described in the embodiments of the present application may also be referred to as diversion, switching, separation, etc. of the accessed services, which is not specifically limited in the embodiments of the present application. A terminal device or UPF supporting the ATSSS function may select a link for transmission of a data packet based on the diversion mode and link status.

[0230] Specifically, the terminal device supporting the ATSSS function supports one or more of the following functions: multipath TCP (MPTCP) function, MPQUIC protocol function and ATSSS low layer (ATSSS-LL) function.

[0231] Each steering, switching, and splitting function in the UE allows service traffic to be diverted, switched, and / or diverted to 3GPP access and non-3GPP access according to the ASSSS rules provided by the network, or allows service traffic to be diverted, switched, and / or diverted to 3GPP access, or allows service traffic to be diverted, switched, and / or diverted to non-3GPP access. For example, as shown in Figures 2b and 2c, Figure 2b is a schematic diagram of an architecture for access traffic steering, switching, and splitting, and Figure 2c is a schematic diagram of an architecture for access traffic steering, switching, and splitting. Figure 2b illustrates a non-roaming scenario supporting ATSSS and a roaming scenario using local breakout. In Figure 2b, the UE and UPF support MPTCP function, MPQUIC function, and ATSSS-LL function. Figure 2c illustrates a scenario supporting ATSSS using home-routed roaming. In Figure 2c, the UE and local UPF (H-UPF) support MPTCP function, MPQUIC function, and ATSSS-LL function.

[0232] For Ethernet-type multi-access protocol data unit (MA PDU) sessions (also known as multi-access PDU sessions), the ATSSS-LL function is required in the UE. In the same MA PDU session in the UE, the MPTCP function can be used to guide the service data flow corresponding to TCP, the MPQUIC function can be used to guide the service data flow corresponding to UDP, and the ATSSS-LL function can be used to guide other service data flows (ATSSS-LL can also guide TCP and UDP traffic).

[0233] Further optionally, the ATSSS rule derived by the SMF based on the PCC rule may also include a second user plane security policy. Exemplarily, the ATSSS rule is shown in Table 1, and the ATSSS rule may include any one or more of the information in Table 1. It is understandable that the ATSSS rule may also include other information, which is not described here.

[0234] Table 1

[0235] Mode 4: The session management function network element determines the second user plane security policy corresponding to the characteristic information of the service data flow based on a local configuration policy. Specifically, the session management function network element obtains the local configuration policy, which includes the correspondence between the service data flow and the corresponding user plane security policy. For the session management function network element, the local configuration policy may also be referred to as the session management function network element's configuration policy.

[0236] Specifically, the session management function network element determines the second user plane security policy based on the local configuration policy. For example, the local configuration policy includes a correspondence between a service data flow and the second user plane security policy. The session management function network element determines the second user plane security policy corresponding to the service data flow from the configuration policy based on the characteristic information of the service data flow. The configuration policy can be a configuration policy at the session granularity, a configuration policy at the QoS flow granularity, or a configuration policy at the service data flow granularity. Exemplarily, the configuration policies are shown in Tables 2 to 5.

[0237] Exemplarily, the configuration policy is shown in Table 2. When the redirection function used by the service data flow is the MPQUIC function, the second user plane security policy is user plane security policy #1. When the redirection function used by the service data flow is the MPTCP function, the second user plane security policy is user plane security policy #2. When the redirection function used by the service data flow is the ATSSS-LL function, the second user plane security policy is user plane security policy #3. Exemplarily, the session management function network element determines the redirection function used by the service data flow based on characteristic information of the service data flow. For example, the session management function network element determines the redirection function used by the service data flow from the ATSSS rules based on the characteristic information of the service data flow.

[0238] Table 2

[0239] In another exemplary embodiment, the configuration strategy is shown in Table 3.

[0240] Table 3

[0241] For example, the configuration policy is shown in Table 3. When the service data flow type is an XR service, the second user plane security policy is user plane security policy #1. When the service data flow type is a VR service, the second user plane security policy is user plane security policy #2. When the service data flow type is other services, the second user plane security policy is user plane security policy #3.

[0242] In another exemplary embodiment, the configuration strategy is shown in Table 4.

[0243] Table 4

[0244] Exemplarily, the configuration policy is shown in Table 4. When the application layer security activation state of the service data flow is that the application layer of the service data flow is encrypted, the second user plane security policy is user plane security policy #1. When the application layer security activation state of the service data flow is that the application layer of the service data flow is not encrypted, the second user plane security policy is user plane security policy #2. In another exemplary embodiment, the user plane security policy corresponding to the service data flow in the session can also be determined according to the network transmission protocol of the service data flow, that is, according to the network transmission protocol of the service data flow, the user plane security policy adopted by the service data flow related to the network transmission protocol in the session is determined. For example, the configuration policy is shown in Table 5.

[0245] Table 5

[0246] Regarding Table 5, it is illustrated that: when the network transmission protocol of the business data flow is the QUIC protocol, the business data flow in the session adopts user plane security policy #1; when the network transmission protocol of the business data flow is the TCP protocol, the business data flow in the session adopts user plane security policy #2; when the network transmission protocol of the business data flow is the TCP protocol and the TLS protocol, the business data flow in the session adopts user plane security policy #3.

[0247] Furthermore, the characteristic information of the service data flow includes indication information for indicating the application layer security activation status of the service data flow. The application layer security activation status of the service data flow includes: whether the application layer of the service data flow is encrypted and / or integrity protected, or whether the application layer of the service data flow is not encrypted and / or integrity protected. Exemplarily, the indication information may be an application identifier. The session management function network element determines the application layer security activation status corresponding to the service data flow based on the application identifier.

[0248] If the indication information indicates that the service data flow is encrypted at the application layer and the first user plane security policy includes the requirement that user plane encryption be activated, the second user plane security policy includes the requirement that user plane encryption not be enabled. And / or, if the indication information indicates that integrity protection is already implemented at the application layer of the service data flow, the second user plane security policy includes the requirement that user plane integrity protection not be enabled. User plane encryption not being enabled can also be referred to as not requiring user plane encryption protection. User plane integrity protection not being enabled can also be referred to as not requiring user plane integrity protection.

[0249] S6. If the second user plane security policy is inconsistent with the first user plane security policy, the session management function network element sends the second user plane security policy and the QoS flow identifier of the first QoS flow of quality of service to the access network device, where the QoS flow identifier of the first QoS flow is used to indicate the first QoS flow in the session for carrying the service data flow.

[0250] In step S6, the session management function network element determines whether the second user plane security policy is consistent with the first user plane security policy. If not, the session management function network element instructs the access network device to perform user plane security protection on the first QoS flow carrying the service data flow according to the second user plane security policy. If the session management function network element determines that the second user plane security policy is consistent with the first user plane security policy, the session management function network element instructs the access network device to perform user plane security protection on the first QoS flow carrying the service data flow according to the first user plane security policy. Alternatively, the session management function network element sends the first user plane security policy and the QoS flow identifier of the first QoS flow to the access network device.

[0251] The second user plane security policy includes but is not limited to: a. the first QoS flow requires user plane integrity protection;

[0252] b. User plane integrity protection is recommended for the first QoS flow;

[0253] c. The first QoS flow does not require user plane integrity protection;

[0254] d. The first QoS flow requires user plane encryption protection;

[0255] e. The first QoS flow recommends user plane encryption protection;

[0256] f. The first QoS flow does not require user plane encryption protection;

[0257] g. The first QoS flow requires user plane integrity protection, and the first QoS flow requires user plane encryption protection;

[0258] h. The first QoS flow requires user plane integrity protection, and the first QoS flow recommends user plane encryption protection;

[0259] i. The first QoS flow requires user plane integrity protection, and the first QoS flow does not require user plane encryption protection;

[0260] j. The first QoS flow recommends user plane integrity protection, and the first QoS flow requires user plane encryption protection;

[0261] k. The first QoS flow recommends user plane integrity protection, and the first QoS flow recommends user plane encryption protection;

[0262] l. The first QoS flow recommends user plane integrity protection, and the first QoS flow does not require user plane encryption protection;

[0263] m. The first QoS flow does not require user plane integrity protection, and the first QoS flow requires user plane encryption protection;

[0264] n. The first QoS flow does not require user plane integrity protection, and the first QoS flow recommends user plane encryption protection;

[0265] o. The first QoS flow does not require user plane integrity protection, and the first QoS flow does not require user plane encryption protection.

[0266] Regarding the session management function network element instructing the access network device to perform user plane security protection on the first QoS flow carrying the service data flow according to the second user plane security policy, there are multiple specific methods, which are described below:

[0267] In one possible implementation, the session management function network element sends the second user plane security policy and the QoS flow identifier of the first QoS flow to the access network device. The QoS flow identifier of the first QoS flow includes, but is not limited to, the QoS flow identifier of the first QoS flow, a 5G QoS indicator, or an allocation and retention priority. Optionally, the session management function network element sends the second user plane security policy and the QoS flow identifier of the first QoS flow to the access network device via an access and mobility management function.

[0268] Exemplarily, the "Namf_Communication_N1N2MessageTransfer" message sent by the session management function network element to the access and mobility management function carries the second user plane security policy and the identifier of the QoS flow; the "N2_PDU_Session Request (NAS msg)" message sent by the access and mobility management function to the access network device carries the second user plane security policy and the identifier of the QoS flow.

[0269] In another possible implementation manner, the session management function network element sends first indication information to the access network device, where the first indication information is used to indicate that the user plane security policy of the first QoS flow is the second user plane security policy.

[0270] The first indication information is carried in the control information of the first QoS flow, and the control information of the first QoS flow implicitly indicates that the user plane security policy of the first QoS flow is the second user plane security policy. The network function or device that receives the control information of the first QoS flow determines that the user plane security policy of the first QoS flow is the second user plane security policy based on the control information of the first QoS flow.

[0271] The control information of the first QoS flow is introduced below. The control information of the first QoS flow includes but is not limited to: the QFI of the first QoS flow, the QoS template (profile) of the first QoS flow, the QoS flow description (QoS flow description) of the first QoS flow, or other relevant information of the QoS flow.

[0272] (1) The QFI of the first QoS flow includes first indication information, and a first indication bit is newly added in the QFI, and the first indication bit is used to indicate that the user plane security policy of the first QoS flow is the second user plane security policy. For example, when the first indication bit is "1", it indicates that the user plane security policy of the first QoS flow is the second user plane security policy. For another example, when the first indication bit is "0", it indicates that the first QoS flow adopts the user plane security policy of the session to which the first QoS flow belongs.

[0273] For example, please refer to Figure 4, which is a schematic diagram of the structure of a QFI in an embodiment of the present application. The current QFI is 6 bits long. In this embodiment of the present application, the QFI is expanded to include the original 6-bit field and the first indicator bit. For example, when the first indicator bit is 1 bit long, the expanded QFI is 7 bits long.

[0274] It should be noted that the QFI carrying the first indicator bit can be carried in any message sent by the SMF to any network function or device, and this embodiment of the present application does not limit this.

[0275] It should be noted that the first indication bit may also be carried by other QoS flow identification information of the first QoS flow, and the other QoS flow identification information includes but is not limited to: the QoS classification identification code of the first QoS flow, the 5G QoS indication of the first QoS flow, or the allocation maintenance priority of the first QoS flow.

[0276] (2) The QoS profile of the first QoS flow includes first indication information. The first indication information is added to the QoS profile of the first QoS flow, and the first indication information is used to indicate that the user plane security policy of the first QoS flow is the second user plane security policy. For example, when the first indication information is "1", it indicates that the user plane security policy of the first QoS flow is the second user plane security policy. For another example, when the first indication information is "0", it indicates that the first QoS flow adopts the user plane security policy of the session to which the first QoS flow belongs.

[0277] For example, the QoS template of the first QoS flow may be carried in an N2 message, and the N2 message is sent by the session management function network element to the access network device through the access and mobility management function.

[0278] (3) The QoS flow description of the first QoS flow includes first indication information. Regarding the QoS flow description, it means that the network can also provide the UE with one or more QoS flow descriptions associated with a PDU session at the PDU session establishment or at the PDU session modification. The QoS flow description of the first QoS flow includes the first indication information. In the QoS flow description of the first QoS flow, a second indication bit is added, and the second indication bit is used to indicate that the user plane security policy of the first QoS flow is the second user plane security policy. For example, when the second indication bit is "1", it indicates that the user plane security policy of the first QoS flow is the second user plane security policy. For another example, when the second indication bit is "0", it indicates that the first QoS flow adopts the user plane security policy of the session to which the first QoS flow belongs, and the user plane security policy of the session is the first user plane security policy, that is, the user plane security policy of the first QoS flow is not modified. For ease of understanding, please refer to Figure 5, which is a structural diagram of the QoS flow description in an embodiment of the present application.

[0279] (4) Other relevant information of the first QoS includes first indication information. A first information element (IE) is added to the other relevant information of the first QoS, and the first information element is used to indicate that the user plane security policy of the first QoS flow is the second user plane security policy. The other relevant information of the first QoS may be an authorized QoS flow description (Authorized QoS flow descriptions), and the authorized QoS flow description may be carried in a "PDU SESSION ESTABLISHMENT ACCEPT" message sent by the session management function network element to the terminal device, or a "PDU SESSION MODIFICATION COMMAND" message sent by the session management function network element to the terminal device.

[0280] In another possible implementation, the session management function network element creates a first QoS flow, then assigns the first QoS flow to the service data flow, and determines the quality of service of the first QoS flow based on the quality of service requirement of the service data flow. The user plane security policy of the first QoS flow is the second user plane security policy. The specific method is as follows:

[0281] Step D1: The session management function network element creates a first QoS flow.

[0282] In step D2, the session management function network element determines the QoS parameters of the first QoS flow based on the QoS requirements of the service data flow. The QoS parameters include, but are not limited to, guaranteed flow bit rate (GFBR), maximum flow bit rate (MFBR), notification control, reflective QoS attribute (RQA), and maximum packet loss rate (up link and down link). By determining the QoS parameters of the first QoS flow, the quality of service of the first QoS flow meets the QoS requirements of the service data flow.

[0283] In step D3, the session management function network element indicates to the access network device that the user plane security policy for the first QoS flow is the second user plane security policy. The session management function network element sends the second user plane security policy and the QoS flow identifier of the first QoS flow to the access network device. Alternatively, the session management function network element sends first indication information to the access network device, where the first indication information is used to indicate that the user plane security policy for the first QoS flow is the second user plane security policy. The specific method is similar to that described in the previous embodiment and is not further described here.

[0284] Step D4: The session management function network element notifies the terminal device through the access network device that the first QoS flow is used to carry the service data flow.

[0285] The session management function network element sends the second user plane security policy, the QoS flow identifier of the first QoS flow, and the quality of service parameters of the first QoS flow to the access network device. By sending the quality of service parameters of the first QoS flow to the access network device, the session management function network element ensures that the quality of service requirements of the service data flow are met when the service data flow is carried in the first QoS flow for transmission. The second user plane security policy is carried by the newly created first QoS flow, and the first QoS flow is then assigned to the service data flow. This avoids the problem of the first QoS flow carrying service data flows with different user plane security policies, which may cause the user plane security policy of the first QoS flow to be inconsistent with the security requirements of the service data flow.

[0286] In another possible implementation, the session management function network element determines, from one or more QoS flows in a session, a QoS flow that meets a first condition as a first QoS flow. The first condition includes: the quality of service parameters of the QoS flow match the quality of service requirements of the service data flow, and the user plane security policy corresponding to the service data flow carried by the QoS flow is consistent with the second user plane security policy. The session management function network element then assigns the first QoS flow to the service data flow. The specific method is as follows:

[0287] Step F1, the session management function network element determines the first QoS flow from one or more QoS flows in the session, the service quality of the first QoS flow meets the service quality requirements of the service data flow, and the user plane security policy corresponding to the service data flow carried by the first QoS flow is consistent with the second user plane security policy.

[0288] Step F2: The session management function network element indicates to the access network device that the user plane security policy of the first QoS flow is the second user plane security policy. The specific method is similar to that described in the above embodiment and will not be described in detail here.

[0289] Step F3: The session management function network element notifies the terminal device through the access network device that the first QoS flow is used to carry the service data flow.

[0290] By determining a first QoS flow from one or more QoS flows in a session, the quality of service of the first QoS flow meets the quality of service requirements of the service data flow, and the user plane security policy of the first QoS flow is the second user plane security policy. This avoids the problem of the user plane security policy of the first QoS flow being inconsistent with the security requirements of the service data flow due to the service data flow using different user plane security policies carried by the first QoS flow.

[0291] S7. The access network device receives the second user plane security policy and the QoS flow identifier of the first QoS flow from the session management function network element, and determines the first DRB corresponding to the first QoS flow in the session and the user plane security activation status of the first DRB based on the second user plane security policy and the QoS flow identifier of the first QoS flow.

[0292] For example, after receiving the QoS flow identifier and the second user plane security policy of the first QoS flow from the session management function network element, the access network device determines, based on the QoS flow identifier and the second user plane security policy of the first QoS flow, that the user plane security policy of the first QoS flow is the second user plane security policy. Based on the explicit instruction from the session management function network element, the access network device can directly and accurately determine that the user plane security policy of the first QoS flow is the second user plane security policy.

[0293] In another example, an access network device receives first indication information from a session management function network element, indicating that the user plane security policy for a first QoS flow is the second user plane security policy. The access network device then determines, based on the first indication information, that the user plane security policy for the first QoS flow is the second user plane security policy. In this way, the access network device locally determines that the user plane security policy for the first QoS flow is the second user plane security policy based on the indication from the session management function network element, without requiring the session management function network element to send the specific content of the second user plane security policy, thereby reducing signaling overhead.

[0294] Optionally, the access network device determines that the user plane security policy of the first QoS flow is the second user plane security policy based on the local configuration policy and the first indication information. The configuration policy is similar to the configuration policy illustrated in Tables 2 to 5 above and will not be described here. The configuration policy of the access network device includes: the correspondence between the first QoS flow and the second user plane security policy. Alternatively, the configuration policy of the access network device includes: the correspondence between the characteristic information of the service data flow and the second user plane security policy. Then, the access network device determines that the user plane security policy of the first QoS flow is the second user plane security policy based on the configuration policy of the access network device and the first indication information.

[0295] Regarding the instructions of the session management function network element, please refer to the content described in step S6, which will not be repeated here.

[0296] Secondly, it introduces how the access network device determines the first DRB corresponding to the first QoS flow in the session and the user plane security activation status of the first DRB based on the second user plane security policy and the QoS flow identifier of the first QoS flow. The first DRB adopts the second user plane security policy.

[0297] In one possible implementation, the access network device determines that the first QoS flow is newly created based on the QoS flow identifier of the first QoS flow; the access network device creates a first DRB and determines the user plane security activation status of the first DRB based on the second user plane security policy; or, determines from one or more DRBs of the session that the DRB that meets the second condition is the first DRB, and the second condition includes: the user plane security activation status of the DRB is determined based on the second user plane security policy.

[0298] After the access network device receives the QoS flow identifier of the first QoS flow from the session management function network element, it determines that the first QoS flow is a newly created QoS flow based on the QoS flow identifier of the first QoS flow. For example, the access network device locally stores the correspondence between the PDU session, QoS flow and DRB, and the correspondence can be "PDU session identifier-QoS flow identifier of the QoS flow-DRB identifier". After the access network device receives the QoS flow identifier of the first QoS flow from the session management function network element, it detects whether there is a corresponding QoS flow identifier in the local correspondence of the access network device. If the access network device determines that the QoS flow identifier of the first QoS flow does not exist in the local correspondence, the access network device determines that the first QoS flow is a newly created QoS flow. After the access network device determines that the first QoS flow is a newly created QoS flow, the access network device creates a first DRB and determines the user plane security activation status of the first DRB based on the second user plane security policy.

[0299] For example, the second user plane security policy is: the first QoS flow requires user plane integrity protection, and the first QoS flow requires user plane encryption protection. The access network device determines the user plane security activation status of the first DRB according to the second user plane security policy as: the user plane integrity protection of the first DRB is activated (or the user plane integrity protection of the first DRB is turned on), and the user plane encryption protection of the first DRB is activated (or the user plane encryption protection of the first DRB is turned on).

[0300] For another example, the second user plane security policy is: recommend user plane integrity protection for the first QoS flow, and recommend user plane encryption protection for the first QoS flow. The access network device determines the user plane security activation state of the first DRB based on the second user plane security policy and a local policy of the access network device. According to the local policy of the access network device, the user plane security activation status of the first DRB may be: the user plane integrity protection of the first DRB is activated (or the user plane integrity protection of the first DRB is turned on) and the user plane encryption protection of the first DRB is activated (or the user plane encryption protection of the first DRB is turned on); the user plane security activation status of the first DRB may also be: the user plane integrity protection of the first DRB is not activated (or the user plane integrity protection of the first DRB is turned off) and the user plane encryption protection of the first DRB is not activated (or the user plane encryption protection of the first DRB is turned off); the user plane security activation status of the first DRB may also be: the user plane integrity protection of the first DRB is not activated (or the user plane integrity protection of the first DRB is turned off) and the user plane encryption protection of the first DRB is activated (or the user plane encryption protection of the first DRB is turned on; the user plane security activation status of the first DRB may also be: the user plane integrity protection of the first DRB is activated (or the user plane integrity protection of the first DRB is turned on) and the user plane encryption protection of the first DRB is not activated (or the user plane encryption protection of the first DRB is turned off).

[0301] For another example, the second user plane security policy is: the first QoS flow does not require user plane integrity protection, and the first QoS flow does not require user plane encryption protection. The access network device determines the user plane security activation status of the first DRB according to the second user plane security policy as: the user plane integrity protection of the first DRB is not activated (or the user plane integrity protection of the first DRB is turned off), and the user plane encryption protection of the first DRB is not activated (or the user plane encryption protection of the first DRB is turned off).

[0302] Alternatively, the access network device determines a DRB that meets the second condition from one or more DRBs of the session as the first DRB, and the one or more DRBs of the session are created DRBs. The second condition includes: the user plane security activation status of the DRB is determined according to the second user plane security policy. In other words, the access network device determines the first DRB from one or more DRBs of the session that adopt the second user plane security policy. The access network device then allocates the first DRB to the first QoS flow to ensure that the first DRB that adopts the second user plane security policy can carry the service data of the first QoS flow.

[0303] In one possible implementation, the access network device determines, based on the QoS flow identifier of the first QoS flow, that the following conditions are met for the first QoS flow: 1) the first QoS flow has been created before receiving the second user plane security policy and the QoS flow identifier of the first QoS flow from the session management function network element, 2) the first QoS flow corresponds to the second DRB, and the number of QoS flows corresponding to the second DRB is greater than 1;

[0304] The access network device creates a first DRB and determines the user plane security activation status of the first DRB based on the second user plane security policy; or, determines the DRB that meets the second condition from one or more DRBs of the session as the first DRB, and the second condition includes: the user plane security activation status of the DRB is determined based on the second user plane security policy.

[0305] After the access network device receives the QoS flow identifier of the first QoS flow from the session management function network element, it determines that the first QoS flow meets the following conditions based on the QoS flow identifier of the first QoS flow: 1) The first QoS flow is an already created QoS flow, and the first QoS flow has been created before the access network device receives the second user plane security policy and the QoS flow identifier of the first QoS flow from the session management function network element. 2) The first QoS flow has been allocated a second DRB, and the number of QoS flows corresponding to the second DRB is greater than 1. In other words, in addition to corresponding to the first QoS flow, the second DRB also corresponds to other QoS flows. Then the access network device creates a first DRB, or the access network device determines the first DRB from one or more DRBs that adopt the second user plane security policy for the session. Then the access network device allocates the first DRB to the first QoS flow to ensure that the first DRB using the second user plane security policy can carry the service data of the first QoS flow.

[0306] In one possible implementation, the access network device determines that the following conditions are met based on the QoS flow identifier of the first QoS flow: 1) the first QoS flow is created before receiving the second user plane security policy and the QoS flow identifier of the first QoS flow from the session management function network element, 2) the first QoS flow corresponds to the first DRB, and the number of QoS flows corresponding to the first DRB is equal to 1; the access network device updates the user plane security activation status of the first DRB according to the second user plane security policy.

[0307] After the access network device receives the QoS flow identifier of the first QoS flow from the session management function network element, it determines that the first QoS flow meets the following conditions based on the QoS flow identifier of the first QoS flow: 1) The first QoS flow is an already created QoS flow, and the first QoS flow has been created before the access network device receives the second user plane security policy and the QoS flow identifier of the first QoS flow from the session management function network element. 2) The first QoS flow has been allocated a first DRB, and the number of QoS flows corresponding to the first DRB is 1. In other words, the first DRB only corresponds to the first QoS flow. The access network device then updates the user plane security activation status of the first DRB according to the second user plane security policy. In other words, the access network device modifies the user plane security policy of the first DRB. After modification, the user plane security policy of the first DRB is the second user plane security policy, to ensure that the first DRB with the second user plane security policy can carry the service data of the first QoS flow.

[0308] Through the above method, the access network device allocates a first DRB to the first QoS flow according to the instruction of the session management function network element, and the first DRB adopts the second user plane security policy. This ensures that after the user plane security policy of the QoS flow is modified, the DRB with the corresponding security policy can be used to carry traffic of the QoS flow.

[0309] S8. The access network device sends user plane security indication information corresponding to the first DRB to the terminal device.

[0310] Step S8 is an optional step. After receiving the instruction from the session management function network element, the access network device sends user plane security indication information corresponding to the first DRB to the terminal device. The user plane security indication information is used to indicate whether to activate user plane security protection for the first DRB. The user plane security indication information is determined based on the second user plane security protection policy.

[0311] Exemplarily, the second user plane security policy is: the first QoS flow requires user plane integrity protection, and / or, the first QoS flow requires user plane encryption protection. The user plane security indication information corresponding to the first DRB includes: an indication to activate user plane integrity protection of the first DRB, and / or, an indication to activate user plane encryption protection of the first DRB.

[0312] For another example, the second user plane security policy is: the first QoS flow recommends user plane integrity protection, and / or, the first QoS flow recommends user plane encryption protection. The access network device determines the user plane security activation status of the first DRB based on the second user plane security policy and the local policy of the access network device. Further, the access network device determines the user plane security indication information corresponding to the first DRB based on the user plane security activation status of the first DRB. The user plane security indication information corresponding to the first DRB may be: indicating the activation of the user plane integrity protection of the first DRB and / or indicating the activation of the user plane encryption protection of the first DRB; the user plane security indication information corresponding to the first DRB may also be: indicating the deactivation of the user plane integrity protection of the first DRB and / or indicating the deactivation of the user plane encryption protection of the first DRB; the user plane security indication information corresponding to the first DRB may also be: indicating the deactivation of the user plane integrity protection of the first DRB and / or indicating the activation of the user plane encryption protection of the first DRB; the user plane security indication information corresponding to the first DRB may also be: indicating the activation of the user plane integrity protection of the first DRB and / or indicating the deactivation of the user plane encryption protection of the first DRB.

[0313] For another example, the second user plane security policy is: the first QoS flow does not require user plane integrity protection, and / or the first QoS flow does not require user plane encryption protection. The user plane security indication information corresponding to the first DRB may also be: indicating that the user plane integrity protection of the first DRB is not activated and / or indicating that the user plane encryption protection of the first DRB is not activated.

[0314] In a possible implementation, the user plane security indication information corresponding to the first DRB may be carried in a radio resource control (RRC) reconfiguration message. The RRC reconfiguration message includes the DRB and its corresponding user plane security indication information.

[0315] In an embodiment of the present application, after the session management function network element obtains the characteristic information of the service data flow of the terminal device, it determines the second user plane security policy corresponding to the service data flow based on the characteristic information of the service data flow. In the case that the second user plane security policy is inconsistent with the first user plane security policy corresponding to the session, the session management function network element instructs the access network device to perform user plane security protection on the first QoS flow according to the second user plane security policy, and the first QoS flow carries the service data flow. By adopting the method provided in the above embodiment, differentiated user plane security protection is implemented for the service data carried by the session, the user plane security protection performance is improved, and the security requirements of different services are met. In addition, when the user plane security policy of the session is different from the user plane security policy of the QoS flow, the SMF can also instruct each network function or terminal device to modify the user plane security policy of the QoS flow to ensure that the core network, access network and terminal use the same user plane security policy for the same QoS flow.

[0316] In combination with the foregoing embodiments, the embodiments of the present application also propose other implementation schemes. In another example, the subscription data also includes the user plane security policy corresponding to the data network accessed by the terminal device. Or, in another example, the subscription data includes the user plane security policy corresponding to the slice providing communication services for the terminal device. Exemplarily, the terminal device sends a session establishment request message to the session management function network element, carrying the identifier of the data network requested by the terminal device, or the identifier of the slice requested by the terminal device. The terminal device requests access to the data network through the session establishment request message, or the terminal device requests the slice to provide communication services for the terminal device through the session establishment request message. The session management function network element determines the data network accessed by the terminal device or the slice providing communication services for the terminal device based on the session establishment request message. Furthermore, the session management function network element determines the user plane security policy of the terminal device in the data network or the user plane security policy of the terminal device in the slice based on the subscription data. The session management function network element uses the user plane security policy to perform corresponding user plane security protection for the QoS flows corresponding to all service data flows in the terminal device.

[0317] Alternatively, in another example, the subscription data includes a user plane security policy corresponding to the terminal device level. Exemplarily, the terminal device level refers to the user plane security protection level of the terminal device, and the terminal device levels include: level 1, level 2, level 3, and so on. Each terminal device level corresponds to a user plane security policy. As the terminal device level of the terminal device changes, the user plane security policy of all service data flows of the terminal device also needs to change. For example, if the terminal device level is level 1, the corresponding user plane security policy includes: user plane encryption protection is not required and user plane integrity protection is not required; if the terminal device level is level 2, the corresponding user plane security policy includes: user plane encryption protection is recommended and user plane integrity protection is recommended; if the terminal device level is level 3, the corresponding user plane security policy includes: user plane encryption protection is required and user plane integrity protection is required. When the terminal device level changes, the unified data management network element sends the subscription data corresponding to the terminal device to the session management function network element and notifies the session management function network element that the terminal device of the terminal device has changed, for example, the terminal device level of the terminal device changes from level 1 to level 2. Based on the notification from the unified data management function network element, the session management function network element determines that the terminal device's level has changed from level 1 to level 2. Based on the terminal device's level, the session management function network element determines the user plane security policy corresponding to level 2 for the terminal device from the terminal device's subscription data from the unified data management network element. The session management function network element then instructs the access network device to perform user plane security protection for the QoS flows corresponding to all service data flows in the terminal device according to the user plane security policy corresponding to level 2.

[0318] Alternatively, in another example, the subscription data includes a user plane security policy corresponding to the service level. Exemplarily, the service level refers to the user plane security protection level of the service, which includes Level 1, Level 2, and Level 3. Each service level corresponds to a user plane security policy. As the service level of a service in a terminal device changes, the user plane security policy of the service data flow corresponding to that service also needs to change. For example, if the service level is Level 1, the corresponding user plane security policy includes: user plane encryption protection not required and user plane integrity protection not required; if the service level is Level 2, the corresponding user plane security policy includes: user plane encryption protection recommended and user plane integrity protection recommended; if the service level is Level 3, the corresponding user plane security policy includes: user plane encryption protection required and user plane integrity protection required. When the service level changes, the unified data management network element sends the subscription data corresponding to the terminal device to the session management function network element, which notifies the session management function network element of the change in the service level of the terminal device's service. Based on the notification from the unified data management network element, the session management function network element determines that the service level of the service in the terminal device has changed. For example, the service level of service #1 in the terminal device changes from Level 1 to Level 2. The session management function network element determines the user plane security policy corresponding to service level 2 from the terminal device's subscription data from the unified data management network element. The session management function network element then instructs the access network device to perform user plane security protection on the QoS flows of all service data flows corresponding to service #1 in the terminal device according to the user plane security policy corresponding to level 2.

[0319] In combination with the above embodiments, the present application also proposes other implementation schemes. For ease of understanding, please refer to Figure 6, which is a flow chart of another embodiment of a communication method proposed in the present application. A communication method proposed in the present application includes:

[0320] G1. The session management function network element obtains the current network status.

[0321] In step G1, the session management function (SMF) obtains notification information from any one or more of the following network functions or devices, including but not limited to: an access and mobility management function (AMF), an access network device (RAN), a policy control function (PCF), a network manager (managing these network functions), or a terminal device. The SMF then determines the current network status based on the notification information.

[0322] The network status includes, but is not limited to: the network returning to normal, or the network experiencing an abnormality. Furthermore, the network status is the network security capability, which includes: the network security capability improving or the network security capability decreasing.

[0323] The network returning to normal includes, but is not limited to: network congestion returning to normal, network service resources being improved, and / or network functions returning to normal. For example, the network service resources may be security protection functions provided by the network, and the improvement of network service resources may be the addition of network functions related to security protection functions. The network function returning to normal may be the return of network functions related to security protection functions from an abnormal state to a normal state.

[0324] Network anomalies include, but are not limited to, network congestion, natural disasters in the area where the network is deployed, a reduction in network service resources, and / or network function failures. For example, a reduction in network service resources may be caused by the network shutting down certain network functions related to security protection functions, or by the network function related to security protection functions going offline. A network function failure may be caused by a network function related to security protection functions going from a normal state to a faulty state.

[0325] G2. The session management function network element determines a second user plane security policy corresponding to the network state according to the network state.

[0326] In step G2, one possible implementation is for the session management function network element to determine an improvement in network security capabilities based on the network state. In response to the improvement in network security capabilities, the session management function network element determines a second user plane security policy. The second user plane security policy has a higher security protection capability than the first user plane security policy, which was the user plane security policy used by the QoS flow before the network state changed. For example, if a new network function related to security protection is deployed on the network, the network security capabilities are improved. Then, in response to the improvement in network security capabilities, the session management function network element determines a corresponding second user plane security policy based on the network state.

[0327] Another possible implementation is for the session management function network element to determine, based on the network state, that network security capabilities have decreased. In response to the decreased network security capabilities, the session management function network element determines a second user plane security policy. The security protection capability of the second user plane security policy is lower than that of the first user plane security policy, which was the user plane security policy used by the QoS flow before the network state changed. For example, if some network functions related to security protection functions are offline in the network, the network security capabilities have decreased. Then, in response to the decreased network security capabilities, the session management function network element determines a corresponding second user plane security policy based on the network state.

[0328] Furthermore, the session management function network element determines the second user plane security policy corresponding to the network state according to the network state, including multiple implementation methods. Specifically as follows:

[0329] (1) The subscription data includes a correspondence between the network state and the user plane security policy. The session management function network element determines, based on the network state, from the subscription data, the user plane security policy corresponding to the network state as the second user plane security policy.

[0330] (2) The PCC rule includes a correspondence between the network state and the user plane security policy. The session management function network element determines, based on the network state, from the PCC rule, the user plane security policy corresponding to the network state as the second user plane security policy.

[0331] (3) The local configuration policy includes a correspondence between the network state and the user plane security policy. The session management function network element determines, based on the network state, from the local configuration policy, the user plane security policy corresponding to the network state as the second user plane security policy.

[0332] The following description will be made by taking an example where a session management function network element determines a user plane security policy corresponding to a network state from a local configuration policy.

[0333] In one example, the local configuration policy includes a correspondence between network security capabilities and user plane security policies, for example: network security capability X1 corresponds to user plane security policy Y1; network security capability X2 corresponds to user plane security policy Y2; and network security capability X3 corresponds to user plane security policy Y3. The notification information indicates the network security capability, and the session management function network element determines the user plane security policy corresponding to the current network security capability based on the network security capability indicated by the notification information and the configuration policy. Furthermore, the session management function network element uses the user plane security policy corresponding to the current network security capability to perform user plane integrity protection and / or user plane encryption protection on the QoS flow. For example, when the notification information indicates that the network security capability is X1, the QoS flow uses user plane security policy Y1; when the notification information indicates that the network security capability is X2, the QoS flow uses user plane security policy Y2; and when the notification information indicates that the network security capability is X3, the QoS flow uses user plane security policy Y3.

[0334] In another example, after a network function or device in the network perceives a change in network security capabilities, it sends a notification message to the session management function network element, notifying the session management function network element of the change in current network security capabilities and the need to adjust the user plane security policy of the QoS flow. The notification message indicates the extent to which the user plane security policy of the first QoS flow needs to be changed. For example, the PCF perceives that the current network security capability changes from X1 to X2, and the PCF sends a notification message to the session management function network element, indicating that the user plane security policy of the first QoS flow needs to be changed from user plane security policy Y1 to user plane security policy Y2. For another example, the PCF perceives that the current network security capability changes from X1 to X2, and the PCF sends a notification message to the session management function network element, indicating that the user plane security policy of the first QoS flow is user plane security policy Y2.

[0335] For example, the level of network security capability X1 is higher than the level of network security capability X2, the level of network security capability X2 is higher than the level of network security capability X3, the security of user plane security policy Y1 is higher than the security of user plane security policy Y2, and the security of user plane security policy Y2 is higher than the security of user plane security policy Y3. For example, user plane security policy Y1 requires user plane integrity protection and user plane encryption protection for QoS flows, user plane security policy Y2 recommends user plane integrity protection and user plane encryption protection for QoS flows, and user plane security policy Y3 does not require user plane integrity protection and user plane encryption protection for QoS flows.

[0336] G3. If the second user plane security policy is inconsistent with the first user plane security policy, the session management function network element instructs the access network device to perform user plane security protection on the first QoS flow according to the second user plane security policy, and the first QoS flow carries the service data flow.

[0337] G4. The access network device receives the second user plane security policy and the QoS flow identifier of the first QoS flow from the session management function network element, and determines the first DRB corresponding to the first QoS flow in the session and the user plane security activation status of the first DRB based on the second user plane security policy and the QoS flow identifier of the first QoS flow.

[0338] G5. The access network device notifies the terminal device that the user plane security policy of the first DRB is the second user plane security policy.

[0339] Steps G3 to G5 are similar to steps S6 to S8 in the aforementioned embodiment and are not described in detail here.

[0340] In an embodiment of the present application, after the session management function network element obtains the network status, it determines the second user plane security policy corresponding to the network status. In the case where the second user plane security policy is inconsistent with the user plane security policy of the session in which the terminal device carries the service data flow, the session management function network element instructs the access network device to perform user plane security protection on the first QoS flow according to the second user plane security policy, and the first QoS flow carries the service data flow. By adopting the method provided in the above embodiment, differentiated user plane security protection is implemented for the service data carried by the session, and differentiated user plane security policies are adopted to perform user plane security protection on the service data flow corresponding to the service data, thereby improving the user plane security protection performance and meeting the security requirements of different services. In addition, when the user plane security policy of the session is different from the user plane security policy of the QoS flow, the SMF can also instruct each network function or terminal device to modify the user plane security policy of the QoS flow to ensure that the core network, access network and terminal adopt the same user plane security policy for the same QoS flow.

[0341] In combination with the above embodiments, the present application also proposes other implementation schemes. For ease of understanding, please refer to Figure 7, which is a flow chart of another embodiment of a communication method proposed in the present application. A communication method proposed in the present application includes:

[0342] H1. The UE sends a session establishment request to the AMF. The session establishment request is used to request establishment of a first session. The session establishment request includes a first session identifier and a second session identifier.

[0343] In step H1, the UE sends a session establishment request to the AMF, where the session establishment request is used to request establishment of a first session. The session establishment request includes a first session identifier and a second session identifier, where the first session identifier and the second session identifier are inconsistent. The first session corresponds to the first session identifier.

[0344] Optionally, when the UE supports MPQUIC capability, the session establishment request sent by the UE to the AMF includes a first session identifier and a second session identifier.

[0345] Exemplarily, the session establishment request is a "PDU Session Establishment Request" message.

[0346] H2. SMF selects and sends a session management context create / update request.

[0347] In step H2, the AMF triggers the selection of an appropriate SMF in response to the session establishment request. The AMF then sends a session management context create / update request to the selected SMF, requesting the establishment of the first session (corresponding to the first session identifier) ​​and the second session (corresponding to the second session identifier). That is, the AMF sends an "Nsmf_PDUSession_CreateSMContext Request" message to the SMF.

[0348] H3. Get session management subscription data from UDM and check the legitimacy of the request.

[0349] Step H3 is optional. In step H3, the SMF obtains session management subscription data from the UDM. This session management subscription data includes subscription retrieval and subscription updates information. By querying this session management subscription data, the SMF determines whether an MA PDU session can be created. (For example, if the first session is an MA PDU session, the SMF determines whether the first session can be created based on the query result.)

[0350] The SMF is also used to query the SMF subscription data and PCC rules, and determine whether an MA PDU session can be established based on the query results. The subscription data includes the relevant data of the UE, and the relevant data of the UE in the subscription data can also be called the UE subscription data.

[0351] H4 and SMF obtain the PCC rules and generate ASSSS rules and / or N4 rules based on the PCC rules, and distribute the ASSSS rules and / or N4 rules to the RAN, UE, and UPF. After receiving the PCC rules, the SMF derives (a) the ASSSS rules from the received PCC rules. These rules will be sent to the UE to control service layering, switching, and splitting in the uplink direction; and (b) the N4 rules. These N4 rules will be sent to the UPF to control service layering, switching, and splitting in the downlink direction. After the SMF derives the N4 rule (ruler) for the session (MA PDU session), it sends the N4 rule to the UPF.

[0352] Step H4 is an optional step.

[0353] H5 and SMF obtain the user plane security policy of the QoS flow.

[0354] In step H5, the SMF determines the QoS flow corresponding to the session establishment request based on the session establishment request. The SMF then determines the user plane security policy for the QoS flow. For example, the SMF determines that the user plane security policy for the first QoS flow is the first user plane security policy. In another example, the SMF determines that the PDU session corresponding to the session establishment request includes multiple QoS flows, and the user plane security policies for the multiple QoS flows are the first user plane security policy and the second user plane security policy, and the second user plane security policy is inconsistent with the first user plane security policy.

[0355] How the SMF determines the user plane security policy for the first QoS flow is similar to the aforementioned steps S4 to S5, or similar to the aforementioned steps G1 to G2, and will not be elaborated here.

[0356] In step H5, if it is determined that multiple QoS flows adopt the first user plane security policy and the second user plane security policy, then step H6 is entered, and the SMF creates a first session and a second session. The first session carries the QoS flow that adopts the first user plane security policy, and the first session adopts the first user plane security policy. The QoS flow that adopts the second user plane security policy is carried on the second session, and the second session adopts the second user plane security policy. Or the first session carries the QoS flow that adopts the second user plane security policy, and the first session adopts the second user plane security policy. The QoS flow that adopts the second user plane security policy is carried on the first session, and the second session adopts the first user plane security policy. If it is determined that the user plane security policies of multiple QoS flows are all the first user plane security policy, the SMF only needs to create the first session, and the first session carries the QoS flow.

[0357] H6. SMF creates the first session and the second session. The first session corresponds to the first session identifier, and the second session corresponds to the second session identifier. The first session carries the QoS flow using the first user plane security policy, and the user plane security policy of the first session is the first user plane security policy.

[0358] In step H6, if the first session is an MA PDU session, the SMF creates the first session and the second session in response to the session establishment request in step H1. The first session corresponds to the first session identifier, and the second session corresponds to the second session identifier. The first session uses the first user plane security policy, and the second session uses the second user plane security policy. The first session carries the QoS flow that uses the first user plane security policy.

[0359] Exemplarily, the first session carries MPQUIC packets, and the second session carries MPTCP packets and ASSSS packets.

[0360] In another example, the first session carries the application data stream of the XR / VR service, and the second session carries the application data stream of the video application.

[0361] H7. Send the session and the user plane security policy of the session.

[0362] In step H7, the SMF sends the first session and the first user plane security policy used by the first session, and the second session and the second user plane security policy used by the second session to the RAN and UPF respectively.

[0363] In one possible implementation, the SMF may send messages in the following manner: for example, message #1 includes a first session identifier and a first user plane security policy used by the first session; and message #2 includes a second session identifier and a second user plane security policy used by the second session. Accordingly, the RAN receives message #1 and message #2, and the UPF receives message #1 and message #2.

[0364] In another possible implementation, the SMF may send the following message: for example, message #1 includes the first session identifier and the first user plane security policy used by the first session, and the second session identifier and the second user plane security policy used by the second session. Accordingly, the RAN receives message #1, and the UPF receives message #1.

[0365] H8. RAN allocates DRBs for QoS flows in the session based on the session and the security policy adopted by the session.

[0366] In step H8, the RAN responds to step H7, and the RAN allocates a DRB for the QoS flow in the first session, and the DRB uses the first user plane security policy; the RAN allocates a DRB for the QoS flow in the second session, and the DRB uses the second user plane security policy.

[0367] H9. RAN sends the session and the security policy used for the session to the UE.

[0368] In step H9, the RAN sends the first session and the first user plane security policy used by the first session, and the second session and the second user plane security policy used by the second session to the UE.

[0369] In one possible implementation, the RAN may send the following message: for example, message #1 includes a first session identifier and a first user plane security policy used by the first session; and message #2 includes a second session identifier and a second user plane security policy used by the second session. Accordingly, the UE receives message #1 and message #2.

[0370] In another possible implementation, the RAN may send the message in the following manner: for example, message #1 includes the first session identifier and the first user plane security policy used by the first session, and the second session identifier and the second user plane security policy used by the second session. Accordingly, the UE receives the message #1.

[0371] It is understandable that the RAN may also implement user plane security activation in other ways, such as sending a corresponding user plane security policy to the UE for the DRB corresponding to the session.

[0372] H10. The UE executes the security policy of the PDU session.

[0373] In step H10, the UE executes the first user plane security policy for the first session and executes the second user plane security policy for the second session.

[0374] In this embodiment of the present application, after determining that the user plane security policy corresponding to the QoS flow is the first user plane security policy, the SMF establishes two PDU sessions, each of which carries the traffic corresponding to the first user plane security policy and the other traffic. The PDU session carrying the traffic corresponding to the first user plane security policy adopts the first user plane security policy for user plane security protection. This implements a user plane security policy that controls the granularity of the QoS flow.

[0375] In combination with the above embodiments, the following introduces various application scenarios proposed in the embodiments of the present application, including:

[0376] 1. The terminal device triggers a session modification request, and the SMF modifies the user plane security policy corresponding to the QoS flow.

[0377] For example, please refer to Figure 8, which is a schematic diagram of an application scenario in an embodiment of the present application. An application scenario proposed in an embodiment of the present application includes:

[0378] J1. The UE sends a session modification request, which carries characteristic information of the service data flow.

[0379] In step J1, the UE sends a session modification request to the SMF, which carries the characteristic information of the service data flow. Please refer to the above step S4 for details, which will not be repeated here.

[0380] J2. The session management function network element determines the second user plane security policy corresponding to the service data flow based on the characteristic information of the service data flow.

[0381] J3. If the second user plane security policy is inconsistent with the first user plane security policy, the session management function network element instructs the access network device to perform user plane security protection on the first QoS flow according to the second user plane security policy, and the first QoS flow carries the service data flow.

[0382] J4. The access network device receives the second user plane security policy and the QoS flow identifier of the first QoS flow from the session management function network element, and determines the first DRB corresponding to the first QoS flow in the session and the user plane security activation status of the first DRB based on the second user plane security policy and the QoS flow identifier of the first QoS flow.

[0383] J5. The access network device notifies the terminal device that the user plane security policy of the first DRB is the second user plane security policy.

[0384] Steps J2 to J5 are similar to the aforementioned steps S5 to S8 and are not described in detail here.

[0385] 2. PCF triggers a session modification request, and SMF modifies the user plane security policy corresponding to the QoS flow.

[0386] For example, please refer to Figure 9, which is a schematic diagram of an application scenario in an embodiment of the present application. An application scenario proposed in an embodiment of the present application includes:

[0387] K1, PCF session management policy association modification process, in which PCF sends characteristic information of business data flow to SMF.

[0388] In step K1, during the PCF-initated SM Policy Association Modification process, the SMF obtains characteristic information of the service data flow sent by the PCF. Alternatively, the PCF sends the characteristic information of the service data flow to the SMF. Optionally, the PCF-initated SM Policy Association Modification process can be triggered by the AF. For details, refer to step S4 above and are not further described here.

[0389] K2. The session management function network element determines the second user plane security policy corresponding to the service data flow based on the characteristic information of the service data flow.

[0390] K3. If the second user plane security policy is inconsistent with the first user plane security policy, the session management function network element instructs the access network device to perform user plane security protection on the first QoS flow according to the second user plane security policy, and the first QoS flow carries the service data flow.

[0391] K4. The access network device receives the second user plane security policy and the QoS flow identifier of the first QoS flow from the session management function network element, and determines the first DRB corresponding to the first QoS flow in the session and the user plane security activation status of the first DRB based on the second user plane security policy and the QoS flow identifier of the first QoS flow.

[0392] K5. The access network device notifies the terminal device that the user plane security policy of the first DRB is the second user plane security policy.

[0393] Steps K2 to K5 are similar to the aforementioned steps S5 to S8 and are not described in detail here.

[0394] 3. UDM triggers a session modification request, and SMF modifies the user plane security policy corresponding to the QoS flow.

[0395] For example, please refer to Figure 10, which is a schematic diagram of an application scenario in an embodiment of the present application. An application scenario proposed in an embodiment of the present application includes:

[0396] Option (1):

[0397] L1-1. Send subscription data, including characteristic information of the business data flow.

[0398] In step L1-1, the subscription data changes, and the UDM sends the subscription data to the SMF, where the subscription data includes characteristic information of the service data flow. Exemplarily, the subscription data includes relevant data of the UE, and the relevant data of the UE includes characteristic information of the service data flow of the UE. After the relevant data of the terminal device included in the subscription data changes, the UDM sends the updated subscription data to the session management function network element. Alternatively, the session management function network element actively obtains the subscription data from the UDM, for example, the session management function network element periodically sends the identification information of the UE to the UDM, and in response to the identification information of the UE, the UDM sends the subscription data to the session management function network element.

[0399] Please refer to the aforementioned step S4 for details, which will not be described here in detail.

[0400] L2-1. The session management function network element determines a second user plane security policy corresponding to the service data flow according to the characteristic information of the service data flow.

[0401] Please refer to the aforementioned step S5 for details, which will not be described in detail here. After step L2-1, step L3 is executed.

[0402] Option (2):

[0403] L1-2. Send subscription data, including user plane security policy.

[0404] When subscription data changes, UDM sends the subscription data to SMF, which includes the user plane security policy.

[0405] Please refer to the aforementioned step S4 for details, which will not be described here in detail.

[0406] L2-2. The session management function network element determines a second user plane security policy according to the user plane security policy included in the subscription data.

[0407] Please refer to the aforementioned step S5 for details, which will not be described in detail here. After step L2-2, step L3 is executed.

[0408] L3. If the second user plane security policy is inconsistent with the first user plane security policy, the session management function network element instructs the access network device to perform user plane security protection on the first QoS flow according to the second user plane security policy, and the first QoS flow carries the service data flow.

[0409] L4. The access network device receives the second user plane security policy and the QoS flow identifier of the first QoS flow from the session management function network element, and determines the first DRB corresponding to the first QoS flow in the session and the user plane security activation status of the first DRB based on the second user plane security policy and the QoS flow identifier of the first QoS flow.

[0410] L5. The access network device notifies the terminal device that the user plane security policy of the first DRB is the second user plane security policy.

[0411] Steps L3 to L5 are similar to the aforementioned steps S6 to S8 and are not described in detail here.

[0412] The present application is described above from the perspective of method, and other embodiments provided in the present application will be further described below.

[0413] Please refer to Figure 11, which is a schematic diagram of an implementation of the communication device provided in this application. The communication device 1100 includes a processing module 1101 and a transceiver module 1102. The communication device 1100 can implement the functions of the communication device (including the session management function network element and access network equipment, etc.) in the above-mentioned method embodiment, and thus can also achieve the beneficial effects of the above-mentioned method embodiment. In the embodiment of the present application, the communication device 1100 can be a session management function network element, or it can be an integrated circuit or component within the session management function network element, such as a chip. The following embodiments are described using the communication device 1100 as a session management function network element as an example.

[0414] In one possible example,

[0415] The transceiver module 1102 is configured to receive a session establishment request message from a terminal device, the session establishment request message being used to request the establishment of a session; the transceiver module 1102 is further configured to obtain, in response to the session establishment request message, a first user plane security policy corresponding to the session, the first user plane security policy being used to indicate whether to activate user plane security protection corresponding to the session; the transceiver module 1102 is further configured to send the first user plane security policy and an identifier indicating the session to an access network device; the transceiver module 1102 is further configured to obtain characteristic information of a service data flow of the terminal device, the service data flow being carried in the session and being used to Transmitting the business data of the terminal device; a processing module 1101 is used to determine the second user plane security policy corresponding to the business data flow based on the characteristic information of the business data flow, and the second user plane security policy is used to indicate whether to activate the user plane security protection corresponding to the business data flow; the transceiver module 1102 is also used to send the second user plane security policy and the QoS flow identifier of the first QoS flow to the access network device when the first user plane security policy is inconsistent with the second user plane security policy, and the QoS flow identifier of the first QoS flow is used to indicate the first QoS flow in the session for carrying the business data flow.

[0416] Optionally, the transceiver module 1102 is further configured to receive a session modification request message from the terminal device, where the session modification request message is used to request modification of the session, and the session modification request message includes characteristic information of the service data flow.

[0417] Optionally, the transceiver module 1102 is further configured to receive a message from a policy control function network element for requesting to update the policy information of the session, where the message for requesting to update the policy information of the session includes feature information of the service data flow.

[0418] Optionally, the transceiver module 1102 is further configured to receive subscription data of the terminal device from a unified data management network element, where the subscription data includes characteristic information of the service data flow.

[0419] Optionally, the processing module 1101 is further used to determine whether the service data flow is carried by the session; the transceiver module 1102 is further used to obtain the first user plane security policy when it is determined that the service data flow is carried by the session.

[0420] Optionally, the transceiver module 1102 is also used to send a message to the unified data management network element for requesting to obtain the subscription data of the terminal device; the transceiver module 1102 is also used to receive the subscription data of the terminal device from the unified data management network element, and the subscription data includes the correspondence between the characteristic information of the business data flow and the user plane security policy; the processing module 1101 is also used to determine the second user plane security policy corresponding to the characteristic information of the business data flow based on the subscription data.

[0421] Optionally, the transceiver module 1102 is also used to send a message to the unified data management network element for requesting a user plane security policy corresponding to the characteristic information of the service data flow; the transceiver module 1102 is also used to receive the second user plane security policy from the unified data management network element.

[0422] Optionally, the transceiver module 1102 is also used to receive policies and billing control rules from the policy control function network element, and the policies and billing control rules include the correspondence between the characteristic information of the service data flow and the user plane security policy; the processing module 1101 is also used to determine the second user plane security policy corresponding to the characteristic information of the service data flow based on the policies and billing control rules.

[0423] Optionally, the processing module 1101 is further configured to determine the second user plane security policy corresponding to the characteristic information of the service data flow according to a local configuration policy.

[0424] Optionally, the processing module 1101 is also used to create the first QoS flow and determine the service quality parameters of the first QoS flow based on the service quality requirements of the business data flow; the transceiver module 1102 is also used to send the second user plane security policy, the QoS flow identifier of the first QoS flow, and the service quality parameters of the first QoS flow to the access network device.

[0425] Optionally, the processing module 1101 is also used to determine a QoS flow that meets a first condition from one or more QoS flows in the session as the first QoS flow, wherein the first condition includes: the service quality parameters of the QoS flow match the service quality requirements of the business data flow, and the user plane security policy corresponding to the business data flow carried by the QoS flow is consistent with the second user plane security policy.

[0426] Optionally, the characteristic information of the service data flow includes indication information, and the indication information is used to indicate the application layer security activation status of the service data flow; when the indication information indicates that the service data flow has been encrypted at the application layer, and the first user plane security policy includes that user plane encryption needs to be activated, the second user plane security policy includes that user plane encryption does not need to be enabled; and / or, when the indication information indicates that the service data flow has been integrity protected at the application layer, and the first user plane security policy includes that user plane integrity protection needs to be activated, the second user plane security policy includes that user plane integrity protection does not need to be enabled.

[0427] Optionally, the characteristic information of the business data flow includes the protocol used by the terminal device to transmit the business data flow; when the protocol is the Fast User Datagram Protocol Internet Connection QUIC protocol or the Multipath QUIC protocol, and the first user plane security policy includes that user plane encryption needs to be enabled, the second user plane security policy includes that user plane encryption does not need to be enabled.

[0428] In another possible implementation, the transceiver module 1102 is further configured to, during the process of establishing a session of the terminal device, receive a first user plane security policy corresponding to the session and an identifier for indicating the session from the session management function network element, where the first user plane security policy is used to indicate whether to activate user plane security protection corresponding to the session; the processing module 1101 is further configured to determine whether to activate user plane security protection of a data radio bearer DRB belonging to the session according to the first user plane security policy;

[0429] The transceiver module 1102 is also used to receive a second user plane security policy and a QoS flow identifier of a first QoS flow from the session management function network element, wherein the second user plane security policy is used to indicate whether to activate the user plane security protection corresponding to the service data flow, and the QoS flow identifier of the first QoS flow is used to indicate the first QoS flow in the session for carrying the service data flow; the processing module 1101 is also used to determine the first DRB corresponding to the first QoS flow in the session and the user plane security activation status of the first DRB based on the second user plane security policy and the QoS flow identifier of the first QoS flow.

[0430] Optionally, processing module 1101 is further used to determine whether the first QoS flow is newly created based on the QoS flow identifier of the first QoS flow; processing module 1101 is further used to create the first DRB and determine the user plane security activation status of the first DRB based on the second user plane security policy; or, determine the DRB that meets the second condition from one or more DRBs of the session as the first DRB, and the second condition includes: the user plane security activation status of the DRB is determined based on the second user plane security policy.

[0431] Optionally, the processing module 1101 is further used to determine that the following conditions are met for the first QoS flow based on the QoS flow identifier of the first QoS flow: 1) the first QoS flow has been created before the second user plane security policy and the QoS flow identifier of the first QoS flow are received from the session management function network element; 2) the first QoS flow corresponds to a second DRB, and the number of QoS flows corresponding to the second DRB is greater than 1; the processing module 1101 is further used to create the first DRB and determine the user plane security activation status of the first DRB based on the second user plane security policy; or, the processing module 1101 is further used to determine that the DRB that meets the second condition from one or more DRBs of the session is the first DRB, and the second condition includes: the user plane security activation status of the DRB is determined based on the second user plane security policy.

[0432] Optionally, the processing module 1101 is further used to determine, based on the QoS flow identifier of the first QoS flow, that the following conditions are met: 1) the first QoS flow is created before the second user plane security policy and the QoS flow identifier of the first QoS flow are received from the session management function network element; 2) the first QoS flow corresponds to the first DRB, and the number of QoS flows corresponding to the first DRB is equal to 1; the processing module 1101 is also used to update the user plane security activation status of the first DRB according to the second user plane security policy.

[0433] Optionally, the transceiver module 1102 is also used to send user plane security indication information corresponding to the first DRB to the terminal device, and the user plane security indication information is used to indicate whether to activate the user plane security protection of the first DRB, and the user plane security indication information is determined according to the second user plane security protection policy.

[0434] Please refer to Fig. 12, which is another schematic structural diagram of a communication device 1200 provided in this application. The communication device 1200 at least includes an input and output interface 1202. The communication device 1200 may be a chip or an integrated circuit.

[0435] Optionally, the communication device further includes a logic circuit 1201 .

[0436] The transceiver module 1102 shown in FIG11 may be a communication interface, which may be the input / output interface 1202 in FIG12 , which may include an input interface and an output interface. Alternatively, the communication interface may be a transceiver circuit, which may include an input interface circuit and an output interface circuit.

[0437] Optionally, when the communication device 1200 is a session management function network element (or a component in a session management function network element) in the aforementioned embodiment, the input and output interface 1202 is used to input and output information; the logic circuit 1201 is used to execute the method executed by the session management function network element in the aforementioned Figures 3-10 and related embodiments.

[0438] Optionally, when the communication device 1200 is the access network device (or a component in the access network device) in the aforementioned embodiment, the input and output interface 1202 is used to input and output information, and the logic circuit 1201 is used to execute the method executed by the access network device in the aforementioned Figures 3-10 and related embodiments.

[0439] The logic circuit 1201 and the input / output interface 1202 may also execute other steps executed by the communication device in any embodiment and achieve corresponding beneficial effects, which will not be described in detail here.

[0440] In a possible implementation, the processing module 1101 shown in FIG. 11 may be the logic circuit 1201 in FIG. 12 .

[0441] Optionally, the logic circuit 1201 may be a processing device, and the functions of the processing device may be partially or entirely implemented by software. The functions of the processing device may be partially or entirely implemented by software.

[0442] Optionally, the processing device may include a memory and a processor, wherein the memory is used to store a computer program, and the processor reads and executes the computer program stored in the memory to perform corresponding processing and / or steps in any one of the method embodiments.

[0443] Alternatively, the processing device may include only a processor. A memory for storing the computer program is located outside the processing device, and the processor is connected to the memory via circuits / wires to read and execute the computer program stored in the memory. The memory and processor may be integrated or physically separate.

[0444] Optionally, the processing device may be one or more chips, or one or more integrated circuits. For example, the processing device may be one or more field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), system-on-chips (SoCs), central processor units (CPUs), network processors (NPs), digital signal processors (DSPs), microcontroller units (MCUs), programmable logic devices (PLDs), or other integrated chips, or any combination of the above chips or processors.

[0445] Please refer to Figure 13, which shows a communication device 1300 involved in the above embodiments provided in an embodiment of the present application. The communication device 1300 can specifically be a communication device serving as a session management function network element in the above embodiments.

[0446] Herein, a possible logical structure diagram of the communication device 1300 is shown. The communication device 1300 may include but is not limited to at least one processor 1301 and a communication port 1302 .

[0447] Further optionally, the device may also include at least one of a memory 1303 and a bus 1304. In an embodiment of the present application, the at least one processor 1301 is used to control and process the actions of the communication device 1300.

[0448] In addition, the processor 1301 can be a central processing unit, a general-purpose processor, a digital signal processor, an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a transistor logic device, a hardware component, or any combination thereof. It can implement or execute the various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of this application. The processor can also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a digital signal processor and a microprocessor, and so on. Those skilled in the art will clearly understand that for the sake of convenience and brevity of description, the specific working processes of the systems, devices, and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0449] It should be noted that the communication device 1300 shown in Figure 13 can be specifically used to implement the steps implemented by the session management function network element in the aforementioned method embodiment, and to achieve the technical effects corresponding to the session management function network element. The specific implementation methods of the communication device shown in Figure 13 can refer to the description in the aforementioned method embodiment, and will not be repeated here one by one.

[0450] Please refer to Figure 14, which is a schematic diagram of the structure of a communication device 1400 involved in the above embodiments provided in an embodiment of the present application. The communication device 1400 can specifically be the communication device as the access network device in the above embodiments. The structure of the communication device can refer to the structure shown in Figure 14.

[0451] The communication device 1400 includes at least one processor 1401 and at least one network interface 1404. Further optionally, the communication device also includes at least one memory 1402, at least one transceiver 1403 and one or more antennas 1405. The processor 1401, the memory 1402, the transceiver 1403 and the network interface 1404 are connected, for example, via a bus. In an embodiment of the present application, the connection may include various interfaces, transmission lines or buses, etc., which are not limited in this embodiment. The antenna 1405 is connected to the transceiver 1403. The network interface 1404 is used to enable the communication device to communicate with other communication devices through a communication link. For example, the network interface 1404 may include a network interface between the communication device and the core network device, such as an S4 interface, and the network interface may include a network interface between the communication device and other communication devices (such as other access network devices or core network devices), such as an X2 or Xn interface.

[0452] Processor 1401 is primarily used to process communication protocols and communication data, control the entire communication device, execute software programs, and process software program data, for example, to support the communication device in performing the actions described in the embodiments. The communication device may include a baseband processor and a central processing unit. The baseband processor is primarily used to process communication protocols and communication data, while the central processing unit is primarily used to control the entire terminal device, execute software programs, and process software program data. Processor 1401 in Figure 14 may integrate the functions of both a baseband processor and a central processing unit. Those skilled in the art will appreciate that the baseband processor and the central processing unit may also be independent processors interconnected via a bus or other technology. Those skilled in the art will appreciate that a terminal device may include multiple baseband processors to accommodate different network standards, multiple central processing units to enhance its processing capabilities, and various components of the terminal device may be connected via various buses. The baseband processor may also be referred to as a baseband processing circuit or a baseband processing chip. The central processing unit may also be referred to as a central processing circuit or a central processing chip. The functionality for processing communication protocols and communication data may be built into the processor or stored in memory as a software program, which is executed by the processor to implement the baseband processing functionality.

[0453] The memory is primarily used to store software programs and data. Memory 1402 can exist independently and be connected to processor 1401. Alternatively, memory 1402 can be integrated with processor 1401, for example, within a single chip. Memory 1402 can store program code for executing the technical solutions of the embodiments of the present application, and execution is controlled by processor 1401. The various computer program codes executed can also be considered drivers for processor 1401.

[0454] Figure 14 shows only one memory and one processor. In an actual terminal device, there may be multiple processors and multiple memories. The memory may also be referred to as a storage medium or a storage device. The memory may be a storage element on the same chip as the processor, i.e., an on-chip storage element, or an independent storage element, which is not limited in the present embodiment.

[0455] The transceiver 1403 can be used to support the reception or transmission of radio frequency signals between the communication device and the terminal. The transceiver 1403 can be connected to the antenna 1405. The transceiver 1403 includes a transmitter Tx and a receiver Rx. Specifically, one or more antennas 1405 can receive radio frequency signals. The receiver Rx of the transceiver 1403 is used to receive the radio frequency signal from the antenna, convert the radio frequency signal into a digital baseband signal or a digital intermediate frequency signal, and provide the digital baseband signal or digital intermediate frequency signal to the processor 1401 so that the processor 1401 can further process the digital baseband signal or digital intermediate frequency signal, such as demodulation and decoding. In addition, the transmitter Tx in the transceiver 1403 is also used to receive a modulated digital baseband signal or digital intermediate frequency signal from the processor 1401, convert the modulated digital baseband signal or digital intermediate frequency signal into a radio frequency signal, and transmit the radio frequency signal through one or more antennas 1405. Specifically, the receiver Rx can selectively perform one or more stages of down-mixing and analog-to-digital conversion on the RF signal to obtain a digital baseband signal or a digital intermediate frequency signal. The order of the down-mixing and analog-to-digital conversion processes is adjustable. The transmitter Tx can selectively perform one or more stages of up-mixing and digital-to-analog conversion on the modulated digital baseband signal or digital intermediate frequency signal to obtain a RF signal. The order of the up-mixing and digital-to-analog conversion processes is adjustable. The digital baseband signal and the digital intermediate frequency signal may be collectively referred to as digital signals.

[0456] The transceiver 1403 may also be referred to as a transceiver module, a transceiver, a transceiver device, etc. Optionally, a device in the transceiver module that implements a receiving function may be referred to as a receiving unit, and a device in the transceiver module that implements a transmitting function may be referred to as a transmitting unit. That is, the transceiver module includes a receiving unit and a transmitting unit. The receiving unit may also be referred to as a receiver, an input port, a receiving circuit, etc., and the transmitting unit may be referred to as a transmitter, a transmitter, or a transmitting circuit, etc.

[0457] It should be noted that the communication device 1400 shown in Figure 14 can be specifically used to implement the steps implemented by the access network device in the aforementioned method embodiment, and to achieve the corresponding technical effects of the access network device. The specific implementation methods of the communication device 1400 shown in Figure 14 can refer to the description in the aforementioned method embodiment, and will not be repeated here.

[0458] An embodiment of the present application also provides a computer-readable storage medium storing one or more computer-executable instructions. When the computer-executable instructions are executed by a processor, the processor executes the method as a possible implementation method of the session management function network element or access network device in the aforementioned embodiment.

[0459] An embodiment of the present application also provides a computer program product (or computer program) storing one or more computers. When the computer program product is executed by the processor, the processor executes the method of the possible implementation of the above-mentioned session management function network element or access network device.

[0460] An embodiment of the present application also provides a chip system, which includes at least one processor for supporting a communication device to implement the functions involved in the possible implementation of the above-mentioned communication device. Optionally, the chip system also includes an interface circuit, which provides program instructions and / or data to the at least one processor. In one possible design, the chip system may also include a memory for storing the necessary program instructions and data for the communication device. The chip system can be composed of a chip, or it can include a chip and other discrete devices, wherein the communication device can specifically be a session management function network element or access network device in the aforementioned method embodiment.

[0461] An embodiment of the present application also provides a communication system, which includes the session management function network element and access network device in any of the above embodiments.

[0462] In the several embodiments provided in this application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are merely schematic. For example, the division of the unit is only a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interface, device or unit, which can be electrical, mechanical or other forms.

[0463] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the units may be selected to achieve the purpose of the solution of this embodiment according to actual needs.

[0464] In addition, the functional units in the various embodiments of the present application can be integrated into a processing module, or each unit can exist physically separately, or two or more units can be integrated into one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of a software functional unit. If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the contributing part or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including several instructions for enabling a computer device (which can be a personal computer, a server, or an access network device, etc.) to execute all or part of the steps of the method of each embodiment of the present application. The aforementioned storage medium includes various media that can store program code, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

Claims

1. A communication method, characterized in that: Applicable to session management function network elements, including: Receiving a session establishment request message from a terminal device, wherein the session establishment request message is used to request to establish a session; In response to the session establishment request message, acquiring a first user plane security policy corresponding to the session, where the first user plane security policy is used to indicate whether to activate user plane security protection corresponding to the session; Sending the first user plane security policy and an identifier for indicating the session to an access network device; Acquire characteristic information of a service data stream of the terminal device, where the service data stream is carried by the session and is used to transmit service data of the terminal device; Determine, according to the characteristic information of the service data flow, a second user plane security policy corresponding to the service data flow, where the second user plane security policy is used to indicate whether to activate user plane security protection corresponding to the service data flow; When the first user plane security policy is inconsistent with the second user plane security policy, the second user plane security policy and the QoS flow identifier of the first quality of service QoS flow are sent to the access network device, and the QoS flow identifier of the first QoS flow is used to indicate the first QoS flow in the session for carrying the business data flow.

2. The method according to claim 1, characterized in that: The acquiring characteristic information of the service data flow of the terminal device includes: A session modification request message is received from the terminal device, where the session modification request message is used to request modification of the session, and the session modification request message includes characteristic information of the service data flow.

3. The method according to claim 1, characterized in that The acquiring characteristic information of the service data flow of the terminal device includes: A message for requesting to update the policy information of the session is received from a policy control function network element, wherein the message for requesting to update the policy information of the session includes characteristic information of the service data flow.

4. The method according to claim 1, characterized in that: The acquiring characteristic information of the service data flow of the terminal device includes: Receive subscription data of the terminal device from a unified data management network element, where the subscription data includes characteristic information of the service data flow.

5. The method according to any one of claims 1 to 4, characterized in that: After acquiring the characteristic information of the service data flow of the terminal device, the method further includes: Determining whether the service data flow is carried on the session; In a case where it is determined that the service data flow is carried by the session, the first user plane security policy is obtained.

6. The method according to any one of claims 1 to 5, characterized in that: The determining, according to the characteristic information of the service data flow, a second user plane security policy corresponding to the service data flow includes: Sending a message for requesting to obtain subscription data of the terminal device to a unified data management network element; Receiving subscription data of the terminal device from the unified data management network element, the subscription data including a correspondence between characteristic information of a service data flow and a user plane security policy; Determine, according to the subscription data, the second user plane security policy corresponding to the characteristic information of the service data flow.

7. The method according to any one of claims 1 to 5, characterized in that: The determining, according to the characteristic information of the service data flow, a second user plane security policy corresponding to the service data flow includes: Sending a message for requesting a user plane security policy corresponding to the characteristic information of the service data flow to a unified data management network element; Receive the second user plane security policy from the unified data management network element.

8. The method according to any one of claims 1 to 5, characterized in that: The determining, according to the characteristic information of the service data flow, a second user plane security policy corresponding to the service data flow includes: Receiving a policy and charging control rule from a policy control function network element, wherein the policy and charging control rule includes a correspondence between characteristic information of a service data flow and a user plane security policy; According to the policy and charging control rule, the second user plane security policy corresponding to the characteristic information of the service data flow is determined.

9. The method according to any one of claims 1 to 5, characterized in that: The determining, according to the characteristic information of the service data flow, a second user plane security policy corresponding to the service data flow includes: Determine the second user plane security policy corresponding to the characteristic information of the service data flow according to the local configuration policy.

10. The method according to any one of claims 1 to 9, characterized in that: Before sending the second user plane security policy and the QoS flow identifier of the first QoS flow to the access network device, the method further includes: Creating the first QoS flow, and determining a quality of service parameter of the first QoS flow according to a quality of service requirement of the business data flow; The sending the second user plane security policy and the QoS flow identifier of the first QoS flow to the access network device includes: The second user plane security policy, the QoS flow identifier of the first QoS flow, and the quality of service parameters of the first QoS flow are sent to the access network device.

11. The method according to any one of claims 1 to 9, characterized in that: Before sending the second user plane security policy and the QoS flow identifier of the first QoS flow to the access network device, the method further includes: Determine, from one or more QoS flows in the session, a QoS flow that satisfies a first condition as the first QoS flow, where the first condition includes: The quality of service parameters of the QoS flow match the quality of service requirements of the service data flow, and the user plane security policy corresponding to the service data flow carried by the QoS flow is consistent with the second user plane security policy.

12. The method according to any one of claims 1 to 11, characterized in that: The characteristic information of the service data flow includes indication information, where the indication information is used to indicate the application layer security activation state of the service data flow; When the indication information indicates that the service data flow has been encrypted at the application layer, and the first user plane security policy includes that user plane encryption needs to be activated, the second user plane security policy includes that user plane encryption does not need to be enabled; and / or, When the indication information indicates that the service data flow has been integrity protected at the application layer, and the first user plane security policy includes that user plane integrity protection needs to be activated, the second user plane security policy includes that user plane integrity protection does not need to be enabled.

13. The method according to any one of claims 1 to 11, characterized in that: The characteristic information of the service data stream includes the protocol used by the terminal device to transmit the service data stream; When the protocol is the Fast User Datagram Protocol Internet Connection QUIC protocol or the Multipath QUIC protocol, and the first user plane security policy includes that user plane encryption needs to be enabled, the second user plane security policy includes that user plane encryption does not need to be enabled.

14. A communication method, characterized in that: Applied to access network equipment, including: In the process of establishing a session of a terminal device, receiving a first user plane security policy corresponding to the session and an identifier for indicating the session from a session management function network element, wherein the first user plane security policy is used to indicate whether to activate user plane security protection corresponding to the session; Determining whether to activate user plane security protection for a data radio bearer (DRB) belonging to the session according to the first user plane security policy; receiving a second user plane security policy and a QoS flow identifier of a first quality of service QoS flow from the session management function network element, wherein the second user plane security policy is used to indicate whether to activate user plane security protection corresponding to the service data flow, and the QoS flow identifier of the first QoS flow is used to indicate the first QoS flow in the session for carrying the service data flow; Determine the first DRB corresponding to the first QoS flow in the session and the user plane security activation status of the first DRB according to the second user plane security policy and the QoS flow identifier of the first QoS flow.

15. The method according to claim 14, characterized in that The determining, according to the second user plane security policy and the QoS flow identifier of the first QoS flow, the first DRB corresponding to the first QoS flow in the session and the user plane security activation state of the first DRB includes: Determining, according to the QoS flow identifier of the first QoS flow, that the first QoS flow is newly created; creating the first DRB, and determining the user plane security activation state of the first DRB according to the second user plane security policy; or, Determine a DRB that meets a second condition from one or more DRBs of the session as the first DRB, wherein the second condition includes: the user plane security activation status of the DRB is determined according to the second user plane security policy.

16. The method according to claim 14, characterized in that The determining, according to the second user plane security policy and the QoS flow identifier of the first QoS flow, the first DRB corresponding to the first QoS flow in the session and the user plane security activation state of the first DRB includes: Determine, according to the QoS flow identifier of the first QoS flow, that the following conditions are met: 1) the first QoS flow has been created before the second user plane security policy and the QoS flow identifier of the first QoS flow are received from the session management function network element, 2) the first QoS flow corresponds to a second DRB, and the number of QoS flows corresponding to the second DRB is greater than 1; creating the first DRB, and determining the user plane security activation state of the first DRB according to the second user plane security policy; or, Determine a DRB that meets a second condition from one or more DRBs of the session as the first DRB, wherein the second condition includes: the user plane security activation status of the DRB is determined according to the second user plane security policy.

17. The method according to claim 14, characterized in that The determining, according to the second user plane security policy and the QoS flow identifier of the first QoS flow, the first DRB corresponding to the first QoS flow in the session and the user plane security activation state of the first DRB includes: Determining that the following conditions are met according to the QoS flow identifier of the first QoS flow: 1) the first QoS flow is created before the second user plane security policy and the QoS flow identifier of the first QoS flow are received from the session management function network element, 2) the first QoS flow corresponds to the first DRB, and the number of QoS flows corresponding to the first DRB is equal to 1; Update the user plane security activation status of the first DRB according to the second user plane security policy.

18. The method according to any one of claims 14 to 17, characterized in that: The method further comprises: Send user plane security indication information corresponding to the first DRB to the terminal device, where the user plane security indication information is used to indicate whether to activate user plane security protection of the first DRB, and the user plane security indication information is determined based on the second user plane security protection policy.

19. A communication method, characterized in that: The method comprises: The session management function network element obtains the network status; The session management function network element determines, according to the network state, a second user plane security policy corresponding to the network state; When the second user plane security policy is inconsistent with the user plane security policy of the session of the terminal device, the session management function network element instructs the access network device to perform user plane security protection on the first quality of service QoS flow according to the second user plane security policy, and the first QoS flow carries the service data flow.

20. The method according to claim 19, characterized in that The session management function network element obtains the network state, including: The session management function network element obtains notification information, where the notification information comes from any one or more of the following network functions or devices: an access and mobility management function, an access network device, a policy control function network element, a network manager, or a terminal device; The session management function network element determines the network status according to the notification information.

21. The method according to claim 19 or 20, characterized in that The network state includes a network security capability, and the session management function network element determines, according to the network state, the second user plane security policy corresponding to the network state, including: The session management function network element determines, according to the network state, that the network security capability is improved; In response to the improved network security capability, the session management function network element determines the second user plane security policy, the security protection capability of the second user plane security policy is higher than the security protection capability of the first user plane security policy, and the first user plane security policy is the user plane security policy adopted by the first QoS flow before the network status changes.

22. The method according to claim 21, characterized in that The network status includes: the network returns to normal, wherein the network returns to normal includes: the congestion occurring in the network returns to normal, the service resources provided by the network are improved, and / or the network functions in the network return to normal.

23. The method according to claim 19 or 20, characterized in that The network state includes a network security capability, and the session management function network element determines, according to the network state, the second user plane security policy corresponding to the network state, including: The session management function network element determines, according to the network state, that the network security capability is reduced; In response to the decrease in the network security capability, the session management function network element determines the second user plane security policy, and the security protection capability of the second user plane security policy is lower than the security protection capability of the first user plane security policy. The first user plane security policy is the user plane security policy adopted by the first QoS flow before the network status changes.

24. The method according to claim 23, characterized in that The network status includes: network abnormality, and the network abnormality includes: network congestion, natural disasters in the area where the network is deployed, reduced service resources provided by the network, and / or network function failure in the network.

25. The method according to claim 19 or 20, characterized in that The session management function network element determines, according to the network state, the second user plane security policy corresponding to the network state, including: The session management function network element obtains subscription data of the unified data management network element; The session management function network element determines, according to the subscription data and the network status, that the user plane security policy corresponding to the network status is the second user plane security policy.

26. The method according to claim 19 or 20, characterized in that The session management function network element determines, according to the network state, the second user plane security policy corresponding to the network state, including: The session management function network element obtains the policy and charging control PCC rule from the policy control function network element; The session management function network element determines, according to the network state, from the PCC rule that the user plane security policy corresponding to the network state is the second user plane security policy.

27. The method according to claim 19 or 20, characterized in that The session management function network element determines, according to the network state, the second user plane security policy corresponding to the network state, including: The session management function network element obtains a local configuration policy, where the local configuration policy includes a correspondence between the network state and the second user plane security policy; The session management function network element determines, according to the network state, from the configuration policy, that the user plane security policy corresponding to the network state is the second user plane security policy.

28. The method according to any one of claims 19 to 27, characterized in that The session management function network element instructs the access network device to perform user plane security protection on the first QoS flow according to the second user plane security policy, including: The session management function network element sends the QoS flow identifier of the first QoS flow and the second user plane security policy to the access network device.

29. The method according to any one of claims 19 to 27, characterized in that The session management function network element instructs the access network device to perform user plane security protection on the first QoS flow according to the second user plane security policy, including: The session management function network element sends first indication information to the access network device, where the first indication information is used to indicate that the user plane security policy of the first QoS flow is the second user plane security policy.

30. The method according to any one of claims 29, characterized in that The first indication information is carried in the QoS flow identifier of the first QoS flow; Alternatively, the first indication information is carried in a QoS profile corresponding to the first QoS flow; Alternatively, the first indication information is carried in description information of the first QoS flow.

31. The method according to any one of claims 19 to 30, characterized in that The session management function network element sends access traffic guidance, switching, and splitting ASSSS rules to the terminal device, and the ASSS rules include the correspondence between the second user plane security policy and the first QoS flow.

32. A communication method, characterized in that: The method comprises: The session management function network element receives a session establishment request from a terminal device, wherein the session establishment request includes a first session identifier and a second session identifier; The session management function network element determines, according to the session establishment request, that a user plane security policy corresponding to a quality of service QoS flow is a first user plane security policy, and the QoS flow carries data of the terminal device; The session management function network element creates a first session and a second session according to the session establishment request, wherein the first session corresponds to the first session identifier, the second session identifier corresponds to the second session identifier, the first session carries the QoS flow, and the user plane security policy of the first session is the first user plane security policy.

33. The method according to claim 32, characterized in that The method comprises: The session management function network element sends the first session identifier and the first user plane security policy to the access network device; The session management function network element sends the second session identifier and the user plane security policy of the second session to the access network device.

34. A communication device, characterized in that: The method comprises one or more functional modules, wherein the one or more functional modules are used to execute the method described in any one of claims 1 to 13, or to execute the method described in any one of claims 14 to 18, or to execute the method described in any one of claims 19 to 31, or to execute the method described in claim 32 or 33.

35. A communication device, characterized in that: Including communication interface and processor: The communication interface is used to input and / or output signaling or data; The processor is used to execute a computer executable program so that the method described in any one of claims 1 to 13 is executed, or the method described in any one of claims 14 to 18 is executed, or the method described in any one of claims 19 to 31 is executed, or the method described in claim 32 or 33 is executed.

36. A communication device, characterized in that: including a processor and memory, The memory is used to store computer programs or instructions; The processor is used to execute the computer program or instructions in the memory, so that the method described in any one of claims 1 to 13 is executed, or the method described in any one of claims 14 to 18 is executed, or the method described in any one of claims 19 to 31 is executed, or the method described in claim 32 or 33 is executed.

37. A computer-readable storage medium comprising instructions, characterized in that: When the instructions are executed by a processor, the method of claims 1-13, or any one of claims 14-18, or any one of claims 19-31, or any one of claims 32 or 33 is implemented.

38. A computer program product comprising a program, characterized in that When the program is executed by a processor, the method of claims 1-13, or any one of claims 14-18, or any one of claims 19-31, or any one of claims 32 or 33 is implemented.

39. A chip system, characterized in that: The chip system includes at least one processor. When the program instructions are executed in the at least one processor, the method described in any one of claims 1 to 13 is implemented, or the method described in any one of claims 14 to 18 is implemented, or the method described in any one of claims 19 to 31 is implemented, or the method described in claim 32 or 33 is implemented.

40. A communication system, characterized in that: The invention comprises a communication device for executing the method according to any one of claims 1 to 13, and a communication device for executing the method according to any one of claims 14 to 18.

Images