Communication security protection methods, communication device and storage medium

Abstract

Provided in the embodiments of the present disclosure are communication security protection methods, a communication device, and a storage medium. A communication security protection method comprises: a first network function (NF) of an access network (AN), when communicating with a second NF, supports service-based architecture (SBA) domain security.

Description

Communication security protection method, communication equipment and storage medium Technical Field

[0001] The present disclosure relates to the field of communication technology, and in particular to a communication security protection method, communication equipment, and storage medium. Background Art

[0002] Service Based Architecture (SBA) is a network structure that communicates through a Service Based Interface (SBI).

[0003] The network function (NF) of the service-oriented architecture may include application functions (AF) and the like.

[0004] Summary of the Invention

[0005] The embodiments of the present disclosure provide a communication security protection method and apparatus, a communication device, and a storage medium.

[0006] According to a first aspect of an embodiment of the present disclosure, a communication security protection method is provided, wherein the method includes: supporting service-based architecture (SBA) domain security when a first network function (NF) of an access network (AN) communicates with a second NF.

[0007] According to a second aspect of an embodiment of the present disclosure, a communication security protection method is provided, wherein the method includes: supporting service-based architecture (SBA) domain security when a second network function NF communicates with a first NF of an access network AN.

[0008] According to a third aspect of an embodiment of the present disclosure, a communication security protection method is provided, wherein the method includes:

[0009] The processing module is configured to support service-based architecture (SBA) domain security when communicating with the second NF.

[0010] According to a fourth aspect of an embodiment of the present disclosure, a communication security protection method is provided, wherein the method includes:

[0011] The processing module is configured to support service-based architecture (SBA) domain security when communicating with a first NF of an access network (AN).

[0012] According to a fifth aspect of an embodiment of the present disclosure, a communication device is provided, wherein the communication device includes:

[0013] one or more processors;

[0014] Among them, the processor is used to call instructions to enable the communication device to execute the communication security protection method provided by any technical solution of the first aspect and / or the second aspect mentioned above.

[0015] According to the sixth aspect of an embodiment of the present disclosure, a storage medium is provided, wherein the storage medium stores instructions, which, when the instructions are executed on a communication device, enable the communication device to execute the communication security protection method provided by any aspect of the first aspect and / or the second aspect.

[0016] The technical solution provided by the embodiment of the present disclosure supports SBA domain security when the first NF and the second NF of the AN communicate, thereby ensuring the communication security of the first NF and the second NF, and realizing secure communication between the NF of the AN and other NFs.

[0017] It should be understood that the foregoing general description and the following detailed description are merely exemplary and explanatory and are not restrictive of the embodiments of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present invention and, together with the description, serve to explain the principles of the embodiments of the present invention.

[0019] FIG1A is a schematic diagram showing an architecture of a communication system according to an exemplary embodiment;

[0020] FIG1B is a schematic diagram showing an architecture of a communication system according to an exemplary embodiment;

[0021] FIG1C is a schematic diagram showing an architecture of a security architecture according to an exemplary embodiment;

[0022] FIG1D is a schematic diagram showing an architecture of a security architecture according to an exemplary embodiment;

[0023] FIG2 is a flow chart showing a communication security protection method according to an exemplary embodiment;

[0024] FIG3 is a flow chart showing a communication security protection method according to an exemplary embodiment;

[0025] FIG4 is a flow chart showing a communication security protection method according to an exemplary embodiment;

[0026] FIG5 is a schematic structural diagram of a first NF of an AN according to an exemplary embodiment;

[0027] FIG6 is a schematic structural diagram of a second NF according to an exemplary embodiment;

[0028] FIG7A is a schematic structural diagram of a communication device according to an exemplary embodiment;

[0029] FIG7B is a schematic structural diagram of a chip according to an exemplary embodiment. DETAILED DESCRIPTION

[0030] The embodiments of the present disclosure provide a communication security protection method and apparatus, communication equipment, a communication system, and a storage medium.

[0031] In a first aspect, an embodiment of the present disclosure provides a communication security protection method, which includes:

[0032] The first network function NF of the access network AN supports service-based architecture SBA domain security when communicating with the second NF.

[0033] In the above embodiment, the first NF of the AN supports SBA domain security when communicating with the second NF, that is, the SBA domain security is used to protect the communication between the first NF and the second NF, so that the communication security of the first NF and the second NF is guaranteed.

[0034] In conjunction with some embodiments of the first aspect, in some embodiments, supporting service-based architecture (SBA) domain security when a first network function NF of an access network AN communicates with a second NF includes:

[0035] The first NF communicates with the second NF based on a service-based architecture interface (SBI), and the first NF supports service-based architecture (SBA) domain security when communicating with the second NF, and / or

[0036] The first NF supports both transport layer and service layer functions, and supports service-based architecture (SBA) domain security when communicating with the second NF, and / or

[0037] The first NF is an AN node of the SBA, and the first NF supports the service-based architecture (SBA) domain security when communicating with the second NF, and / or

[0038] The second NF supports both transport layer and service layer functions, and the first NF supports service-based architecture (SBA) domain security when communicating with the second NF, and / or

[0039] The second NF supports both transport layer and home layer functions, and the first NF supports service-based architecture (SBA) domain security when communicating with the second NF, and / or

[0040] The second NF is the AN node of the SBA, and the first NF supports the service-oriented architecture SBA domain security when communicating with the second NF.

[0041] Based on the above solution, the conditions for using SBA domain security when the first NF and the second NF communicate are restricted, thereby reducing unnecessary use of SBA domain security and unnecessary SBA domain security operations.

[0042] In conjunction with some embodiments of the first aspect, in some embodiments, the second NF includes at least one of the following:

[0043] Core network CN NF of the service network;

[0044] CN NF of the home network;

[0045] AN NF of the service network;

[0046] Based on the above solution, the second NF can be a CN NF or an AN NF, that is, the first NF can use SBA domain security when communicating with the CN NF and / or AN NF, so as to comprehensively cover various communication scenarios that require the use of SBA domain security and achieve secure communication.

[0047] In conjunction with some embodiments of the first aspect, in some embodiments,

[0048] SBA domain security is established based on network domain security.

[0049] In the above embodiment, the SBA domain security is established based on the network domain security, which means that the SBA domain security is guaranteed by the network domain security and can provide more comprehensive security protection than the network domain security.

[0050] In conjunction with some embodiments of the first aspect, in some embodiments,

[0051] Supporting service-based architecture (SBA) domain security when a first network function NF of an access network AN communicates with a second NF includes at least one of the following:

[0052] Support identity authentication when the first NF communicates with the second NF;

[0053] Support transmission protection when the first NF communicates with the second NF;

[0054] Support authorization of service requests when the first NF communicates with the second NF;

[0055] When the first NF communicates with the second NF, the terminal network access is protected through SBA domain security.

[0056] The above solution limits the security operations that may be involved in using SBA domain security when the first NF and the second NF communicate, and has the characteristics of comprehensive coverage and high security level.

[0057] In conjunction with some embodiments of the first aspect, in some embodiments, supporting transmission protection during communication between a first NF and a second NF includes:

[0058] The first NF and the second NF support confidentiality protection, integrity verification and / or replay protection when communicating.

[0059] The above solution defines security operations related to transmission protection and has the characteristics of simple implementation and high security.

[0060] In a second aspect, an embodiment of the present disclosure provides a communication security protection method, which includes:

[0061] The second network function NF supports service-based architecture SBA domain security when communicating with the first NF of the access network AN.

[0062] In conjunction with some embodiments of the second aspect, in some embodiments,

[0063] The second network function NF supports the service-based architecture (SBA) domain security when communicating with the first NF of the access network AN, including:

[0064] The second NF communicates with the first NF based on the service-based architecture interface SBI, and supports service-based architecture SBA domain security when communicating with the first NF, and / or

[0065] The first NF supports both transport layer and service layer functions, and the second NF supports service-based architecture (SBA) domain security when communicating with the first NF, and / or

[0066] The first NF is an AN node that supports SBA, and the second NF supports the service-based architecture (SBA) domain security when communicating with the first NF, or,

[0067] The second NF supports both transport layer and home layer functions, and the first NF supports service-based architecture (SBA) domain security when communicating with the second NF, and / or

[0068] The second NF supports both transport layer and service layer functions, and the first NF supports service-based architecture (SBA) domain security when communicating with the second NF, and / or

[0069] The second NF is an AN node that supports SBA, and supports service-based architecture SBA domain security when communicating with the first NF.

[0070] In conjunction with some embodiments of the second aspect, in some embodiments, SBA domain security is established based on network domain security. In conjunction with some embodiments of the second aspect, in some embodiments,

[0071] The second network function NF supports at least one of the following service-based architecture (SBA) domain security when communicating with the first NF of the access network AN:

[0072] The second NF supports identity authentication when communicating with the first NF;

[0073] The second NF supports transmission protection when communicating with the first NF;

[0074] The second NF supports authorization of service requests when communicating with the first NF;

[0075] When the second NF communicates with the first NF, the terminal network access is protected through SBA domain security.

[0076] The transmission protection supported when the second NF communicates with the first NF includes:

[0077] In combination with some embodiments of the second aspect, in some embodiments, the first NF and the second NF support confidentiality protection, integrity verification and / or replay protection when communicating.

[0078] In a third aspect, an embodiment of the present disclosure provides a first network function NF of an access network AN, including:

[0079] The processing module is configured to support service-based architecture (SBA) domain security when communicating with the second NF.

[0080] In a fourth aspect, an embodiment of the present disclosure provides a second network function NF, including:

[0081] The processing module is configured to support service-based architecture (SBA) domain security when communicating with a first NF of an access network (AN).

[0082] In a fifth aspect, an embodiment of the present disclosure provides a communication device, the communication device including: one or more processors;

[0083] The processor is used to call instructions to enable the communication device to execute the communication security protection method described in the optional implementation methods of the first to sixth aspects.

[0084] In a sixth aspect, an embodiment of the present disclosure provides a storage medium, wherein the storage medium stores instructions, which, when the instructions are executed on a communication device, enable the communication device to execute the communication security protection method described in the optional implementation methods of the first to sixth aspects.

[0085] In a seventh aspect, an embodiment of the present disclosure provides a program product. When the program product is executed by a communication device, the communication device executes the communication security protection method described in the optional implementation methods of the first to sixth aspects.

[0086] In an eighth aspect, an embodiment of the present disclosure provides a computer program which, when executed on a computer, enables the computer to execute the communication security protection method described in the optional implementation of the first to sixth aspects.

[0087] It is understandable that the above-mentioned terminals, network devices, communication systems, program products, and computer programs are all used to execute the methods provided by the embodiments of the present disclosure. Therefore, the beneficial effects that can be achieved can refer to the beneficial effects of the corresponding methods and will not be repeated here.

[0088] The present disclosure provides a communication security protection method, communication device, and storage medium. In some embodiments, the terms "communication security protection method" and "communication method" are interchangeable, "information processing method" and "information indicating device" and "communication network function" are interchangeable, and "communication system" and "information processing system" are interchangeable.

[0089] The embodiments of the present disclosure are not exhaustive and are merely illustrative of some embodiments, and are not intended to be a specific limitation on the scope of protection of the present disclosure. In the absence of contradiction, each step in a certain embodiment can be implemented as an independent embodiment, and the steps can be arbitrarily combined. For example, a solution after removing some steps in a certain embodiment can also be implemented as an independent embodiment, and the order of the steps in a certain embodiment can be arbitrarily exchanged. In addition, the optional implementation methods in a certain embodiment can be arbitrarily combined; in addition, the embodiments can be arbitrarily combined. For example, some or all steps of different embodiments can be arbitrarily combined, and a certain embodiment can be arbitrarily combined with the optional implementation methods of other embodiments.

[0090] In each embodiment of the present disclosure, unless otherwise specified or provided for by logic, the terms and / or descriptions between the embodiments are consistent and can be referenced by each other. The technical features in different embodiments can be combined to form a new embodiment based on their inherent logical relationships.

[0091] The terms used in the embodiments of the present disclosure are only for the purpose of describing specific embodiments and are not intended to limit the present disclosure.

[0092] In the embodiments of the present disclosure, unless otherwise specified, elements expressed in the singular, such as "a", "an", "the", "above", "the", "the", etc., may mean "one and only one", or "one or more", "at least one", etc. For example, when articles such as "a", "an", "the" in English are used in translation, the noun following the article may be understood as a singular expression or a plural expression.

[0093] In the embodiments of the present disclosure, “plurality” refers to two or more.

[0094] In some embodiments, the terms "at least one," "one or more," "a plurality of," "multiple," etc. may be used interchangeably.

[0095] In some embodiments, descriptions such as "at least one of A and B," "A and / or B," "in one case A, in another case B," or "in one case A, in another case B" may include the following technical solutions depending on the situation: in some embodiments, A (A is executed independently of B); in some embodiments, B (B is executed independently of A); in some embodiments, execution is selected from A and B (A and B are selectively executed); and in some embodiments, A and B (both A and B are executed). The same applies when there are more branches such as A, B, and C.

[0096] In some embodiments, "A or B" and other descriptions may include the following technical solutions depending on the situation: in some embodiments, A (A is executed independently of B); in some embodiments, B (B is executed independently of A); in some embodiments, execution is selected from A and B (A and B are selectively executed). The above is also applicable when there are more branches such as A, B, C, etc.

[0097] The prefixes such as "first" and "second" in the embodiments of the present disclosure are only used to distinguish different description objects and do not constitute any restriction on the position, order, priority, quantity or content of the description objects. For the statement of the description object, please refer to the description in the context of the claims or embodiments, and no unnecessary restriction should be constituted due to the use of prefixes. For example, if the description object is a "field", the ordinal number before the "field" in the "first field" and the "second field" does not limit the position or order between the "fields". "First" and "second" do not limit whether the "fields" they modify are in the same message, nor do they limit the order of the "first field" and the "second field". For another example, if the description object is a "level", the ordinal number before the "level" in the "first level" and the "second level" does not limit the priority between the "levels". For another example, the number of description objects is not limited by the ordinal number and can be one or more. Taking "first device" as an example, the number of "devices" can be one or more. In addition, the objects modified by different prefixes can be the same or different. For example, if the description object is "device", then the "first device" and the "second device" can be the same device or different devices, and their types can be the same or different; for another example, if the description object is "information", then the "first information" and the "second information" can be the same information or different information, and their contents can be the same or different.

[0098] In some embodiments, “including A,” “comprising A,” “used to indicate A,” and “carrying A” can be interpreted as directly carrying A or indirectly indicating A.

[0099] In some embodiments, terms such as "...", "determine...", "in the case of...", "at the time of...", "when...", "if...", "if...", etc. can be used interchangeably.

[0100] In some embodiments, terms such as "greater than", "greater than or equal to", "not less than", "more than", "more than or equal to", "not less than", "higher than", "higher than or equal to", "not less than", and "above" can be replaced with each other, and terms such as "less than", "less than or equal to", "not greater than", "less than", "less than or equal to", "not more than", "lower than", "lower than or equal to", "not higher than", and "below" can be replaced with each other.

[0101] In some embodiments, devices, etc. can be interpreted as physical or virtual, and their names are not limited to the names recorded in the embodiments. Terms such as "device", "equipment", "device", "circuit", "network element", "node", "function", "unit", "section", "system", "network", "chip", "chip system", "entity", and "subject" can be used interchangeably.

[0102] In some embodiments, "network" can be interpreted as devices included in the network (eg, access network equipment, core network equipment, etc.).

[0103] In some embodiments, the terms "access network device (AN device)", "radio access network device (RAN device)", "base station (BS)", "radio base station" "fixed station", "node", "access point", "transmission point (TP)", "reception point (RP)", "transmission / reception point (TRP)", "panel", "antenna panel", "antenna array", "cell", "macro cell", "small cell", "femto cell", "pico cell", "sector", "cell group", "serving cell", "carrier", "component carrier", "bandwidth part (BWP)" and the like may be used interchangeably.

[0104] In some embodiments, the terms "terminal", "terminal device", "user equipment (UE)", "user terminal", "mobile station (MS)", "mobile terminal (MT)", subscriber station, mobile unit, subscriber unit, wireless unit, remote unit, mobile device, wireless device, wireless communication device, remote device, mobile subscriber station, access terminal, mobile terminal, wireless terminal, remote terminal, handset, user agent, mobile client, client, etc. can be used interchangeably.

[0105] In some embodiments, the access network device, the core network device, or the network device can be replaced by a terminal. For example, the various embodiments of the present disclosure can also be applied to a structure in which the communication between the access network device, the core network device, or the network device and the terminal is replaced by communication between multiple terminals (for example, device-to-device (D2D), vehicle-to-everything (V2X), etc.). In this case, it is also possible to set the structure in which the terminal has all or part of the functions of the access network device. In addition, terms such as "uplink" and "downlink" can also be replaced by terms corresponding to communication between terminals (for example, "side"). For example, uplink channels, downlink channels, etc. can be replaced by side channels, and uplinks, downlinks, etc. can be replaced by side links.

[0106] In some embodiments, the terminal may be replaced by an access network device, a core network device, or a network device. In this case, the access network device, the core network device, or the network device may have a structure that has all or part of the functions of the terminal.

[0107] In some embodiments, obtaining data, information, etc. may comply with the laws and regulations of the country where the data is obtained.

[0108] In some embodiments, data, information, etc. may be obtained with the user's consent.

[0109] In addition, each element, each row, or each column in the table of the embodiment of the present disclosure can be implemented as an independent embodiment, and the combination of any elements, any rows, and any columns can also be implemented as an independent embodiment.

[0110] FIG1A is a schematic diagram showing the architecture of a communication system according to an embodiment of the present disclosure.

[0111] As shown in Figure 1A, a communication system 100 includes a terminal 101 and a network device 102. The network device 102 may include an access network device and a core network device.

[0112] In some embodiments, a network device may also be referred to as a network function or a network node. For example, an access network node may be referred to as an access network function or an access network node. A core network device may also be referred to as a core network function or a core network node.

[0113] In some embodiments, the core network device may communicate with the terminal through the access network device.

[0114] In some embodiments, the terminal 101 includes, for example, a mobile phone, a wearable device, an Internet of Things device, a car with communication function, a smart car, a tablet computer, a computer with wireless transceiver function, a virtual reality (VR) terminal device, an augmented reality (AR) terminal device, a wireless terminal device in industrial control, a wireless terminal device in self-driving, a wireless terminal device in remote medical surgery, a wireless terminal device in a smart grid, a wireless terminal device in transportation safety, a wireless terminal device in a smart city, and at least one of a wireless terminal device in a smart home, but is not limited thereto.

[0115] In some embodiments, the terminal is also referred to as User Equipment (UE).

[0116] In some embodiments, the access network device may be, for example, a node or device that accesses a terminal to a wireless network. The access network device may include an evolved NodeB (eNB), a next generation evolved NodeB (ng-eNB), a next generation NodeB (gNB), a node B (NB), a home node B (HNB), a home evolved nodeB (HeNB), a wireless backhaul device, a radio network controller (RNC), a base station controller (BSC), a base transceiver station (BTS), a base band unit (BBU), a mobile switching center, a base station in a 6G communication system, an open base station (Open RAN), a cloud base station (Cloud RAN), a base station in other communication systems, and at least one of an access node in a Wi-Fi system, but is not limited thereto.

[0117] In some embodiments, the technical solution of the present disclosure can be applied to the Open RAN architecture. In this case, the interfaces between or within the access network devices involved in the embodiments of the present disclosure can be transformed into internal interfaces of the Open RAN, and the processes and information interactions between these internal interfaces can be implemented through software or programs.

[0118] In some embodiments, the access network device can be composed of a centralized unit (CU) and a distributed unit (DU), where the CU can also be called a control unit. The CU-DU structure can be used to split the protocol layer of the access network device, with the functions of some protocol layers centrally controlled by the CU, and the functions of the remaining part or all of the protocol layers distributed in the DU, which is centrally controlled by the CU, but is not limited to this.

[0119] In some embodiments, the core network device may be a single device including a first network element, or may be a plurality of devices or a group of devices, each including a first network element. The network element may be virtual or physical. The core network may include, for example, at least one of an Evolved Packet Core (EPC), a 5G Core Network (5GCN), and a Next Generation Core (NGC).

[0120] It can be understood that the communication system described in the embodiment of the present disclosure is for the purpose of more clearly illustrating the technical solution of the embodiment of the present disclosure, and does not constitute a limitation on the technical solution provided by the embodiment of the present disclosure. Ordinary technicians in this field can know that with the evolution of the system architecture and the emergence of new business scenarios, the technical solution provided by the embodiment of the present disclosure is also applicable to similar technical problems.

[0121] The following embodiments of the present disclosure may be applied to the communication system 100 shown in FIG1A , or a portion thereof, but are not limited thereto. The entities shown in FIG1A are illustrative only. The communication system may include all or part of the entities shown in FIG1A , or may include other entities other than those shown in FIG1A . The number and form of the entities may be arbitrary. The connection relationship between the entities is illustrative only. The entities may be connected or disconnected, and the connection may be in any manner, including direct or indirect, wired or wireless.

[0122] The embodiments of the present disclosure can be applied to Long Term Evolution (LTE), LTE-Advanced (LTE-A), LTE-Beyond (LTE-B), SUPER 3G, IMT-Advanced, 4th generation mobile communication system (4G), 5th generation mobile communication system (5G), 5G new radio (NR), future radio access (FRA), new radio access technology (RAT), new radio (NR), new radio access (NX), future generation radio access (FX), Global System for Mobile communications (GSM (registered trademark)), CDMA2000, Ultra Mobile Broadband (UMB), IEEE 802.11 (Wi-Fi (registered trademark)), IEEE 802.16 (WiMAX (registered trademark)), IEEE 802.20, Ultra-WideBand (UWB), Bluetooth (registered trademark), Public Land Mobile Network (PLMN) networks, Device-to-Device (D2D) systems, Machine-to-Machine (M2M) systems, Internet of Things (IoT) systems, Vehicle-to-Everything (V2X), systems utilizing other communication security protection methods, and next-generation systems based on and extending these systems. Furthermore, multiple systems may be combined (for example, LTE or LTE-A combined with 5G).

[0123] As shown in FIG1B , a schematic diagram of a network architecture is provided according to an embodiment of the present disclosure.

[0124] Figure 1B shows the network functions of the core network (CN), which may include but are not limited to access management function (AMF), location management function (LMF), policy control function (PCF), user data management (UDM), user equipment radio capability management function (UCMF), session management function (SMF), network data analysis function (NWDAF), network exposure function (NEF) and / or network repository function (NRF), etc.

[0125] Signaling communications between the CN's NF and the Radio Access Network (RAN) can be forwarded or transparently transmitted through the AMF. The RAN may include a New Generation (NG)-RAN.

[0126] In the architecture shown in Figure 1B, the core network NF can also communicate with the RAN via SBI. When the CN's NF communicates with the RAN via SBI (for example, transmitting signaling), the AMF can be bypassed between the CN's NF and the RAN, thereby shortening the transmission path, reducing transmission latency, and resolving the transmission bottleneck caused by AMF intermediate forwarding or transparent transmission. As shown in Figure 1B, there is NRAM between the NG-RAN and NRF, and they can communicate directly via NRAM. This NRAM can be an SBI based on SBA. Interfaces N2 and N4 in Figure 1B can be non-SBI.

[0127] If the CN's NF and RAN use SBI for communication, the network structure between the CN's NF and RAN is a service-based architecture (SBA).

[0128] In this architecture, the RAN is served not only by the AMF but also by other NFs in the CN, such as the CN's Application Function (AF). However, there are currently no regulations on how to secure RAN communications within this service-oriented architecture.

[0129] Figure 1C shows a schematic diagram of the division of a network architecture based on security protection. In the network architecture shown in Figure 1C, the network is divided into three layers, namely the transport layer (Transport Stratum, TS), the middle layer and the application layer (Application Stratum). The middle layer includes the service layer and the home layer. The service layer (Serving Stratum) corresponds to the function of the service network. The home layer (Home Environment Stratum) corresponds to the function of the home network. One or more applications (Application, APP) are provided in the application layer. These applications may include user applications (User Application) for users and / or supplier applications (Provide Application) provided by suppliers.

[0130] The service layer may include: a service network (SN), a home environment (HE), a subscriber identification module (SIM), and / or a mobile equipment (MO) that does not include a SIM. The subscriber identification module includes, but is not limited to, a universal subscriber identity module (USIM). The HE herein may refer to a control plane NF in the home network. In some cases, the HE may be understood as a network function related to communication security. For example, the control plane NF may include, but is not limited to, a PCF, an NRF, an UDM, an authentication server function (ASF) AUSF, a NEF, and / or a user data repository (UDR).

[0131] FIG1D shows another schematic diagram of the division of a network architecture based on security protection. Similarly, the network architecture shown in FIG1D includes three layers, and an SBI is provided between the 3GPP AN and HE.

[0132] The difference between Figure 1C and Figure 1D lies in the different ownership of the RAN. In the architecture shown in Figure 1C, the access network (AN) belongs to the transport layer. ANs can include both 3GPP ANs and non-3GPP ANs. Typically, a 3GPP AN includes a radio access network (RAN). In the network architecture shown in Figure 1D, the 3GPP AN belongs to both the transport layer and the service layer.

[0133] In some embodiments, when performing security processing, the network architecture is further divided into multiple domains, and security mechanisms, security requirements, or security policies are specified based on the domains.

[0134] For example, Network Access Security (I) is used for security control of network access. This defines a set of security features that can provide security protection for 3GPP access and non-3GPP access, mainly involving attack defense of the radio interface (Radio Interface), security protection of context transmission between the serving network and the home network, etc.

[0135] Network Domain Security (II) is used for security control of the network domain. This defines a set of security features that enable secure exchange of signaling and / or data between network functions. Network domain security control may include: control plane security control and / or user plane security control.

[0136] User domain security (III) is used for terminal security protection and mainly defines a security feature for protecting terminals that access the network and / or use network services.

[0137] Application Domain Security (IV) protects the security of the User Domain and the Provider Domain. It defines a set of security features that enable secure information exchange between the User Domain and the Provider Domain based on applications.

[0138] SBA Domain Security (V), also known as SBA Domain Security, is used for SBA security control. It defines a set of security features for secure communication between SBA network functions within the service network domain and with other network domains. These security features include network function registration, discovery, and authorization security, as well as features related to protecting service-based interfaces.

[0139] It is worth noting that there are currently no regulations on how to protect secure communications for access network nodes that belong to both the transport layer and the service layer.

[0140] In view of this, an embodiment of the present disclosure provides a secure communication protection method to solve the above problems.

[0141] FIG2 is an interactive diagram of a communication security protection method according to an embodiment of the present disclosure. As shown in FIG2 , the present disclosure embodiment relates to a communication security protection method for a communication system 100, the method comprising:

[0142] S2101: The first NF of the AN supports SBA domain security when communicating with the second NF.

[0143] In some embodiments, the first NF of the AN may be any access network node such as a base station.

[0144] In some embodiments, supporting SBA domain security may be understood as at least one of the following:

[0145] Use SBA's security mechanism;

[0146] Meet SBA's security requirements;

[0147] Implement SBA's security policies, etc.

[0148] In some embodiments, supporting SBA domain security may be understood as complying with SBA domain security.

[0149] In some embodiments, S2101 may include at least one of the following:

[0150] Support SBA domain security when the first NF sends a message to the second NF;

[0151] The first NF supports SBA domain security when receiving messages from the second NF.

[0152] It is worth noting that the communication between the first NF and the second NF here can be understood as information exchange between the first NF and the second NF.

[0153] The communication between the first NF and the second NF may involve messages including but not limited to one of the following:

[0154] Request message, used to request the execution of a specific service or function;

[0155] Response message, used to provide feedback on the execution status of the service request;

[0156] Subscription messages are used to generate, update or delete NFs that subscribe to stored information content;

[0157] Notification messages are used to send subscription messages to the subscriber's NF when the subscribed information content is generated, updated, or deleted.

[0158] Of course, the above is only an example to illustrate the interactive messages, and the specific implementation is not limited to the above example.

[0159] In some embodiments, SBA domain security is a security mechanism, security requirement, or security policy proposed for SBA, and is mainly used for communication security protection of NFs within the SBA domain.

[0160] In some embodiments, SBA domain security involves the Application Programming Interface (API) for information exchange between NFs, and the use of the API needs to be securely protected.

[0161] In other embodiments, the protocols involved in SBA domain security may include, but are not limited to, web protocols. For example, these web protocols may include, but are not limited to, HyperText Transfer Protocol (HTTP) and / or JavaScript Object Notation (JSON) communication protocols.

[0162] In some embodiments, SBA domain security relies on the use of a Public Key Infrastructure (PKI) within the network. In a PKI, a Certificate Authority (CA) can issue a certificate to each communication endpoint based on (identity) management functions and policies. The public and private key pairs associated with the certificates can then be used for asymmetric encryption, authentication, and signature verification between communicating parties. These communication endpoints can include, but are not limited to, various network devices.

[0163] In some embodiments, SBA domain security can enable NFs to communicate securely within the service domain or between NFs outside other domains. These secure communications may involve registration, discovery, and authorization of network functions, and may also include the secure use of SBI.

[0164] In some embodiments, supporting SBA domain security when a first NF communicates with a second NF may include:

[0165] When the first condition is met, the first NF supports SBA domain security when communicating with the second NF.

[0166] Furthermore, when the first condition is met, supporting SBA domain security when the first NF communicates with the second NF may include at least one of the following:

[0167] The first NF communicates with the second NF based on a service-based architecture interface (SBI), and the first NF supports service-based architecture (SBA) domain security when communicating with the second NF, and / or

[0168] The first NF supports both transport layer and service layer functions, and supports service-based architecture (SBA) domain security when communicating with the second NF, and / or

[0169] The first NF is an AN node of the SBA, and the first NF supports the service-based architecture (SBA) domain security when communicating with the second NF, and / or

[0170] The second NF supports both transport layer and service layer functions, and the first NF supports service-based architecture (SBA) domain security when communicating with the second NF, and / or

[0171] The second NF supports both transport layer and home layer functions, and the first NF supports service-based architecture (SBA) domain security when communicating with the second NF, and / or

[0172] The second NF is the AN node of the SBA, and the first NF supports the service-oriented architecture SBA domain security when communicating with the second NF.

[0173] In some embodiments, if the first NF is the NF of the 3GPP AN shown in FIG. 1D , it may also be considered to meet the first condition.

[0174] In some embodiments, when the first NF and the second NF communicate without satisfying the first condition, SBA domain security does not need to be observed. For example, when the first NF and the second NF communicate without satisfying the first condition and the first NF and the second NF communicate using an interface in the network domain, network domain security may be observed.

[0175] Exemplarily, when the first NF and the AMF of the home PLMN communicate through the N2 interface, network domain security can be complied with.

[0176] As another example, when the first NF and the UPF of the home PLMN communicate through the N3 interface, network domain security can be complied with.

[0177] Exemplarily, compliance with network domain security may include: performing security protection based on subscriber identities and security data. The subscriber identity may include, but is not limited to, a Subscription Permanent Identifier (SUPI). The security data may include a security context. The security context may include, but is not limited to, a fifth generation mobile communication (5G) context. The security context may include keys, parameters related to key updates, and / or security algorithms.

[0178] In some embodiments, after the terminal is switched from the source NF to the target NF, the target NF needs to delete the security data of the terminal.

[0179] In other embodiments, the target NF may request the terminal's security context from the source NF. The source NF and target NF may include, but are not limited to, an AN NF and / or a CN NF. The AN NF may include, but is not limited to, a base station. The CN NF may include, but is not limited to, an AMF, SMF, and / or UPF.

[0180] In some embodiments, the second NF includes at least one of the following:

[0181] Core network CN NF of the service network;

[0182] CN NF of the home network;

[0183] AN NF of the service network.

[0184] The serving network here may be the current serving network of the terminal. The serving network of the terminal may include a home network and / or a visited network.

[0185] For example, the terminal accesses the current service network and obtains communication services in the current service network.

[0186] In some embodiments, the first NF needs to support SBA domain security when communicating with the CN NF of the home location and / or the visited location.

[0187] In other embodiments, the first NF needs to support SBA domain security when communicating with other AN NFs in the home or visited locations.

[0188] In some embodiments, the first NF may be an AN NF to which the terminal is currently connected.

[0189] In some embodiments, the first NF may be the current serving base station of the terminal or the target base station for cell change. Cell change here includes but is not limited to cell handover and / or cell reselection.

[0190] In some embodiments, the first NF of the AN supports SBA domain security when communicating with a PCF, NRF, AUSF, UDM, and / or UDR in the home network. The PCF, NRF, AUSF, UDM, and / or UDR may be from the home network.

[0191] In other embodiments, the first NF of the AN supports SBA domain security when communicating with the AMF, SMF, LMF and / or UPF in the service network.

[0192] In some embodiments, the serving network and the home network are different, which indicates that the serving network and the home network correspond to different Public Land Mobile Networks (PLMNs).

[0193] In some embodiments, the service network and the home network of the terminal belong to different administrative regions, or the service network and the home network of the terminal belong to networks of different operators in the same administrative region.

[0194] In some embodiments, if both the first and second NFs are AN NFs, they can support SBA domain security when communicating across networks via an SBA Security Edge Protection Proxy (SEPP). For example, a first NF in a home network and a second NF in a service network can support SBA domain security when communicating via SEPP. For another example, a first NF in a service network and a second NF in a home network can support SBA domain security when communicating via SEPP.

[0195] In some embodiments, SEPP is a NF that provides security protection for communications between different PLMNs.

[0196] In some embodiments, SEPP supports SBA domain security and can protect at least signaling transmission of the control plane based on the SBA domain security.

[0197] Exemplarily, when the first NF and the second NF are both different AN NFs, the context of the terminal may be transferred through SEPP, and SBA needs to be supported when transferring the context of the terminal.

[0198] In some embodiments, SBA domain security is established based on network domain security.

[0199] In some embodiments, SBA domain security is established based on network domain security, which means that SBA domain security includes network domain security, that is, network domain security is observed when complying with SBA domain security.

[0200] In some embodiments, since SBA domain security is established based on network domain security, the security of SBA domain security must be equal to or higher than the security of network domain security.

[0201] In some embodiments, supporting service-based architecture (SBA) domain security when a first network function NF of an access network AN communicates with a second NF includes at least one of the following:

[0202] Support identity authentication when the first NF communicates with the second NF;

[0203] Support transmission protection when the first NF communicates with the second NF;

[0204] Support authorization of service requests when the first NF communicates with the second NF;

[0205] When the first NF communicates with the second NF, the terminal's network access is protected through SBA domain security.

[0206] In some embodiments, SAB security may involve at least one of the following aspects:

[0207] Identity authentication for communication between NFs;

[0208] Transmission protection;

[0209] Authorization of service requests;

[0210] Terminal network access protection.

[0211] In some embodiments, identity authentication is to authenticate the legal identity of the network function NF.

[0212] For example, before a first NF and a second NF communicate, they first authenticate each other. Only after both parties have authenticated each other can they transmit target information. This target information may include signaling and / or service data, which is data that needs to be exchanged between the first NF and the second NF.

[0213] In some embodiments, the target information is transmitted after the first and second NFs complete identity authentication. During the transmission of the target information, various security algorithms can be used to protect the target information. For example, confidentiality protection, integrity verification, and / or replay protection can be used to protect the transmitted target information.

[0214] In some embodiments, if any of the first NF, the second NF, and / or the terminal needs to obtain a service, authorization for obtaining the service is required. Only if authorization is obtained can the service be obtained or used. For example, the service may include, but is not limited to, location-based services. If authorization is not obtained, the first NF, the second NF, and / or the terminal may reject the corresponding service request.

[0215] In some embodiments, when a terminal accesses an SBA, SBA domain security needs to be used to protect the terminal's network access.

[0216] In some embodiments, the network access of the terminal may include: initial access of the terminal and / or access update of the terminal.

[0217] In some embodiments, supporting transmission protection when the first NF and the second NF communicate includes: supporting confidentiality protection, integrity verification and / or replay protection when the first NF and the second NF communicate.

[0218] In some embodiments, confidentiality protection is a property that aims to prevent the disclosure of transmitted information to unauthorized users.

[0219] Confidentiality protection can be achieved through technologies such as information encryption, identity authentication, access control, and secure communication protocols. Information encryption and decoding are the most basic means to prevent illegal information leakage, so that the transmitted information can only be obtained and / or used by authorized parties.

[0220] In some embodiments, integrity protection is intended to ensure that information is not damaged or modified, lost, or altered without authorization during transmission, exchange, storage, or processing. Integrity protection may involve integrity checks based on Message Integrity Check (MIC) codes and / or signature verification based on digital signatures.

[0221] In some embodiments, replay protection is intended to defend against replay attacks. Replay attacks may use the message content of a previously transmitted legitimate message to launch an attack. In this case, replay protection can be achieved by introducing a counter or a fresh value to update the key.

[0222] Of course, the above is only an example of the SBA domain security between the first NF and the second NF, and the specific implementation is not limited to the above example.

[0223] S2102: The second NF supports SBA domain security when communicating with the first NF of the AN.

[0224] In some embodiments, when the second condition is met, the second NF supports SBA domain security when communicating with the first NF of the AN.

[0225] In some embodiments, when the second condition is met, the second NF supports SBA domain security when communicating with the first NF of the AN, which may include but is not limited to at least one of the following:

[0226] The second NF communicates with the first NF based on the service-based architecture interface SBI, and supports service-based architecture SBA domain security when communicating with the first NF, and / or

[0227] The first NF supports both transport layer and service layer functions, and the second NF supports service-based architecture (SBA) domain security when communicating with the first NF, and / or

[0228] The first NF is an AN node that supports SBA, and the second NF supports service-based architecture (SBA) domain security when communicating with the first NF, and / or,

[0229] The second NF supports both transport layer and home layer functions, and the first NF supports service-based architecture (SBA) domain security when communicating with the second NF, and / or

[0230] The second NF supports both transport layer and service layer functions, and the first NF supports service-based architecture (SBA) domain security when communicating with the second NF, and / or

[0231] The second NF is an AN node that supports SBA, and supports service-based architecture SBA domain security when communicating with the first NF.

[0232] In some embodiments, the first NF and / or the second NF belongs to the network architecture shown in FIG. 1D and may also be considered to meet the second condition.

[0233] In some embodiments, if the second NF does not meet the second condition when communicating with the first NF, then there is no need to support (or comply with / obey) SBA domain security. For example, if the second NF does not meet the second condition of complying with SBA domain security when communicating with the first NF, but complies with the condition of complying with network domain security, then the second NF supports, complies with, or obeys network domain security.

[0234] For the relevant description of SBA domain security here, please refer to the relevant explanation of step S2101.

[0235] In some embodiments, SBA domain security is established based on network domain security.

[0236] In some embodiments, SBA domain security is established based on network domain security, which means that SBA domain security includes network domain security, that is, network domain security is observed when complying with SBA domain security.

[0237] In some embodiments, since SBA domain security is established based on network domain security, the security of SBA domain security must be equal to or higher than the security of network domain security.

[0238] As shown in FIG3 , an embodiment of the present disclosure provides a communication security protection method, which is performed by a first NF of an AN. The method may include:

[0239] S3101: The first NF of the network AN supports SBA domain security when communicating.

[0240] In some embodiments, a first NF of an AN supports SBA domain security when communicating with a second NF.

[0241] In some embodiments, an optional embodiment of S3101 may refer to S2101 of the corresponding embodiment of FIG. 2 .

[0242] Exemplarily, when the first condition is met, the first NF supports SBA domain security when communicating with the second NF.

[0243] Specifically, the second NF supports service-based architecture (SBA) domain security when communicating with the first NF based on the service-based architecture interface (SBI), and / or

[0244] The first NF supports both transport layer and service layer functions, and the second NF supports service-based architecture (SBA) domain security when communicating with the first NF, and / or

[0245] The first NF is an AN node that supports SBA, and the second NF supports service-based architecture (SBA) domain security when communicating with the first NF, and / or,

[0246] The second NF supports both transport layer and home layer functions, and the first NF supports service-based architecture (SBA) domain security when communicating with the second NF, and / or

[0247] The second NF supports both transport layer and service layer functions, and the first NF supports service-based architecture (SBA) domain security when communicating with the second NF, and / or

[0248] The second NF is an AN node that supports SBA, and supports service-based architecture SBA domain security when communicating with the first NF.

[0249] In some embodiments, the second NF includes at least one of the following:

[0250] Core network CN NF of the service network;

[0251] CN NF of the home network;

[0252] AN NF of the service network.

[0253] In some embodiments, the second NF may be the PCF, NRF, AUSF, UDM and / or UDR of the home network. In some embodiments, the second NF may be the AMF, SMF, LMF and / or UPF of the service network.

[0254] In some embodiments, the second NF may be located in the same PLMN as the first NF, or in a different PLMN.

[0255] In some embodiments, SBA domain security is established based on network domain security, and / or SBA domain security is established based on network access security.

[0256] In some embodiments, SBA domain security is established based on network domain security.

[0257] In some embodiments, SBA domain security is established based on network domain security, which means that SBA domain security includes network domain security, that is, network domain security is observed when complying with SBA domain security.

[0258] In some embodiments, since SBA domain security is established based on network domain security, the security of SBA domain security must be equal to or higher than the security of network domain security.

[0259] In some embodiments, supporting service-based architecture (SBA) domain security when a first network function NF of an access network AN communicates with a second NF includes at least one of the following:

[0260] Support identity authentication when the first NF communicates with the second NF;

[0261] Support transmission protection when the first NF communicates with the second NF;

[0262] Support authorization of service requests when the first NF communicates with the second NF;

[0263] When the first NF communicates with the second NF, the terminal's network access is protected through SBA domain security.

[0264] In some embodiments, supporting transmission protection when a first NF and a second NF communicate includes:

[0265] The first NF and the second NF support confidentiality protection, integrity verification and / or replay protection when communicating.

[0266] As shown in FIG4 , an embodiment of the present disclosure provides a communication security protection method, which is executed by a second NF. The method may include:

[0267] S4101: The second NF supports the service-based architecture (SBA) domain security when communicating with the first NF.

[0268] In some embodiments, the second NF supports SBA domain security when communicating with the first NF of the AN.

[0269] In some embodiments, when the second condition is met, the second NF supports SBA domain security when communicating with the first NF of the AN.

[0270] Specifically, the second NF supports service-based architecture (SBA) domain security when communicating with the first NF based on the service-based architecture interface (SBI), and / or

[0271] The first NF supports both transport layer and service layer functions, and the second NF supports service-based architecture (SBA) domain security when communicating with the first NF, and / or

[0272] The first NF is an AN node that supports SBA, and the second NF supports service-based architecture (SBA) domain security when communicating with the first NF, and / or,

[0273] The second NF supports both transport layer and service layer functions, and the first NF supports service-based architecture (SBA) domain security when communicating with the second NF, and / or

[0274] The second NF supports the functions of the transport layer, the service layer, and the home layer simultaneously, and the first NF supports the service-based architecture (SBA) domain security when communicating with the second NF, and / or

[0275] The second NF is an AN node that supports SBA, and supports service-based architecture SBA domain security when communicating with the first NF.

[0276] In some embodiments, when the second NF communicates with the first NF, the second condition is not met and SBA domain security does not need to be supported. For example, when the second NF communicates with the first NF, the second condition is not met but the condition corresponding to network domain security is met, then network domain security is supported.

[0277] The second condition here may be a condition of complying with SBA domain security.

[0278] In some embodiments, SBA domain security is established based on network domain security.

[0279] In some embodiments, SBA domain security is established based on network domain security, which means that SBA domain security includes network domain security, that is, network domain security is observed when complying with SBA domain security.

[0280] In some embodiments, since SBA domain security is established based on network domain security, the security of SBA domain security must be equal to or higher than the security of network domain security.

[0281] In some embodiments, the second network function NF supports at least one of the following service-based architecture (SBA) domain security when communicating with the first NF of the access network AN:

[0282] The second NF supports identity authentication when communicating with the first NF;

[0283] The second NF supports transmission protection when communicating with the first NF;

[0284] The second NF supports authorization of the service request when communicating with the first NF.

[0285] In some embodiments, supporting transmission protection when the second NF communicates with the first NF includes:

[0286] The first NF and the second NF support confidentiality protection, integrity verification and / or replay protection when communicating.

[0287] Dependencies between multiple network functions (NFs) can lead to unnecessary complexity and even delays. Network functions can be redesigned to reduce the number of dependencies and processing points. For example, new network architectures enhance the possibility of direct signaling between NFs to eliminate potential bottlenecks. Today, many services require information to be transferred from one NG-RAN node to another via the fifth-generation core network (5GC). 5GC transfers information between different RAN nodes via the AMF. To simplify this transmission, the introduction of the SBI will allow this information to be exchanged directly between NG-RAN NFs, enabling information exchange between NFs from different RANs without going through the AMF.

[0288] If the RAN is incorporated into a service-oriented architecture, its NFs can function as message producers and consumers within the service-oriented architecture. This allows information to be exchanged between RAN NFs and with NFs other than the AMF and UPF. Currently, securing only the communications between the RAN and the AMF, and between the RAN and the UPF, is insufficient. If the service-oriented RAN requires direct interaction with other NFs (such as the SMF, PCF, and LMF), the interfaces between these NFs also require security protection.

[0289] The following is an introduction to the security architecture:

[0290] Network Access Security (I): Network access security defines a set of security features that enable terminals to securely authenticate and access the network. Terminal access can include both 3GPP and non-3GPP access, depending on the access network, to protect the (wireless) interface from attacks. Non-3GPP access includes, but is not limited to, Wi-Fi access. Network access security involves the SN communicating security context to the AN to ensure access security.

[0291] Network Domain Security (II): defines a set of security features that enable NFs to securely exchange signaling data and user plane data.

[0292] User Domain Security (III): defines a set of security features to protect user access to mobile devices.

[0293] Application Domain Security (IV): This defines a set of security features that enable applications in the user domain and the provider domain to securely exchange messages. SBA Domain Security (V): This defines a set of security features that enable SBA network functions to securely communicate within the service network domain and between other network domains. These security features may address aspects such as network function registration, discovery, and authorization, as well as SBI-based protection.

[0294] In the five security domains described above, when RAN nodes have transport layer functions, they may need to support network access security (I) and network domain security (II). When RAN nodes can act as message producers or consumers, the RAN node's functions no longer solely serve the transport layer but also include service layer functions. RAN nodes (also known as AN NFs) need to interact with NFs in the service network and may even need to interact with NFs in the terminal's home network. To protect the interaction between NFs in the service network and the home network, service-based RAN nodes need to support SBA domain security (V), namely:

[0295] "V" is required between service-based RAN nodes and NFs in the service network (such as AMF, SMF, LMF, UPF).

[0296] "V" is required between service-based RAN nodes and NFs in the home network (such as PCF, NRF, AUSF, UDM / UDR).

[0297] “V” may require communication between RAN nodes in different service networks via SEPP.

[0298] As shown in Figure 1D, in the enhanced security architecture, the 3GPP AN's NFs extend to the service and transport layers, while the non-3GPP AN remains in the transport layer. The 3GPP AN portion in the service layer interacts with NFs in the home network or a serving network protected by SBA domain security. The NFs in the serving network can also be another 3GPP AN node in the same serving network or a 3GPP AN node in another serving network.

[0299] The 3GPP AN is integrated into the service network (SN), spanning the service and transport layers, rather than remaining within the transport layer. The 3GPP AN portion of the service layer interacts with NFs in the home network or a service network protected by SBA domain security (V*). The NFs in the service network can also be another 3GPP AN node in the same service network or a 3GPP AN node in another service network. "I*" represents network access security between the terminal and the service network (CN) NFs, as well as between the terminal and the service network (AN) NFs.

[0300] V* stands for enhanced (or newly added) SBA domain security.

[0301] The 3GPP AN NF may be the AN NF of the terminal's home network or the AN NF of the serving network. The 3GPP AN NF may have at least one of the following capabilities:

[0302] 3GPP AN NF shall support SBA domain security when interacting with CN NFs of the serving network.

[0303] 3GPP AN NF shall support SBA domain security when interacting with CN NFs in the home network.

[0304] 3GPP AN NF and another 3GPP AN NF in the same service network should be able to support SBA domain security.

[0305] When a 3GPP AN NF interacts with a 3GPP AN NF in another serving network, the 3GPP AN NF shall be able to support SBA domain security.

[0306] 3GPP AN NF shall be able to use SBA domain security when communicating with CN NFs in the serving network and / or home network or other 3GPP AN NFs in the serving network on the basis of network domain security.

[0307] 3GPP AN NF should be able to use SBA domain security to achieve network access security with CN NFs in the serving network / home network.

[0308] The NF for CN may have the following capabilities, including but not limited to: when the CN NF interacts with the 3GPP AN NF in the service network, it should support SBA domain security.

[0309] In the embodiments of the present disclosure, some or all of the steps and their optional implementations may be arbitrarily combined with some or all of the steps in other embodiments, or may be arbitrarily combined with the optional implementations of other embodiments.

[0310] In the embodiments of the present disclosure, some or all of the steps and their optional implementations may be arbitrarily combined with some or all of the steps in other embodiments, or may be arbitrarily combined with the optional implementations of other embodiments.

[0311] The embodiments of the present disclosure also provide an apparatus for implementing any of the above methods. For example, an apparatus is provided, comprising units or modules for implementing each step performed by a terminal in any of the above methods. For another example, another apparatus is provided, comprising units or modules for implementing each step performed by a network device (e.g., an access network device or a core network device) in any of the above methods.

[0312] It should be understood that the division of the various units or modules in the above devices is merely a division of logical functions. In actual implementation, they may be fully or partially integrated into a physical entity, or they may be physically separated. In addition, the units or modules in the device may be implemented in the form of a processor calling software: for example, the device includes a processor, the processor is connected to a memory, and the memory stores instructions. The processor calls the instructions stored in the memory to implement any of the above methods or implement the functions of the various units or modules of the above devices, wherein the processor is, for example, a general-purpose processor, such as a central processing unit (CPU) or a microprocessor, and the memory is a memory within the device or a memory outside the device. Alternatively, the units or modules in the device can be implemented in the form of hardware circuits, and the functions of some or all of the units or modules can be realized by designing the hardware circuits. The above-mentioned hardware circuits can be understood as one or more processors; for example, in one implementation, the above-mentioned hardware circuit is an application-specific integrated circuit (ASIC), which realizes the functions of some or all of the above units or modules by designing the logical relationship of the components in the circuit; for example, in another implementation, the above-mentioned hardware circuit can be realized by a programmable logic device (PLD). Taking a field programmable gate array (FPGA) as an example, it can include a large number of logic gate circuits, and the connection relationship between the logic gate circuits is configured by configuring the configuration file, thereby realizing the functions of some or all of the above units or modules. All units or modules of the above devices can be realized in the form of software called by the processor, or in the form of hardware circuits, or in part by the form of software called by the processor, and the rest by hardware circuits.

[0313] In the embodiments of the present disclosure, a processor is a circuit with signal processing capabilities. In one implementation, the processor can be a circuit with instruction reading and execution capabilities, such as a central processing unit (CPU), a microprocessor, a graphics processing unit (GPU) (which can be understood as a microprocessor), or a digital signal processor (DSP). In another implementation, the processor can implement certain functions through the logical relationship of a hardware circuit. The logical relationship of the above-mentioned hardware circuit is fixed or reconfigurable. For example, the processor is a hardware circuit implemented by an application-specific integrated circuit (ASIC) or a programmable logic device (PLD), such as an FPGA. In a reconfigurable hardware circuit, the process of the processor loading a configuration document to implement the hardware circuit configuration can be understood as the process of the processor loading instructions to implement the functions of some or all of the above units or modules. In addition, it can also be a hardware circuit designed for artificial intelligence, which can be understood as an ASIC, such as a neural network processing unit (NPU), a tensor processing unit (TPU), a deep learning processing unit (DPU), etc.

[0314] FIG5 is a first NF of an access network AN provided by an embodiment of the present disclosure, which includes:

[0315] The processing module 110 is configured to support service-based architecture (SBA) domain security when communicating with the second NF.

[0316] In some embodiments, the first NF of the AF further includes a receiving module and / or a sending module.

[0317] In some embodiments, the receiving module and / or the sending module may correspond to specific structures such as an antenna or a network interface of the terminal.

[0318] It is worth noting that the processing module of the NF of the AN can perform any steps related to information processing in the communication security protection method performed by the NF of the AN. The receiving module can be used for any steps related to reception in the communication security protection method performed by the NF of the AN. The sending module can be used for any steps related to sending in the communication security protection method performed by the terminal.

[0319] In some embodiments, the processing module is configured so that the first NF communicates with the second NF based on the service-based architecture interface SBI, and the first NF supports the service-based architecture SBA domain security when communicating with the second NF, or the first NF supports the functions of the transport layer and the service layer at the same time, and the first NF supports the service-based architecture SBA domain security when communicating with the second NF, or the first NF is an AN node of the SBA, and the first NF supports the service-based architecture SBA domain security when communicating with the second NF, or the second NF supports the functions of the transport layer and the service layer at the same time, and the first NF supports the service-based architecture SBA domain security when communicating with the second NF, or the second NF supports the functions of the transport layer and the home layer at the same time, and the first NF supports the service-based architecture SBA domain security when communicating with the second NF, or the second NF is an AN node of the SBA, and the first NF supports the service-based architecture SBA domain security when communicating with the second NF.

[0320] In some embodiments, the second NF includes at least one of the following:

[0321] Core network CN NF of the service network;

[0322] CN NF of the home network;

[0323] AN NF of the service network.

[0324] In some embodiments, SBA domain security is established based on network domain security.

[0325] In some embodiments, the processing module is configured to perform at least one of the following:

[0326] Support identity authentication when the first NF communicates with the second NF;

[0327] Support transmission protection when the first NF communicates with the second NF;

[0328] Support authorization of service requests when the first NF communicates with the second NF;

[0329] When the first NF communicates with the second NF, the terminal network access is protected through SBA domain security.

[0330] In some embodiments, supporting transmission protection when the first NF and the second NF communicate includes: supporting confidentiality protection, integrity verification and / or replay protection when the first NF and the second NF communicate.

[0331] FIG6 is a schematic diagram of the structure of a second NF provided by an embodiment of the present disclosure. As shown in FIG7B , the second NF includes:

[0332] The processing module 120 is configured to support service-based architecture (SBA) domain security when the second NF communicates with the first NF of the access network AN.

[0333] In some embodiments, the second NF further includes a receiving module and / or a sending module.

[0334] In some embodiments, the receiving module and / or the sending module may correspond to specific structures such as an antenna or a network interface of the terminal.

[0335] It is worth noting that the processing module of the second NF can execute any steps related to information processing in the communication security protection method executed by the second NF. The receiving module can be used for any steps related to reception in the communication security protection method executed by the second NF. The sending module can be used for any steps related to sending in the communication security protection method executed by the terminal.

[0336] In some embodiments, the processing module is configured to perform at least one of the following:

[0337] The second NF communicates with the first NF based on the service-based architecture interface SBI, and supports service-based architecture SBA domain security when communicating with the first NF, and / or

[0338] The first NF supports both transport layer and service layer functions, and the second NF supports service-based architecture (SBA) domain security when communicating with the first NF, and / or

[0339] The first NF is an AN node that supports SBA, and the second NF supports service-based architecture (SBA) domain security when communicating with the first NF, and / or,

[0340] The second NF supports both transport layer and home layer functions, and the first NF supports service-based architecture (SBA) domain security when communicating with the second NF, and / or

[0341] The second NF supports both transport layer and service layer functions, and the first NF supports service-based architecture (SBA) domain security when communicating with the second NF, and / or

[0342] The second NF is an AN node that supports SBA, and supports service-based architecture SBA domain security when communicating with the first NF.

[0343] In some embodiments, SBA domain security is established based on network domain security.

[0344] In some embodiments, the processing module is configured to perform at least one of the following:

[0345] The second NF supports identity authentication when communicating with the first NF;

[0346] The second NF supports transmission protection when communicating with the first NF;

[0347] The second NF supports authorization of service requests when communicating with the first NF;

[0348] When the second NF communicates with the first NF, the terminal network access is protected through SBA domain security.

[0349] In some embodiments, supporting transmission protection when the second NF communicates with the first NF includes:

[0350] The first NF and the second NF support confidentiality protection, integrity verification and / or replay protection when communicating.

[0351] The present disclosure provides a communication security protection method, which may include:

[0352] The first NF of the AN can execute any of the communication security protection methods provided by the technical solutions executed by the first NF of the AN.

[0353] The second NF may execute any one of the aforementioned communication security protection methods provided by the technical solutions executed by the second NF.

[0354] An embodiment of the present disclosure also provides a communication device, which may include: one or more processors; wherein the processor is used to call instructions to enable the communication device to execute a communication security protection method that can be implemented in any of the aforementioned embodiments.

[0355] The communication device may include a network device. Exemplarily, the communication device may be the first NF and / or the second NF of the aforementioned AN.

[0356] 7A and / or 7B , the communication device 8100 further includes one or more memories 8102 for storing instructions. Alternatively, all or part of the memories 8102 may be located outside the communication device 8100.

[0357] The communication device may be the aforementioned terminal and network device. In some embodiments, the network device may be a master node and / or an auxiliary node.

[0358] In some embodiments, the communication device 8100 further includes one or more transceivers 8103. When the communication device 8100 includes one or more transceivers 8103, the communication steps such as sending and receiving in the above method are performed by the transceiver 8103, and the other steps are performed by the processor 8101.

[0359] In some embodiments, a transceiver may include a receiver and a transmitter, which may be separate or integrated. Optionally, the terms transceiver, transceiver unit, transceiver, and transceiver circuit may be used interchangeably; the terms transmitter, transmitting unit, transmitter, and transmitting circuit may be used interchangeably; and the terms receiver, receiving unit, receiver, and receiving circuit may be used interchangeably.

[0360] Optionally, the communication device 8100 further includes one or more interface circuits 8104, which are connected to the memory 8102. The interface circuits 8104 can be used to receive signals from the memory 8102 or other devices, and can be used to send signals to the memory 8102 or other devices. For example, the interface circuits 8104 can read instructions stored in the memory 8102 and send the instructions to the processor 8101.

[0361] The communication device 8100 described in the above embodiment may be a network device or a terminal, but the scope of the communication device 8100 described in the present disclosure is not limited thereto, and the structure of the communication device 8100 may not be limited by FIG. 7A. The communication device may be an independent device or may be part of a larger device. For example, the communication device may be: (1) an independent integrated circuit IC, or a chip, or a chip system or subsystem; (2) a collection of one or more ICs, optionally, the above IC collection may also include a storage component for storing data and programs; (3) an ASIC, such as a modem; (4) a module that can be embedded in other devices; (5) a receiver, a terminal device, an intelligent terminal device, a cellular phone, a wireless device, a handheld device, a mobile unit, an in-vehicle device, a network device, a cloud device, an artificial intelligence device, etc.; (6) others, etc.

[0362] 7B is a schematic diagram of the structure of a chip 8200 provided in an embodiment of the present disclosure. If the communication device 8100 can be a chip or a chip system, please refer to the schematic diagram of the structure of the chip 8200 shown in FIG7B , but the present disclosure is not limited thereto.

[0363] The chip 8200 includes one or more processors 8201, and the processor 8201 is used to call instructions to enable the chip 8200 to execute any of the above communication security protection methods.

[0364] In some embodiments, chip 8200 further includes one or more interface circuits 8202, which are connected to memory 8203. Interface circuit 8202 can be used to receive signals from memory 8203 or other devices, and can be used to send signals to memory 8203 or other devices. For example, interface circuit 8202 can read instructions stored in memory 8203 and send the instructions to processor 8201. Optionally, the terms interface circuit, interface, transceiver pin, and transceiver are interchangeable.

[0365] In some embodiments, the chip 8200 further includes one or more memories 8203 for storing instructions. Alternatively, all or part of the memories 8203 may be outside the chip 8200.

[0366] The present disclosure also provides a storage medium having instructions stored thereon, which, when executed on the communication device 8100, causes the communication device 8100 to execute any of the above methods. Optionally, the storage medium is an electronic storage medium. Optionally, the storage medium is a computer-readable storage medium, but may also be a storage medium readable by other devices. Optionally, the storage medium may be a non-transitory storage medium, but may also be a transient storage medium.

[0367] The present disclosure further provides a program product, which, when executed by the communication device 8100, enables the communication device 8100 to perform any of the above communication security protection methods. Optionally, the program product is a computer program product.

[0368] The present disclosure also provides a computer program, which, when executed on a computer, enables the computer to execute any one of the above communication security protection methods.

[0369] Other embodiments of the present invention will readily occur to those skilled in the art after considering the specification and practicing the invention disclosed herein. This disclosure is intended to cover any variations, uses, or adaptations of the invention that follow from the general principles of the invention and include common knowledge or customary techniques in the art not disclosed herein. The description and examples are to be considered as exemplary only, with the true scope and spirit of the invention being indicated by the following claims.

[0370] It should be understood that the present invention is not limited to the exact construction described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present invention is limited only by the appended claims.

Claims

1. A communication security protection method, wherein: include: The first network function NF of the access network AN supports the service-based architecture SBA domain security when communicating with the second NF.

2. The method according to claim 1, wherein: The first network function NF of the access network AN supports service-based architecture SBA domain security when communicating with the second NF, including: The first NF communicates with the second NF based on a service-based architecture interface SBI, and the first NF supports service-based architecture SBA domain security when communicating with the second NF, and / or, The first NF supports the functions of the transport layer and the service layer at the same time, the first NF supports the service-based architecture (SBA) domain security when communicating with the second NF, and / or, The first NF is an AN node of the SBA, and the first NF supports service-based architecture SBA domain security when communicating with the second NF, and / or, The second NF supports the functions of the transport layer and the service layer at the same time, the first NF supports the service-based architecture (SBA) domain security when communicating with the second NF, and / or, The second NF supports the functions of the transport layer and the home layer at the same time, the first NF supports the service-based architecture (SBA) domain security when communicating with the second NF, and / or, The second NF is an AN node of the SBA, and the first NF supports the service-oriented architecture SBA domain security when communicating with the second NF.

3. The method according to claim 1 or 2, wherein: The second NF includes at least one of the following: The core network CN NF of the service network; CN NF of the home network; AN NF of the service network.

4. According to the method according to any one of claims 1 to 3, the SBA domain security is established based on network domain security.

5. The method according to any one of claims 1 to 4, wherein: The first network function NF of the access network AN supports the service-based architecture SBA domain security when communicating with the second NF, including at least one of the following: The first NF supports identity authentication when communicating with the second NF; The first NF supports transmission protection when communicating with the second NF; The first NF supports authorization of the service request when communicating with the second NF; When the first NF communicates with the second NF, terminal network access is protected through SBA domain security.

6. The method according to claim 5, wherein: The first NF and the second NF supporting transmission protection when communicating include: The first NF and the second NF support confidentiality protection, integrity verification and / or replay protection when communicating.

7. A communication security protection method, wherein: include: The second network function NF supports the service-based architecture SBA domain security when communicating with the first NF of the access network AN.

8. The method according to claim 7, wherein: The second network function NF supports service-based architecture SBA domain security when communicating with the first NF of the access network AN, including: The second NF communicates with the first NF based on a service-based architecture interface SBI, and the second NF supports service-based architecture SBA domain security when communicating with the first NF, and / or The first NF supports the functions of the transport layer and the service layer at the same time, the second NF supports the service-based architecture (SBA) domain security when communicating with the first NF, and / or The first NF is an AN node supporting SBA, the second NF supports service-based architecture SBA domain security when communicating with the first NF, and / or, The second NF supports the functions of the transport layer and the home layer at the same time, the first NF supports the service-based architecture (SBA) domain security when communicating with the second NF, and / or, The second NF supports the functions of the transport layer and the service layer at the same time, the first NF supports the service-based architecture (SBA) domain security when communicating with the second NF, and / or, The second NF is an AN node supporting SBA, and the second NF supports service-based architecture SBA domain security when communicating with the first NF.

9. The method according to claim 7 or 8, wherein: The SBA domain security is established based on the network domain security.

10. The method according to any one of claims 7 to 9, wherein: The second network function NF supports at least one of the following service-based architecture SBA domain security when communicating with the first NF of the access network AN: The second NF supports identity authentication when communicating with the first NF; The second NF supports transmission protection when communicating with the first NF; The second NF supports authorization of the service request when communicating with the first NF; When the second NF communicates with the first NF, terminal network access is protected through SBA domain security.

11. The method according to claim 10, wherein: The second NF supporting transmission protection when communicating with the first NF includes: The first NF and the second NF support confidentiality protection, integrity verification and / or replay protection when communicating.

12. A first network function NF of an access network AN, wherein: include: The processing module is configured to support service-based architecture (SBA) domain security when communicating with the second NF.

13. A second network function NF, wherein: include: The processing module is configured to support service-based architecture SBA domain security when communicating with a first NF of an access network AN.

14. A communication device, wherein: The communication device comprises: one or more processors; The processor is used to call instructions so that the communication device executes the communication security protection method described in any one of claims 1 to 6 and / or claims 7 to 11.

15. A storage medium, wherein: The storage medium stores instructions, and when the instructions are executed on the communication device, the communication device executes the communication security protection method described in any one of claims 1 to 6 and / or claims 7 to 11.

Images