Communication method and apparatus

Abstract

A communication method and apparatus. The method comprises: a source base station sends a handover request message to a candidate base station to request the configuration of a candidate cell; and the candidate base station acquires, on the basis of the handover request message, key information from a core network device, and sends to the source base station the key information and the configuration of the candidate cell. Alternatively, the source base station derives a security key for the candidate base station, and sends the security key to the candidate base station. By using the described method, key information can be respectively maintained by candidate base stations, thus avoiding security problems of inter-gNB LTM; or key information can also be maintained by the source base station, so that a security key is derived for a candidate base station, thus avoiding security problems of inter-gNB LTM.

Description

Communication method and device

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims priority to the Chinese patent application filed with the State Intellectual Property Office of the People's Republic of China on September 28, 2023, with application number 202311290477.3 and invention name "A Communication Method and Device", the entire contents of which are incorporated by reference into this application. Technical Field

[0003] The present application relates to the field of communication technology, and in particular to a communication method and device. Background Art

[0004] Cell handover is a very important feature in communication systems. It is triggered by the movement of the terminal when the terminal is in a radio resource control (RRC) connected state. It switches the terminal to a neighboring cell with better signal quality before the signal quality of the serving cell becomes unavailable for communication, thereby providing continuous and uninterrupted communication services.

[0005] There are two types of cell handovers: one is based on layer 1 / layer 2, which can be called layer 1 / layer 2 handover or layer 1 / layer 2 triggered mobility (L1 / L2 triggered mobility, LTM); the other is based on layer 3, which can be called layer 3 handover (L3 handover).

[0006] Currently, LTM allows terminals to switch cells within the same base station, a feature known as intra-gNB LTM. However, further research is needed to enable terminals to switch cells between different base stations, a feature known as inter-gNB LTM.

[0007] Summary of the Invention

[0008] The present application provides a communication method and apparatus for supporting inter-gNB LTM.

[0009] In the first aspect, an embodiment of the present application provides a communication method, which is applied to a second access network device (such as a candidate base station) or a module (such as a chip or circuit) in the second access network device. Taking the application of this method to the second access network device as an example, in this method, the second access network device receives a first request message from the first access network device, and the first request message is used to request the configuration of the first candidate cell; according to the first request message, obtains first key information and second key information from the core network device, the first key information is used to identify the second key information, and the second key information is used for security protection of data between the terminal device and the second access network device; wherein the first key information and the second key information correspond to the first candidate cell; and sends a first response message to the first access network device, and the first response message includes the configuration of the first candidate cell and the first key information.

[0010] This method allows for inter-gNB LTM to maintain its own key information based on candidate base stations, thus avoiding security issues.

[0011] In one possible design, the method also includes: receiving a second request message from the first access network device, the second request message being used to request the configuration of a second candidate cell; sending the configuration of the second candidate cell and first indication information to the first access network device, the first indication information being used to indicate the key information corresponding to the second candidate cell; wherein the key information corresponding to the second candidate cell is the same as the key information corresponding to the first candidate cell.

[0012] In this design, the key information used by multiple candidate cells included in a candidate base station is shared. This allows a terminal connected to one candidate cell of a candidate base station to switch to another candidate cell of the same base station without having to update the security key, thereby reducing handover latency within the base station. The security key is derived from the key information.

[0013] In one possible design, the first request message includes key request information, and the key request information is used to request (or instruct) the second access network device to obtain the security key corresponding to the first candidate cell.

[0014] In this design, when the source base station sends a first request message to the candidate base station, it requests the candidate base station to obtain the security key corresponding to the first candidate cell. Therefore, in response to the key request message, the candidate base station obtains the key information corresponding to the first candidate cell from its own key information and derives the security key based on the key information corresponding to the first candidate cell.

[0015] In one possible design, the key request information includes information of a third candidate cell, and the information of the third candidate cell is used to obtain the security key corresponding to the first candidate cell; wherein the third candidate cell is the same as or different from the first candidate cell.

[0016] In this design, the candidate base station determines the candidate cell for key derivation, which is indicated by the source base station through the first request message.

[0017] In one possible design, the first response message also includes information of a third candidate cell corresponding to the first key information, and the information of the third candidate cell is used to obtain the security key corresponding to the first candidate cell; wherein the third candidate cell is the same as or different from the first candidate cell.

[0018] In this design, the candidate base station determines the candidate cell for key derivation, which is determined by the candidate base station itself. In addition, the candidate base station indicates the candidate cell for key derivation to the source base station through a first response message.

[0019] In one possible design, the method also includes: deducing the security key corresponding to the first candidate cell based on the second key information, the PCI of the third candidate cell and the downlink frequency of the third candidate cell; receiving data from the terminal device, and processing the data of the terminal device according to the security key corresponding to the first candidate cell.

[0020] In this design, the candidate base station obtains the first and second key information from its own key information and then performs key deduction based on the first and second key information to obtain a security key. In this way, the candidate base station uses the security key to securely protect data between it and the terminal.

[0021] In one possible design, obtaining the first key information and the second key information from the core network device according to the first request message includes: sending a third request message to the core network device according to the first request message, the third request message being used to request the key information corresponding to the first candidate cell; and receiving the first key information and the second key information from the core network device.

[0022] In this design, the candidate base station sends a third request message to the core network device to request the core network device to allocate the first key information and the second key information.

[0023] In the second aspect, an embodiment of the present application provides a communication method, which is applied to a first access network device (such as a source base station) or a module in the first access network device (such as a chip or circuit). Taking the application of this method to the first access network device as an example, in this method, the first access network device sends a first request message to the second access network device, and the first request message is used to request the configuration of a first candidate cell; and receives a first response message from the second access network device, and the first response message includes the configuration of the first candidate cell and first key information; wherein the first key information corresponds to the first candidate cell.

[0024] In one possible design, the method also includes: sending a second request message to the second access network device, the second request message being used to request the configuration of a second candidate cell; receiving the configuration of the second candidate cell and first indication information from the second access network device, the first indication information being used to indicate the key information corresponding to the second candidate cell; wherein the key information corresponding to the second candidate cell is the same as the key information corresponding to the first candidate cell.

[0025] In one possible design, the first request message includes key request information, and the key request information is used to request the second access network device to obtain the security key corresponding to the first candidate cell.

[0026] In one possible design, the key request information includes information of a third candidate cell, and the information of the third candidate cell is used to obtain the security key corresponding to the first candidate cell; wherein the third candidate cell is the same as or different from the first candidate cell.

[0027] In one possible design, the first response message also includes information of a third candidate cell corresponding to the first key information, and the information of the third candidate cell is used to obtain the security key corresponding to the first candidate cell; wherein the third candidate cell is the same as or different from the first candidate cell.

[0028] In one possible design, the method also includes: sending information of a first list, the first key information, and second indication information to a terminal device; wherein the first list includes identifiers of multiple candidate cells, and the multiple candidate cells include a first candidate cell; the first list corresponds to the first key information; the second indication information is used to indicate that the input parameters of the key deduction correspond to the first candidate cell; and sending a first switching message to the terminal device, wherein the first switching message is used to instruct the terminal device to switch to a candidate cell in the first list.

[0029] In one possible design, the method further includes: sending a second switching message to the second access network device, where the second switching message is used to indicate that a switch has been initiated to a candidate cell in the first list.

[0030] In a third aspect, an embodiment of the present application provides a communication method, which is applied to a terminal device or a module (such as a chip or circuit) in a terminal device. Taking the application of this method to a terminal device as an example, in this method, the terminal device receives information from a first list, first key information, and second indication information from a first access network device; wherein, the first list includes identifiers of multiple candidate cells, and the multiple candidate cells include a first candidate cell; the second indication information is used to indicate that the input parameters of the key deduction correspond to the first candidate cell; a first switching message is received from the first access network device, and the first switching message is used to instruct the terminal device to switch to a candidate cell in the first list; access a candidate cell in the first list; deduce the security key corresponding to the first candidate cell based on the first key information and the second indication information; and communicate with the second access network device on a candidate cell in the first list based on the security key.

[0031] In one possible design, the security key corresponding to the first candidate cell is deduced based on the first key information and the second indication information, including: deducing the security key corresponding to the first candidate cell based on the second key information corresponding to the first key information, the PCI of the first candidate cell and the downlink frequency of the first candidate cell.

[0032] In a fourth aspect, an embodiment of the present application provides a communication method, which is applied to a core network device (such as an AMF) or a module in a core network device (such as a chip or circuit). Taking the application of this method to a core network device as an example, in this method, the core network device receives a third request message from a second access network device, and the third request message is used to request key information; and sends first key information and second key information to the second access network device; wherein the first key information is used to identify the second key information, and the second key information is used for security protection of data between the terminal device and the second access network device.

[0033] In one possible design, the third request message also includes information of a third candidate cell corresponding to the first key information, and the information of the third candidate cell is used to obtain the security key corresponding to the first candidate cell; wherein the third candidate cell is the same as or different from the first candidate cell.

[0034] It can be understood that the method claimed for protection in the second aspect, the third aspect or the fourth aspect corresponds to the first aspect, and the beneficial effects of the relevant technical features in the second aspect or the third aspect can be referred to the description of the first aspect and will not be repeated.

[0035] In the fifth aspect, an embodiment of the present application provides a communication method, which is applied to a first access network device (such as a source base station) or a module in the first access network device (such as a chip or circuit). Taking the application of this method to the first access network device as an example, in this method, the first access network device sends a first request message to the second access network device, and the first request message is used to request the configuration of the first candidate cell. The first request message is also used to indicate the key information corresponding to the first candidate cell; and receives the configuration of the first candidate cell from the second access network device.

[0036] In this method, in inter-gNB LTM, the source base station maintains key information and derives keys for candidate base stations, thus avoiding security issues.

[0037] In one possible design, the method also includes: sending a second request message to the second access network device, the second request message being used to request the configuration of a second candidate cell; receiving the configuration of the second candidate cell and first indication information from the second access network device, the first indication information being used to indicate the key information corresponding to the second candidate cell; wherein the key information corresponding to the second candidate cell is the same as the key information corresponding to the first candidate cell.

[0038] In this design, the key information used by multiple candidate cells included in a candidate base station is shared. This allows a terminal connected to one candidate cell of a candidate base station to switch to another candidate cell of the same base station without having to update the security key, thereby reducing handover latency within the base station. The security key is derived from the key information.

[0039] In one possible design, the first request message includes: information about the first security key corresponding to the first candidate cell and the cell corresponding to the first security key; wherein the information about the first security key corresponding to the first candidate cell and the cell corresponding to the first security key is used to indicate the key information corresponding to the first candidate cell.

[0040] In one possible design, the cell corresponding to the first security key is the first candidate cell, and the method also includes: deducing the first security key based on the second key information corresponding to the first key information, the PCI of the first candidate cell, and the downlink frequency of the first candidate cell; wherein the first key information is used to identify the second key information, and the second key information is used for security protection of data between the terminal device and the second access network device; the first key information and the second key information correspond to the first candidate cell.

[0041] In one possible design, the method also includes: sending a third request message to the core network device, the third request message being used to request the key information corresponding to the first candidate cell; receiving the first key information and the second key information from the core network device; or, determining the key information corresponding to the second security key as the first key information; wherein the second security key corresponds to the source cell.

[0042] In one possible design, the first request message also includes: the first key information.

[0043] In one possible design, the method also includes: sending information of a first list, the first key information, and second indication information to the terminal device; wherein the first list includes identifiers of multiple candidate cells, and the multiple candidate cells include the first candidate cell; the first list corresponds to the first key information; the second indication information is used to indicate that the input parameters of the key derivation correspond to the first candidate cell; and sending a first switching message to the terminal device, wherein the first switching message is used to instruct the terminal device to switch to a candidate cell in the first list.

[0044] In one possible design, the cell corresponding to the first security key is the first candidate cell, and the method also includes: deducing the first security key based on the second key information, the PCI of the first candidate cell, and the downlink frequency of the first candidate cell; wherein the second key information is jointly identified by the first key information and the first extended key information, and the second key information is used for security protection of data between the terminal device and the second access network device; the first key information and the second key information correspond to the first candidate cell.

[0045] In this design, the source base station combines the extended key information with the first key information to increase the number of key information that the source base station can distribute. When the number of candidate base stations exceeds the number of NCCs, additional extended key information is required. The first key information and the first extended key information are used to identify the second key information to avoid key misalignment.

[0046] In one possible design, the method also includes: sending a third request message to the core network device, wherein the third request message is used to request the key information corresponding to the first candidate cell; receiving the first key information, the first extended key information, and the second key information from the core network device; or, determining the key information corresponding to the second security key as the first key information; wherein the second security key corresponds to the source cell.

[0047] In one possible design, the first request message also includes: the first key information and the first extended key information.

[0048] In one possible design, the method also includes: sending information of a first list, the first key information, the first extended key information, and second indication information to the terminal device; wherein the first list includes identifiers of multiple candidate cells, and the multiple candidate cells include the first candidate cell; the first list corresponds to the first key information and the first extended key information; the second indication information is used to indicate that the input parameters of key derivation correspond to the first candidate cell; and sending a first switching message to the terminal device, wherein the first switching message is used to instruct the terminal device to switch to a candidate cell in the first list.

[0049] In one possible design, the method further includes: sending a second switching message to the second access network device, where the second switching message is used to indicate that a switch has been initiated to a candidate cell in the first list.

[0050] In the sixth aspect, an embodiment of the present application provides a communication method, which is applied to a second access network device (such as a candidate base station) or a module in the second access network device (such as a chip or circuit). Taking the application of this method to the second access network device as an example, in this method, the second access network device receives a first request message from the first access network device, where the first request message is used to request the configuration of the first candidate cell, and the first request message is also used to indicate the key information corresponding to the first candidate cell; and sends the configuration of the first candidate cell to the first access network device.

[0051] In one possible design, the method also includes: receiving a second request message from the first access network device, the second request message being used to request the configuration of a second candidate cell; sending the configuration of the second candidate cell and first indication information to the first access network device, the first indication information being used to indicate the key information corresponding to the second candidate cell; wherein the key information corresponding to the second candidate cell is the same as the key information corresponding to the first candidate cell.

[0052] In one possible design, the first request message includes: information about the first security key corresponding to the first candidate cell and the cell corresponding to the first security key; wherein the information about the first security key corresponding to the first candidate cell and the cell corresponding to the first security key is used to indicate the key information corresponding to the first candidate cell.

[0053] In one possible design, the first request message also includes: first key information; wherein, the first key information is used to identify second key information, and the second key information is used for security protection of data between the terminal device and the second access network device.

[0054] In one possible design, the first request message also includes: first key information and first extended key information; wherein, the first key information and the first extended key information are used to jointly identify second key information, and the second key information is used for security protection of data between the terminal device and the second access network device.

[0055] In one possible design, the method further includes: receiving a second switching message from the first access network device, the second switching message being used to indicate that a switch has been initiated to a candidate cell included in the second access device.

[0056] In one possible design, the method also includes: sending a fourth request message to the core network device; receiving third key information and fourth key information from the core network device; wherein the third key information is used to identify the fourth key information, and the fourth key information is used for security protection of data between the terminal device and the third access network device.

[0057] In another possible design, the method also includes: sending a fourth request message to the core network device; receiving third key information, second extended key information and fourth key information from the core network device; wherein the third key information and the second extended key information are used to jointly identify the fourth key information, and the fourth key information is used for security protection of data between the terminal device and the third access network device.

[0058] In the seventh aspect, an embodiment of the present application provides a communication method, which is applied to a terminal device or a module (such as a chip or circuit) in the terminal device. Taking the application of this method to the terminal device as an example, in this method, the terminal device receives information from a first list, first key information, and second indication information from a first access network device; wherein, the first list includes identifiers of multiple candidate cells, and the multiple candidate cells include a first candidate cell; the second indication information is used to indicate that the input parameters of the key deduction correspond to the first candidate cell; a first switching message is received from the first access network device, and the first switching message is used to instruct the terminal device to switch to the candidate cell in the first list; access a candidate cell in the first list; deduce the security key corresponding to the first candidate cell based on the first key information and the second indication information; and communicate with the second access network device on a candidate cell in the first list based on the security key.

[0059] In one possible design, the security key corresponding to the first candidate cell is deduced based on the first key information and the second indication information, including: deducing the security key corresponding to the first candidate cell based on the second key information corresponding to the first key information, the PCI of the first candidate cell and the downlink frequency of the first candidate cell.

[0060] In the eighth aspect, an embodiment of the present application provides a communication method, which is applied to a terminal device or a module (such as a chip or circuit) in the terminal device. Taking the application of this method to the terminal device as an example, in this method, the terminal device receives information from a first list, first key information and first extended key information, and second indication information from a first access network device; wherein, the first list includes identifiers of multiple candidate cells, and the multiple candidate cells include a first candidate cell; the second indication information is used to indicate that the input parameters of the key deduction correspond to the first candidate cell; a first switching message is received from the first access network device, and the first switching message is used to instruct the terminal device to switch to a candidate cell in the first list; access a candidate cell in the first list; deduce the security key corresponding to the first candidate cell based on the first key information, the first extended key information and the second indication information; and communicate with the second access network device on a candidate cell in the first list based on the security key.

[0061] In one possible design, the security key corresponding to the first candidate cell is deduced based on the first key information, the first extended key information and the second indication information, including: deducing the security key corresponding to the first candidate cell based on the second key information, the PCI of the first candidate cell and the downlink frequency of the first candidate cell; wherein the second key information is jointly identified by the first key information and the first extended key information.

[0062] It can be understood that the method requested for protection in the sixth aspect, seventh aspect or eighth aspect corresponds to the fifth aspect, and the beneficial effects of the relevant technical features in the sixth aspect, seventh aspect or eighth aspect can be referred to the description of the first aspect and will not be repeated.

[0063] In the ninth aspect, the present application provides a communication device, which has the ability to implement the functions involved in the first to eighth aspects above. For example, the communication device includes modules or units or means corresponding to the operations involved in the first to eighth aspects above. The functions or units or means can be implemented through software, or through hardware, or the corresponding software can be implemented through hardware.

[0064] In one possible design, the communication device includes a processing unit and a communication unit. The communication unit is used to send and receive signals to enable communication between the communication device and other devices, for example, the communication unit is used to send system information to a terminal; and the processing unit is used to perform certain internal operations of the communication device. The functions performed by the processing unit and the communication unit may correspond to the operations described in aspects 1 to 8 above.

[0065] In one possible design, the communication device includes a processor coupled to a memory. The memory may store the necessary computer programs or instructions for implementing the functions of aspects 1 to 8 above. The processor may execute the computer programs or instructions stored in the memory. When the computer programs or instructions are executed, the communication device implements the method of any possible design or implementation of aspects 1 to 8 above.

[0066] In one possible design, the communication device includes a processor and a memory, and the memory may store the necessary computer programs or instructions for implementing the functions of aspects 1 to 8 above. The processor may execute the computer program or instructions stored in the memory. When the computer program or instructions are executed, the communication device implements the method of any possible design or implementation of aspects 1 to 8 above.

[0067] In one possible design, the communication device includes a processor and an interface circuit, wherein the processor is used to communicate with other devices through the interface circuit and execute the method in any possible design or implementation of the first to eighth aspects above.

[0068] It can be understood that in the fourth aspect above, the processor can be implemented by hardware or by software. When implemented by hardware, the processor can be a logic circuit, an integrated circuit, etc.; when implemented by software, the processor can be a general-purpose processor, which is implemented by reading the software code stored in the memory. In addition, the above processors can be one or more, and the memories can be one or more. The memory can be integrated with the processor, or the memory and the processor can be set separately. In the specific implementation process, the memory can be integrated with the processor on the same chip, or can be set on different chips respectively. The embodiment of the present application does not limit the type of memory and the setting method of the memory and the processor.

[0069] In the tenth aspect, the present application provides a communication system, which may include a first communication device, a second communication device, a third communication device and a fourth communication device; wherein the first communication device is used to execute the method described in the first aspect above, and the second communication device is used to execute the method described in the second aspect above; the third communication device is used to execute the method described in the third aspect above, and the fourth communication device is used to execute the method described in the fourth aspect above; or, the first communication device is used to execute the method described in the fifth aspect above, and the second communication device is used to execute the method described in the sixth aspect above; the third communication device is used to execute the method described in the seventh aspect above, and the fourth communication device is used to execute the method described in the eighth aspect above.

[0070] In the eleventh aspect, the present application provides a computer-readable storage medium, in which computer-readable instructions are stored. When a computer reads and executes the computer-readable instructions, the computer executes the method in any possible design of the first to eighth aspects above.

[0071] In a twelfth aspect, the present application provides a computer program product, which, when read and executed by a computer, enables the computer to execute the method in any possible design of the above-mentioned first to eighth aspects.

[0072] In the thirteenth aspect, the present application provides a chip, which includes a processor, and the processor is coupled to a memory, and is used to read and execute a software program stored in the memory to implement the method in any possible design of the first to eighth aspects above. BRIEF DESCRIPTION OF THE DRAWINGS

[0073] FIG1 is a schematic diagram of the architecture of a communication system applicable to an embodiment of the present application;

[0074] FIG2A is a schematic diagram of a random access process provided by an embodiment of the present application;

[0075] FIG2B is a schematic diagram of another random access process provided in an embodiment of the present application;

[0076] FIG3 is a flow chart corresponding to a communication method;

[0077] FIG4 is a schematic diagram of a key deduction;

[0078] FIG5A is a flow chart of a communication method according to the first embodiment of the present application;

[0079] FIG5B is a schematic diagram of a list provided in Example 1 of the present application;

[0080] FIG6 is a flow chart of the communication method according to the second embodiment of the present application;

[0081] FIG7 is a flow chart of the communication method according to the third embodiment of the present application;

[0082] FIG8 is a flow chart of the communication method according to the fourth embodiment of the present application;

[0083] FIG9 is a possible exemplary block diagram of a device involved in an embodiment of the present application;

[0084] FIG10 is a schematic structural diagram of a communication device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0085] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.

[0086] The technical solutions in the embodiments of the present application can be applied to various communication systems, such as universal mobile telecommunications system (UMTS), wireless local area network (WLAN), wireless fidelity (Wi-Fi) system, 4th generation (4G) mobile communication system, such as long term evolution (LTE) system, fifth generation (5G) mobile communication system, such as new radio (NR) system, and future evolved communication systems, such as sixth generation (6G) mobile communication system.

[0087] This application will present various aspects, embodiments or features around a system that may include multiple devices, components, modules, etc. It should be understood and appreciated that each system may include additional devices, components, modules, etc., and / or may not include all the devices, components, modules, etc. discussed in conjunction with the accompanying drawings. In addition, combinations of these schemes may also be used. In addition, in the embodiments of this application, words such as "exemplarily" and "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described in this application as an "example" should not be interpreted as being more preferred or more advantageous than other embodiments or design schemes. Specifically, the use of the word "example" is intended to present concepts in a concrete way. In the embodiments of this application, "of", "corresponding, relevant" and "corresponding" can sometimes be used interchangeably. It should be noted that when the distinction is not emphasized, the meanings to be expressed are consistent.

[0088] To facilitate understanding of the embodiments of the present application, the communication system applicable to the embodiments of the present application is first described in detail using the communication system shown in FIG1 as an example. As shown in FIG1 , the communication system 10 includes one or more network devices 20, and one or more terminals 30. The interface between the network device and the terminal may be a Uu interface (or air interface), and data may be transmitted between the network device 20 and the terminal 30 through air interface resources. Exemplarily, the terminal may be located within the communication coverage of one or more cells of the network device, and the cell providing service to the terminal (i.e., the service cell of the terminal) may be one or more. When there are multiple service cells of the terminal, the terminal may operate in accordance with one or more transmission technologies such as carrier aggregation (CA), dual connectivity (DC), coordinated multipoint (CoMP) transmission, and multiple transmission and reception point (mTRP).

[0089] (1) Terminal

[0090] A terminal can be a device that accesses the above-mentioned communication system and has wireless transceiver capabilities. A terminal may also be called user equipment (UE), terminal equipment, user device, access terminal, user unit, user station, mobile station, mobile station (MS), remote station, remote terminal, mobile device, user terminal, terminal unit, terminal station, terminal device, wireless communication device, user agent, or user device.

[0091] For example, the terminal in the embodiment of the present application can be a mobile phone, a personal digital assistant (PDA), a laptop computer, a tablet computer, a drone, a computer with wireless transceiver function, a machine type communication (MTC) terminal, a virtual reality (VR) terminal, an augmented reality (AR) terminal, an Internet of Things (IoT) terminal, a wireless terminal in industrial control, a wireless terminal in self-driving, a wireless terminal in remote medical, a wireless terminal in a smart grid, a wireless terminal in transportation safety, a wireless terminal in a smart city, a wireless terminal in a smart home (such as a game console, a smart TV, a smart speaker, a smart refrigerator, and fitness equipment, etc.), a vehicle-mounted terminal, and an RSU with terminal function.

[0092] (2) Network equipment

[0093] The network device is a device located on the network side of the above communication system and has wireless transceiver functions.

[0094] For example, the network device in the embodiment of the present application can be an access point (AP) in a Wi-Fi system, such as a home gateway, a router, a server, a switch, a bridge, etc., a base station, an evolved Node B (eNB), a radio network controller (RNC), a base station controller (BSC), a base transceiver station (BTS), a home base station, a baseband unit (BBU), a wireless relay node, a wireless backhaul node, a transmission point (TRP; or a transmission point, TP), etc. It can also be a next-generation NodeB (gNB) in a 5G system, or a network node constituting a gNB, such as a centralized unit (CU), a distributed unit (DU), a roadside unit (RSU) with base station functions, etc., or it can also be a satellite or various future forms of base stations.

[0095] (3) Communication between terminals and network devices

[0096] Communication between terminals and network devices follows a specific protocol layer structure. For example, the control plane protocol layer structure may include the RRC layer, the packet data convergence protocol (PDCP) layer, the radio link control (RLC) layer, the media access control (MAC) layer, and the physical layer (PHY). The user plane protocol layer structure may include the PDCP layer, the RLC layer, the MAC layer, and the physical layer. In one possible implementation, the service data adaptation protocol (SDAP) layer may also be included above the PDCP layer. The SDAP layer, PDCP layer, RLC layer, MAC layer, and physical layer may also be collectively referred to as the access layer. For detailed descriptions of each of the above protocol layers, please refer to the relevant technical specifications of the 3rd Generation Partnership Project (3GPP).

[0097] Taking downlink data transmission as an example, downlink data can be encapsulated accordingly at each layer of a network device. Data received by a layer from the layer above it is considered a service data unit (SDU) of that layer. After layer encapsulation, it becomes a protocol data unit (PDU) and is then passed to the next layer. For example, data received by a PDCP layer entity from the SDAP layer is called a PDCP SDU. After the PDCP layer entity encapsulates the PDCP SDU, it obtains a PDCP PDU and sends it to the RLC layer. The PDCP PDU received by an RLC layer entity from the PDCP layer is called an RLC SDU. After the RLC layer entity encapsulates the RLC SDU, it obtains an RLC PDU and sends it to the MAC layer.

[0098] From the perspective of the terminal, after the terminal's physical layer receives a transport block from the network device, it can pass it up to the upper layer in sequence, where it can perform the corresponding decapsulation. In other words, the processing performed by each layer in the terminal can be the reverse of the processing performed by each layer in the network device.

[0099] (4) CU-DU separation architecture

[0100] For example, in some possible network structures, a network device may include one or more centralized units (CU) and / or one or more distributed units (DU), and multiple DUs may be centrally controlled by one CU. This architecture may be referred to as a CU-DU separation architecture. As an example, the interface between the CU and the DU may be referred to as an F1 interface, where the control plane (CP) interface may be an F1-C interface and the user plane (UP) interface may be an F1-U interface.

[0101] The processing functions of CU and DU can be divided according to the protocol layers of the wireless network: for example, as shown in Figure 2A, the functions of the PDCP layer and above protocol layers are set in the CU, and the functions of the protocol layers below the PDCP layer (such as the RLC layer and the MAC layer, etc.) are set in the DU. It can be understood that the above division of the processing functions of CU and DU according to the protocol layer is only an example, and can also be divided in other ways, such as the functions of the protocol layers above the RLC layer are set in the CU, and the functions of the protocol layers of the RLC layer and below are set in the DU. For example, the CU or DU can be divided into functions with more protocol layers, and the CU or DU can also be divided into partial processing functions with protocol layers. The embodiments of the present application are not limited to this.

[0102] Furthermore, the functions of the CU can be implemented by one entity, or by different entities. For example, the functions of the CU can be further divided, that is, the control plane and the user plane are separated and implemented through different entities, namely the control plane CU entity (i.e., CU-CP entity) and the user plane CU entity (i.e., CU-UP entity). The CU-CP entity and the CU-UP entity can be coupled with the DU to jointly complete the functions of the RAN device. The interface between the CU-CP entity and the CU-UP entity can be an E1 interface, the interface between the CU-CP entity and the DU can be an F1-C interface, and the interface between the CU-UP entity and the DU can be an F1-U interface. Among them, one DU and one CU-UP can be connected to one CU-CP. Under the control of the same CU-CP, one DU can be connected to multiple CU-UPs, one CU-UP can be connected to multiple DUs, and under the collaboration of multiple CU-CPs, one CU-UP can also be connected to multiple cooperating CU-CPs, thereby improving the flexibility of the CU-CP. Figure 2B is a schematic diagram of an air interface protocol stack distribution. As shown in FIG2B , for both the user plane and the control plane, the air interface protocol stack may be RLC, MAC, and PHY in the DU, and PDCP and above protocol layers in the CU.

[0103] It can be understood that in the architecture shown in Figures 2A and 2B above, the signaling generated by the CU can be sent to the terminal through the DU, or the signaling generated by the terminal can be sent to the CU through the DU. The DU can directly encapsulate the signaling through the protocol layer and transmit it to the terminal or CU without parsing it. In the following embodiments, if the transmission of such signaling between the DU and the terminal is involved, then the sending or receiving of the signaling by the DU includes this scenario. For example, the signaling of the RRC or PDCP layer will eventually be processed into physical layer data and sent to the terminal, or converted from the received physical layer data. Under this architecture, the signaling of the RRC layer or PDCP layer can also be considered to be sent by the DU, or sent by the DU and the radio frequency device.

[0104] The communication system and business scenarios described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application, and do not constitute a limitation on the technical solutions provided in the embodiments of the present application. A person skilled in the art will appreciate that, with the evolution of network architecture and the emergence of new business scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0105] The following is an explanation of the relevant technical features involved in the embodiments of the present application. These explanations are intended to make the embodiments of the present application easier to understand and should not be regarded as limiting the scope of protection claimed by this application.

[0106] 1. Cell Switching

[0107] Cell handover can be categorized into two types: one is cell handover based on Layer 1 / Layer 2 (L1 / L2), also known as L1 / L2 handover or L1 / L2 triggered mobility (LTM); the other is cell handover based on Layer 3 (L3), also known as L3 handover. L1 refers to the physical layer; L2 refers to any one or more of the MAC, RLC, PDCP, and SDAP layers; and L3 refers to the RRC layer. It can be understood that L1 / L2 handover can also be understood as L1 and / or L2 handover. When the relationship is "and," operations related to the handover process are primarily performed by both L1 and L2; when the relationship is "or," operations related to the handover process are primarily performed by either L1 or L2. Because L1 and L2 reside at lower levels of the protocol stack than the RRC layer (L3), L1 / L2 handover can also be referred to as lower-layer handover, lower-layer handover, or lower-layer handover.

[0108] For L3 handover, in a CU-DU separation architecture, the CU receives the terminal's measurement results (which are sent to the CU via the DU) and determines whether to initiate a handover based on these results. If so, the handover command is sent to the DU, which then sends it to the terminal. This process involves communication between the CU and DU (i.e., over the F1 interface), and the maximum transmission latency of the F1 interface is approximately 3ms to 10ms, which results in a certain handover latency.

[0109] The L1 / L2 switching decision is decentralized from the CU to the DU. That is, the DU determines whether to initiate a handover (LTM cell switch) based on the terminal's measurement results and sends the handover command directly to the terminal, effectively reducing F1 interactions and lowering handover latency.

[0110] 2. Cell Handover Scenarios

[0111] As mentioned above, a network device includes one or more CUs and one or more DUs. For example, a network device includes one CU and multiple DUs, with the multiple DUs centrally controlled by the CU, and each of the multiple DUs including one or more cells. It is understood that "a DU includes one or more cells" can also be described as "a DU manages or controls one or more cells," "one or more cells of a DU," or "one or more cells belonging to a DU."

[0112] In LTM, a terminal can move from one gNB-DU (also referred to as the "source gNB-DU" in the following embodiments) to another gNB-DU (also referred to as the "candidate gNB-DU" in the following embodiments) within the same gNB-CU. This can also be understood as a cell handover under the same base station, namely, intra-gNB LTM. For example, Figure 3 is a flowchart corresponding to a communication method, as shown in Figure 3, which includes:

[0113] S301A. The terminal sends a measurement report message to the source gNB-DU.

[0114] The measurement report message may include L3 measurement results, specifically, measurement results of neighboring cells. A neighboring cell refers to a cell to which the terminal may switch after moving.

[0115] S301B. The source gNB-DU sends an uplink (UL) RRC message to the gNB-CU. The UL RRC message includes a measurement report message.

[0116] S302. The gNB-CU decides to initiate LTM configuration based on the measurement results of the neighboring cells.

[0117] S303. The gNB-CU sends a UE context establishment request message to the candidate gNB-DU.

[0118] The UE Context Setup Request message may include the ID of the first candidate cell. It is understood that the gNB-CU also indicates the identity (ID) of the source gNB-DU to request the candidate gNB-DU to provide physical random access channel (PRACH) resources for the source gNB-DU.

[0119] S304. If the candidate gNB-DU accepts the LTM configuration request, it sends a UE Context Setup Response message to the gNB-CU.

[0120] The UE context establishment response message includes at least one of the following information: the lower layer RRC configuration corresponding to the first candidate cell, the transmission configuration indicator (TCI) state configuration, the random access channel (RACH) resource configuration and the reference signal (RS) configuration.

[0121] S305. The gNB-CU sends a UE Context Modification Request message to the source gNB-DU.

[0122] The UE context modification request message includes: the RS configuration of the first candidate cell, the TCI state configuration of the first candidate cell, and the RACH resource configuration of the first candidate cell.

[0123] S306. The source gNB-DU sends a UE Context Modification Response message to the gNB-CU.

[0124] The UE context modification response message may include: channel state information (CSI) resource configuration of the source cell, which is used to send the lower layer measurement result of the first candidate cell in the source cell.

[0125] S307. The gNB-CU sends a UE Context Modification Request message to one or more candidate gNB-DUs.

[0126] The UE context modification request message may include: the cell ID of the source cell, and the RS configuration of the source cell. It should be noted that the candidate cells include the source cell.

[0127] S308. The candidate gNB-DU sends a UE Context Modification Response message to the gNB-CU.

[0128] The UE context modification response message may include: a generated CSI resource configuration, which is used to send the CSI of the candidate cell on the first candidate cell.

[0129] S309. The gNB-CU sends a downlink (DL) RRC message to the source gNB-DU.

[0130] The DL RRC message may include: an RRC reconfiguration message including an LTM configuration (eg, a lower layer RRC configuration corresponding to the first candidate cell).

[0131] S310. The source gNB-DU sends the received RRC reconfiguration message to the terminal.

[0132] S311. The terminal sends an RRC reconfiguration complete message to the source gNB-DU.

[0133] S312. The source gNB-DU sends an RRC Reconfiguration Complete message to the gNB-CU via a UL RRC message.

[0134] S313. The terminal and the candidate gNB-DU perform early synchronization on the first candidate cell based on the random access resource configuration of the first candidate cell. Early synchronization includes early uplink synchronization or early downlink synchronization.

[0135] S314. The candidate gNB-DU sends the timing advance (TA) and associated contention free random access (CFRA) resource information of the first candidate cell to the source gNB-DU via the gNB-CU.

[0136] Among them, S313 and S314 are optional steps and may not be executed.

[0137] S315. The terminal sends the lower layer measurement results to the source gNB-DU. The terminal measures the RS according to the RS configuration and then sends the measurement results to the source gNB-DU according to the CSI resource configuration.

[0138] S316. The source gNB-DU decides to perform LTM on the candidate cell.

[0139] S317. The source gNB-DU sends an LTM command to the terminal.

[0140] The LTM command includes the identifier of the target cell, which is used to indicate the first candidate cell as the target cell for switching. The LTM command may also include beam information of the target cell (for example, TCI state identifier) ​​and timing advance information of the target cell, which is used by the terminal device to receive downlink control information in a random access-free manner.

[0141] S318. The source gNB-DU sends an LTM cell change notification message to the gNB-CU to indicate that an LTM command has been initiated for the terminal.

[0142] The LTM cell change notification message may include the target cell ID and the beam information. It is understandable that the target cell is a candidate cell in the above steps.

[0143] S319. The gNB-CU sends the target cell ID and the beam information to the target gNB-DU.

[0144] It can be understood that the target gNB-DU is one of the candidate gNB-DUs in the preceding steps, i.e., the gNB-DU corresponding to the target cell.

[0145] S320. The target gNB-DU detects terminal access.

[0146] For example, a terminal device accesses the target gNB-DU via random access or random access-free access. In the case of random access-free access, the target gNB-DU sends downlink control information to the terminal device based on beam information. In the random access-free access mode, the terminal device accesses the target cell via the physical uplink shared channel (PUSCH) based on the timing advance information in the LTM command, rather than the physical random access channel (PRACH).

[0147] S321. After detecting the access of the terminal device, the target gNB-DU sends a successful access message to the gNB-CU.

[0148] S322. The gNB-CU sends a UE Context Release Command message to the source gNB-DU.

[0149] The UE Context Release Command message is used to release the resources of the candidate cells of the source gNB-DU.

[0150] S323. The source gNB-DU sends a UE context release complete message to the gNB-CU.

[0151] 3. Key (also called "secret key") deduction

[0152] For secure transmission between a terminal and a base station, security keys are used to protect data. Furthermore, different security keys are used when a terminal communicates with different base stations. Currently, security keys are determined based on the next hop parameter (NH) and the next hop chaining counter (NCC). The NCC corresponds to the NH and is therefore used to identify the NH; the NH is used to determine the security key. For example, Figure 4 illustrates a schematic diagram of key derivation.

[0153] In Xn mobility (also known as mobility in a 5G network), if the source gNB has an unused {NH, NCC} pair, vertical key derivation shall be performed. If vertical key derivation is performed, the security key is determined based on the NH. Specifically, the source gNB shall determine K based on the unused NH, the physical cell identify (PCI) of the target cell, and the downlink frequency of the target cell. NG-RAN* , so as to realize the security protection of communication data by using unused {NH, NCC}.

[0154] If the source gNB has no unused {NH, NCC} pair, horizontal key derivation shall be performed. If horizontal key derivation is performed, the key derivation is based on the K used by the source gNB. gNB Determine the security key. Specifically, the source gNB determines K based on the NH currently used by the source gNB, the PCI of the target cell, and the downlink frequency of the target cell. NG-RAN* , in order to achieve the security protection of communication data using {NH, NCC}.

[0155] Then, the source gNB will determine {K NG-RAN* , NCC} pair is sent to the target gNB.

[0156] The target gNB uses the received {K NG-RAN* , K in NCC} NG-RAN* , as the security key (K gNB ). And, the target gNB then calculates the K gNB Determine the security key for data transmission (K up or K rrc ), using (K up or K rrc ) to securely protect the data. Furthermore, the target gNB includes the NCC in a handover command and returns the handover command to the source gNB, which then sends it to the terminal.

[0157] When an access layer (AS) security context needs to be established between the terminal and the gNB, the terminal determines K based on the NCC. gNB and NH. Exemplary, K gNB and NH come from AMF. Among them, NCC and K gNB and NH values, and K gNB Associated with the NCC corresponding to its derived NH value.

[0158] After the terminal accesses the target gNB, the terminal gNB Determine the security key for data transmission (K up or K rrc ), using the security key for data transmission (K up or K rrc ) to protect the data. For example, the terminal uses a security key (K up or K rrc ) encrypts the data and sends the encrypted data to the target gNB; and the terminal receives the data from the target gNB using the security key (K up or K rrc ) to decrypt the data. Correspondingly, the target gNB uses the security key (K up or K rrc) encrypts the data and sends the encrypted data to the terminal; and the target gNB receives the data from the terminal and uses the security key (K up or K rrc ) to decrypt the data.

[0159] As described above, after determining the target base station, the source base station derives a key for the target base station. However, existing communication systems do not consider inter-base station handovers in LTM, and inter-gNB LTM poses security risks.

[0160] In view of this, an embodiment of the present application provides a communication method for implementing inter-gNB LTM key processing, thereby achieving security protection of inter-gNB LTM.

[0161] The communication method provided by the embodiment of the present application is described in detail below in conjunction with Example 1 to Example 4. Among them, the communication method provided by the embodiment of the present application involves communication between multiple network devices (such as a first access network device, a second access network device and a core network device) and a terminal. Unless otherwise specified, "terminal" can refer to the terminal itself or a component in the terminal, such as a chip or a chip system; "network device" can refer to the network device itself or a component in the network device, such as a chip or a chip system. The following description will be based on the example of "the first access network device is the source base station, the second access network device is the candidate base station, and the core network device is the AMF".

[0162] Example 1

[0163] FIG5A is a flow chart of a communication method according to the first embodiment of the present application. As shown in FIG5A , the method includes:

[0164] S501: The terminal sends an L3 measurement report to the source base station.

[0165] The L3 measurement report includes measurement results of one or more neighboring cells, and the one or more neighboring cells belong to at least one candidate base station.

[0166] It is understandable that at this time, the terminal transmits data with the source base station, and the data is transmitted using the first security key (for example, the first K gNB ) for security protection. The key information used by the source base station is {first NCC, first NH}. As shown in Figure 4, the key deduction content, the terminal and the source base station use the first NH, first PCI and first downlink frequency corresponding to the first NCC as parameter input to determine the first K gNB Wherein, the first PCI is the PCI of the source cell, and the first downlink frequency is the downlink frequency of the source cell. The source cell is the cell where the terminal accesses the source base station.

[0167] In the embodiment of the present application, one candidate base station will be taken as an example, and other candidate base stations will be processed accordingly.

[0168] S502: The source base station decides to perform LTM configuration.

[0169] Exemplarily, the source base station determines multiple cells under the candidate base station as candidate cells; wherein, the PCIs corresponding to different candidate cells are different, and the downlink frequencies corresponding to different candidate cells may be the same or may be different.

[0170] In the embodiments of this application, the first candidate cell and the second candidate cell are used as examples. Other candidate cells are processed similarly to the second candidate cell. The first candidate cell and the second candidate cell are two different cells that belong to candidate base stations. The processing of the first candidate cell and the second candidate cell is described below.

[0171] First candidate cell

[0172] S503: The source base station sends a first handover request message to the candidate base station.

[0173] The first handover request message includes: an identifier of the first candidate cell; and an LTM configuration request. The identifier of the first candidate cell indicates a request for LTM configuration of the first candidate cell or a request for a cell to be a candidate cell; and the LTM configuration request requests LTM configuration. For details on the first handover request message, see the UE Context Establishment Request message in FIG. 3 .

[0174] S504: The candidate base station sends a key request message to the AMF based on the received first handover request message.

[0175] Optionally, when the source base station does not indicate a cell for key derivation, the candidate base station determines the first candidate cell as the cell for key derivation. For example, the candidate base station randomly selects the first candidate cell from multiple candidate cells.

[0176] Alternatively, the candidate base station determines the first candidate cell as the cell for key derivation based on an instruction from the source base station. Exemplarily, the source base station provides the instruction via the first handover request message in S503. For example, the first handover request message further includes: first indication information; wherein the first indication information is used to indicate the first candidate cell as the cell for key derivation. Based on this, the candidate base station determines the first candidate cell as the cell for key derivation based on the first indication information in the first handover request message.

[0177] Exemplarily, the candidate base station sends a key request message to the AMF based on the determined first candidate cell, wherein the key request message is used to allocate corresponding key information for the first candidate cell.

[0178] S505: The AMF sends key information to the candidate base station according to the key request message.

[0179] Exemplarily, the key information includes: a second NCC and a second NH. It is understandable that the second NCC corresponds to the second NH, and the second NCC is used to identify the second NH. The second NH is used by the candidate base station and the terminal to perform key deduction to obtain the second security key (for example, the second K gNB ). Second K gNB Used to securely protect data between the terminal and the candidate base station.

[0180] S506: The candidate base station sends a first handover request confirmation message to the source base station based on the key information. For details of the first handover request message, see the UE context establishment response message in Figure 3 . Upon receiving the key information from the AMF, the candidate base station sends a first handover request confirmation message to the source base station.

[0181] Optionally, when the source base station does not indicate a cell for key derivation, the candidate base station independently determines a first candidate cell as the cell for key derivation, and the candidate base station indicates this to the source base station via a first handover request confirmation message. In this case, the first handover request confirmation message includes: second indication information or a second NCC; and the configuration of the candidate cell. The second indication information is used to indicate the first candidate cell as the cell for key derivation by the candidate base station.

[0182] Alternatively, when the candidate base station determines the first candidate cell as the cell for key derivation according to the instruction of the source base station, the first handover request confirmation message includes: the second NCC; the configuration of the candidate cell. It is understood that in this scenario, the first handover request confirmation message does not need to include the second indication information.

[0183] Second candidate cell

[0184] S507: The source base station sends a second handover request message to the candidate base station.

[0185] The second handover request message includes: an identifier of the second candidate cell; and an LTM configuration request. The identifier of the first candidate cell indicates a request for LTM configuration of the second candidate cell or a request for a cell to be a candidate cell; and the LTM configuration request requests LTM configuration. For details on the first handover request message, see the UE Context Establishment Request message in FIG. 3 .

[0186] S508: The candidate base station sends a second handover request confirmation message to the source base station.

[0187] The second handover request confirmation message includes: third indication information. The third indication information includes multiple forms, as follows:

[0188] (1-1), the third indication information is used to indicate that the second candidate cell and the first candidate cell share the same NCC, ie, the second NCC and the second NH. Exemplarily, the third indication information includes an identifier of the first candidate cell.

[0189] (1-2), the third indication information is used to indicate the second NCC corresponding to the second candidate cell; wherein the second NCC corresponding to the second candidate cell is the same as the second NCC corresponding to the first candidate cell.

[0190] It can be understood that at this time, the candidate base station does not need to send a key request to the AMF, and the AMF does not need to send key information to the candidate base station.

[0191] The source base station may determine at least the following based on the first handover request confirmation message and the second handover request confirmation message from the candidate base station:

[0192] (2-1) The first candidate cell and the second candidate cell of the candidate base station accept the handover request. Based on this, the source base station determines a first list; the first list is the candidate cells for which the candidate base station accepts the handover request.

[0193] (2-2) The second candidate cell and the first candidate cell use the same NCC. It can also be understood that the first list corresponds to the same NCC, that is, the first list corresponds to the second NCC.

[0194] (2-3) The source base station determines the first candidate cell as the cell for key derivation.

[0195] Based on the above determination, the source base station instructs the terminal to perform reconfiguration, which is achieved through the following S509 and S510:

[0196] S509: The source base station sends an RRC reconfiguration message to the terminal. The RRC reconfiguration message includes at least the following information:

[0197] (3-1), a first list, which includes the identifier of the first candidate cell and the identifier of the second candidate cell. It should be noted that the first list may include only the identifier of one candidate cell, i.e., the identifier of the first candidate cell, or may include identifiers of multiple candidate cells, where the multiple candidate cells include the first candidate cell.

[0198] (3-2), second NCC. The second NCC is used to identify the second NH. It can be understood that the second NH is one of the input parameters for key derivation of the first list. The second NCC corresponds to the first list.

[0199] (3-3) The cell in the first list corresponding to the key derivation is also referred to as the first candidate cell in the aforementioned step. It can be understood that the PCI and downlink frequency of the first candidate cell serve as input parameters for key derivation for the first list. The cells in the first list all use the same security key. The specific derivation method is described in Figure 4 above.

[0200] Exemplarily, the RRC reconfiguration message includes different fields, and the different fields can be used to indicate the above information respectively.

[0201] For example, Figure 5B is a schematic diagram of a list provided in Example 1 of the present application. Figure 5B shows candidate base station 1 and candidate base station 2. Candidate base station 1 corresponds to list 1. List 1 includes the identifier of candidate cell 1 and the identifier of candidate cell 2, indicating that candidate cell 1 and candidate cell 2 of the candidate base station accept the handover request from the source base station. List 1 corresponds to NCC1, indicating that both candidate cell 1 and candidate cell 2 correspond to NCC1. The cell corresponding to list 1 for key deduction is candidate cell 1.

[0202] Candidate base station 2 corresponds to list 2. List 2 includes the identifiers of candidate cell 3 and candidate cell 4, indicating that candidate cells 3 and 4 of the candidate base station accept the handover request from the source base station. List 2 corresponds to NCC2, indicating that both candidate cells 3 and 4 correspond to NCC2. The cell for key derivation corresponding to list 2 is candidate cell 3.

[0203] S510 : After completing reconfiguration according to the RRC reconfiguration message, the terminal sends an RRC reconfiguration complete message to the source base station.

[0204] After the terminal reconfiguration is completed, the source base station instructs the terminal to perform cell handover based on the measurement report from the terminal. In the following embodiments, the terminal switches from the source cell to the second candidate cell as an example. The processing flow for switching to the first candidate cell can refer to the processing flow for the second candidate cell.

[0205] S511: The terminal sends a measurement report of the second candidate cell to the source base station, wherein the measurement report is used to indicate the signal quality of the second candidate cell.

[0206] The source base station determines the candidate cell for the terminal to switch to based on the measurement report of the candidate cell sent by the terminal. It is understandable that when the candidate cell is used as the cell for the terminal to switch to, the candidate cell is the target cell, and the base station corresponding to the target cell is the target base station.

[0207] S512: The terminal receives an LTM cell handover command sent by the source base station. The LTM cell handover command is used to instruct the terminal to switch to the second candidate cell. That is, the second candidate cell is used as the target cell for the terminal's handover. For details on the LTM cell handover command, see the LTM command in FIG. 3 .

[0208] S513, the terminal deduces the second K gNB .

[0209] Exemplarily, the terminal derives the second K according to the second NH corresponding to the second NCC, the PCI of the first candidate cell, and the downlink frequency of the first candidate cell. gNB For the specific deduction process, please refer to the key deduction content introduced in Figure 4.

[0210] S514, based on the second K gNB , securely protecting the data between the terminal and the target base station. Exemplarily, on the second candidate cell (also known as the "target cell"), data is sent to the candidate base station (also known as the "target base station"), or data from the target base station is received. Wherein, the data is based on the second K gNB For security protection.

[0211] In addition, the candidate base station refers to the processing of the terminal introduced in S513 and S514, and deduces the second K gNB For the specific deduction process, please refer to the key deduction content introduced in Figure 4.

[0212] It should be noted that, since the security keys corresponding to the first candidate cell and the second candidate cell are both derived based on the key information of the first candidate cell, when the terminal subsequently switches from the second candidate cell to the first candidate cell, the security key used between the terminal and the candidate base station is not updated.

[0213] As described in Example 1, in inter-gNB LTM, candidate base stations maintain their own key information to avoid security issues.

[0214] Example 2

[0215] FIG6 is a flow chart of a communication method according to the second embodiment of the present application. As shown in FIG6 , the method includes:

[0216] S601: The terminal sends an L3 measurement report to the source base station.

[0217] The L3 measurement report includes measurement results of one or more neighboring cells, and the one or more neighboring cells belong to at least one candidate base station.

[0218] It is understandable that at this time, the terminal transmits data with the source base station, and the data is transmitted using the first security key (for example, the first K gNB ) for security protection. The key information used by the source base station is {first NCC, first NH}. Referring to the key deduction content described in Figure 4 above, the terminal and the source base station use the first NH, first PCI and first downlink frequency corresponding to the first NCC as parameter input to determine the first K gNB Wherein, the first PCI is the PCI of the source cell, and the first downlink frequency is the downlink frequency of the source cell. The source cell is the cell where the terminal accesses the source base station.

[0219] In the embodiment of the present application, one candidate base station will be taken as an example, and other candidate base stations will be processed accordingly.

[0220] S602: The source base station decides to perform LTM configuration.

[0221] At this time, the source base station performs the following steps a and b:

[0222] a. The source base station determines multiple cells under the candidate base station as candidate cells; wherein the PCIs corresponding to different candidate cells are different, and the downlink frequencies corresponding to different candidate cells may be the same or different.

[0223] In the embodiment of the present application, the first candidate cell and the second candidate cell are taken as examples, and other candidate cells are processed with reference to the second candidate cell. The first candidate cell and the second candidate cell are two different cells and belong to candidate base stations.

[0224] In this case, since the first candidate cell and the second candidate cell belong to the same candidate base station, the first candidate cell and the second candidate cell correspond to the same key information, that is, the key information corresponding to the candidate base station, such as the second NCC and the second NH. It can also be understood that the second candidate cell uses the security key corresponding to the first candidate cell.

[0225] b. From the first candidate cell and the second candidate cell, determine the first candidate cell as the cell for key derivation. Furthermore, use the key information corresponding to the candidate base station, the PCI of the first candidate cell, and the downlink frequency of the first candidate cell as input parameters for key derivation to derive a key for the candidate base station. The key information corresponding to the candidate base station includes at least the following two determination methods:

[0226] Determination method 1: The source base station uses the key information (such as the first NCC and the first NH) used by the source cell as the key information corresponding to the candidate base station.

[0227] Exemplarily, the source base station derives the security key corresponding to the first candidate cell (for example, the second K gNB ). The first NH is the NH used by the source cell.

[0228] Determination method 2: The source base station obtains the key information corresponding to the candidate base station from the AMF. Exemplarily, the source base station obtains the key information corresponding to the candidate base station from the AMF through the following S602-c1 and S602-c2.

[0229] S602-c1: The source base station sends a key request message to the AMF. The key request message is used to request key information corresponding to the candidate base station.

[0230] S602-c2, AMF sends key information to the source base station.

[0231] For example, the key information includes: a second NCC and a second NH; wherein the second NCC is used to identify the second NH. Exemplarily, the source base station obtains the security key corresponding to the first candidate cell (for example, the second K gNB ').

[0232] For another example, the key information includes the second NCC and the first extended NCC (first H-NCC), and the second NH; wherein the first H-NCC is used to jointly identify the second NH with the second NCC. Exemplarily, the source base station obtains the security key corresponding to the first candidate cell (for example, the second K gNB ').

[0233] It is understood that when the key information sent by the AMF includes the H-NCC, the key information used in the subsequent process is the second NCC and the first H-NCC. It is also understood that when the key information sent by the AMF does not include the H-NCC, the key information used in the subsequent process is the second NCC.

[0234] The following describes how the source base station processes the first candidate cell and the second candidate cell.

[0235] First candidate cell

[0236] S603: The source base station sends a first handover request message to the candidate base station according to the process of S602.

[0237] The first handover request message includes: an identifier of the first candidate cell; an LTM configuration request; and key information corresponding to the first candidate cell. The identifier of the first candidate cell indicates a request for LTM configuration of the first candidate cell; the LTM configuration request is used to request LTM configuration; and the key information corresponding to the first candidate cell indicates the NCC and security keys. For details on the first handover request message, see the UE Context Establishment Request message in Figure 3 .

[0238] Based on S602, the key information corresponding to the first candidate cell includes multiple forms, as follows:

[0239] (4-1), including the first NCC and the second K gNB .

[0240] (4-2), including the second NCC and the second K gNB '.

[0241] (4-3), including the second NCC, the first H-NCC and the second K gNB '.

[0242] S604: The candidate base station sends a first handover request confirmation message to the source base station in response to the first handover request message.

[0243] The first handover request confirmation message includes the configuration of the candidate cell. For the specific content of the first handover request message, refer to the UE context establishment response message in the aforementioned FIG3 .

[0244] In addition, the candidate base station carries the NCC in the first handover request message; for example, the first handover request confirmation message also includes: the first NCC, or the second NCC, or the second NCC and the first H-NCC. Alternatively, the candidate base station carries the NCC in the configuration of the candidate cell; for example, the configuration of the candidate cell includes: the first NCC, or the second NCC, or the second NCC and the first H-NCC.

[0245] Second candidate cell

[0246] S605: The source base station sends a second handover request message to the candidate base station according to the process of S602.

[0247] The second handover request message includes: an identifier of the second candidate cell; and an LTM configuration request. The identifier of the second candidate cell indicates a request for LTM configuration of the second candidate cell; and the LTM configuration request requests LTM configuration. For the specific content of the second handover request message, see the UE context establishment request message in FIG. Based on the first candidate cell being the cell from which the source base station deduces the key for the candidate base station, the second handover request message does not include key information.

[0248] S606: The candidate base station sends a second handover request confirmation message to the source base station.

[0249] At this time, the candidate base station determines from the second handover request message that the second candidate cell uses the security key of the first candidate cell (for example, the second K gNB or the second K gNB '). Based on this, the second handover request confirmation message includes: fourth indication information. The fourth indication information is used to instruct the second candidate cell to use the security key corresponding to the first candidate cell (for example, the second K gNB or the second K gNB ').

[0250] After receiving the first handover request confirmation message and the second handover request confirmation message from the candidate base station, the source base station instructs the terminal to perform reconfiguration based on the LTM configuration performed in S602.

[0251] S607: The source base station sends an RRC reconfiguration message to the terminal. The RRC reconfiguration message includes at least the following information:

[0252] (5-1), a first list, which includes the identifier of the first candidate cell and the identifier of the second candidate cell. The first list is determined by the source base station in S602.

[0253] It should be noted that the first list may include only one candidate cell identifier, that is, the identifier of the first candidate cell, or may include identifiers of multiple candidate cells, where the multiple candidate cells include the first candidate cell.

[0254] (5-2), the second NCC (or the second NCC and the first H-NCC) or the first NCC. The first NCC is the NCC corresponding to the source cell. It is understood that when the source base station does not request key information from the AMF, the first NCC is carried; when the source base station requests key information from the AMF, the second NCC (or the second NCC and the first H-NCC) is carried. The second NCC (or the second NCC and the first H-NCC) or the first NCC corresponds to the first list.

[0255] The first NCC is used to identify the first NH, and the second NCC (or the second NCC and the first H-NCC are used to jointly identify the second NH. It can be understood that the first NH or the second NH is used as one of the input parameters for key derivation of the first list.

[0256] (5-3) The cell in the first list corresponding to the key derivation is the first candidate cell in the aforementioned step. It can be understood that the PCI and downlink frequency of the first candidate cell serve as input parameters for key derivation for the first list. The cells in the first list all use the same security key. The specific derivation method is described in Figure 4 above.

[0257] Exemplarily, the RRC reconfiguration message includes different fields, and the different fields can be used to indicate the above information respectively. Among them, the first list is used to indicate that the first candidate cell and the second candidate cell both use the second NCC (or the second NCC and the first H-NCC) or the first NCC, and that the security keys corresponding to the first candidate cell and the second candidate cell both correspond to the first candidate cell.

[0258] S608 : After completing reconfiguration according to the RRC reconfiguration message, the terminal sends an RRC reconfiguration complete message to the source base station.

[0259] After the terminal reconfiguration is completed, the source base station instructs the terminal to perform cell handover based on the measurement report from the terminal. In the following embodiments, the terminal switches from the source cell to the second candidate cell as an example. The processing flow for switching to the first candidate cell or other candidate cells can refer to the processing flow for the second candidate cell.

[0260] S609: The terminal sends a measurement report of the second candidate cell to the source base station, wherein the measurement report is used to indicate the signal quality of the second candidate cell.

[0261] The source base station determines the candidate cell for the terminal to switch to based on the measurement report of the candidate cell sent by the terminal. It is understandable that when the candidate cell is used as the cell for the terminal to switch to, the candidate cell is the target cell, and the base station corresponding to the target cell is the target base station.

[0262] S610: The terminal receives an LTM cell handover command sent by the source base station. The LTM cell handover command is used to instruct the terminal to switch to a second candidate cell. That is, the second candidate cell is used as the target cell for the terminal's handover. For details on the LTM cell handover command, see the LTM command in FIG. 3 .

[0263] S611, the terminal deduces the second K gNB .

[0264] Exemplarily, the terminal derives the second K according to the second NH corresponding to the second NCC, the PCI of the first candidate cell, and the downlink frequency of the first candidate cell. gNB Alternatively, the terminal derives the second K according to the first NH corresponding to the second NCC and the first H-NCC, the PCI of the first candidate cell, and the downlink frequency of the first candidate cell. gNB'. For the specific deduction process, please refer to the key deduction content introduced in Figure 4.

[0265] In another exemplary embodiment, the terminal derives the second K according to the first NH corresponding to the first NCC, the PCI of the first candidate cell, and the downlink frequency of the first candidate cell. gNB For the specific deduction process, please refer to the key deduction content introduced in Figure 4.

[0266] S612, based on the second K gNB or the second K gNB ', securely protecting the data between the terminal and the target base station. Exemplarily, on the second candidate cell (also known as the "target cell"), data is sent to the candidate base station (also known as the "target base station"), or data from the target base station is received. Wherein, the data is based on the second K gNB or the second K gNB 'For security protection.

[0267] S613: After the target base station determines that the cell switching is completed, the target base station sends a path switching request message (e.g., path switch request) to the AMF.

[0268] S614: The AMF sends a path switch confirmation message (eg, path switch acknowledgement) to the target base station in response to the path switch request message, wherein the path switch acknowledgement message includes key information.

[0269] Exemplarily, the key information included in the path switch confirmation message includes: a third NCC; a third NH.

[0270] In another exemplary embodiment, the key information included in the path switch confirmation message includes: a third NCC, a second H-NCC, and a third NH, wherein the second H-NCC is the same as or different from the first H-NCC, and the third NCC is different from the second NCC.

[0271] It is understandable that the key information included in the path switching confirmation message is used to securely protect data after switching from the target base station to a cell of another base station, and is also used to securely protect data after switching back to the second candidate cell.

[0272] It should be noted that, since the security keys corresponding to the first candidate cell and the second candidate cell are both derived based on the key information of the first candidate cell, when the terminal subsequently switches from the second candidate cell to the first candidate cell, the security key used between the terminal and the candidate base station is not updated.

[0273] As described in Example 2, in inter-gNB LTM, the source base station maintains key information and derives keys for candidate base stations, thereby avoiding security issues.

[0274] Example 3

[0275] FIG7 is a flow chart of a communication method according to a third embodiment of the present application. As shown in FIG7 , the method includes:

[0276] S701: A first access network device (eg, a source base station) sends a first request message to a second access network device (eg, a candidate base station). Correspondingly, the second access network device receives the first request message from the first access network device.

[0277] The first request message is used to request the configuration of the first candidate cell. For the specific content of the first request message, refer to the UE context establishment request message in FIG. 3 .

[0278] Exemplarily, the first request message includes: an identifier of the first candidate cell and LTM configuration request information; wherein, the identifier of the first candidate cell is used to indicate a request for LTM configuration of the first candidate cell or a request for a cell as a candidate cell; and the LTM configuration request information is used to request LTM configuration.

[0279] In another exemplary embodiment, the first request information is further used to request the second access network device to obtain the security key corresponding to the first candidate cell, including key request information.

[0280] It should be noted that the embodiment of the present application does not limit the form of the first request information and the specific information included in the first request information.

[0281] S702, the second access network device obtains the first key information (eg, the second NCC) and the second key information (eg, the second NH) from the core network device (eg, AMF) according to the first request message.

[0282] The second NCC is used to identify the second NH; the second key information NH is used for security protection of data between the terminal and the second access network device. For example, the candidate base station obtains the second K based on the second NH, the PCI of the first candidate cell and the downlink frequency of the first candidate cell. gNB ; Based on the second K gNB The data between the candidate base station and the terminal is securely protected based on K gNB For the security protection, please refer to the content described in Figure 4 above.

[0283] In an optional embodiment, the second access network device obtains the first key information and the second key information, including the following steps S702A and S702B:

[0284] S702A: The second access network device sends a third request message to the core network device according to the first request message. Correspondingly, the core network device receives the third request message from the second access network device.

[0285] The third request message is used to request key information, including an identifier of the first candidate cell and / or key request information, wherein the key information corresponds to the first candidate cell.

[0286] S702B: The core network device sends the first key information and the second key information to the second access network device in response to the third request message. Correspondingly, the second access network device receives the first key information and the second key information from the core network device.

[0287] S703: The second access network device sends a first response message to the first access network device. Correspondingly, the first access network device receives the first response message from the first access network device.

[0288] Wherein, illustratively, the first response message includes the configuration of the first candidate cell and the first key information (e.g., the second NCC). Referring to the introduction of FIG. 3 , the configuration of the first candidate cell includes at least one of the following information: the lower layer RRC configuration, TCI state configuration, RACH resource configuration, and RS configuration corresponding to the first candidate cell. For the specific content of the first response message, refer to the UE context establishment response message of FIG. 3 . After receiving the first key information and the second key information, the second access network device sends a first response message to the first access network device.

[0289] In another exemplary embodiment, the first response message includes the configuration of the first candidate cell, and the configuration of the first candidate cell also includes the first key information. In this way, when the terminal receives the configuration of the first candidate cell, the terminal can obtain the first key information from the configuration of the first candidate cell, and then the terminal can obtain the security key corresponding to the first candidate cell based on the first key information (for example, the second NCC). For example, the terminal obtains the second K based on the second NH corresponding to the second NCC, the PCI of the first candidate cell, and the downlink frequency of the first candidate cell. gNB ; Using the second K gNB Provide security protection for data between the terminal and the candidate base station.

[0290] S704, the first access network device sends the first list information, first key information, and second indication information to the terminal according to the first response message. Correspondingly, the terminal receives the first list information, first key information, and second indication information from the first access network device.

[0291] (6-1) The first list is used to indicate at least one cell information, including the identifier of the first candidate cell. It should be noted that the first list may include only the identifier of one candidate cell, i.e., the identifier of the first candidate cell, or may include identifiers of multiple candidate cells, where the multiple candidate cells include the first candidate cell. In one possible embodiment, the first list also includes the identifier of the second candidate cell described in subsequent S801.

[0292] (6-2) The first key information. The first key information (e.g., the second NCC) is used to identify the second key information (e.g., the second NH). It can be understood that the second NH is one of the input parameters for key derivation of the first list, and the first key information corresponds to the first list.

[0293] (6-3) The second indication information is used to indicate that the input parameters of the key deduction correspond to the first candidate cell. It can be understood that the PCI and downlink frequency of the first candidate cell are used as the input parameters for the key deduction of the first list. The cells in the first list all use the same security key. The specific deduction method is described in the aforementioned Figure 4.

[0294] Exemplarily, the second indication information includes an identifier of the first candidate cell, and the identifier of the first candidate cell indicates that an input parameter for key derivation corresponds to the first candidate cell.

[0295] In another exemplary embodiment, the second indication information is used to indicate the first candidate cell as the cell for key derivation in the first list, so as to indicate that the PCI and downlink frequency of the first candidate cell are used as input parameters for key derivation in the first list.

[0296] It should be noted that the embodiment of the present application does not limit the form of the second indication information and the specific information included in the second indication information.

[0297] S705: The first access network device decides to perform LTM on the candidate cell and sends a first handover message to the terminal. Correspondingly, the terminal receives the first handover message from the first access network device.

[0298] The first handover message is used to instruct the terminal device to switch to the target cell. The first handover message is transmitted via a MAC control element (CE). The target cell is the first candidate cell or the second candidate cell introduced in the subsequent S801. It can be understood that the candidate cell to which the terminal device switches is now called the target cell, and the base station corresponding to the target cell is now called the target base station. For the specific content of the first handover message, see the LTM command in Figure 3 above.

[0299] S706: The terminal accesses the target cell.

[0300] For details on accessing the target cell, please refer to the introduction in FIG3 .

[0301] S707: The terminal communicates with the second access network device in the target cell according to the security key.

[0302] The terminal device derives the security key corresponding to the target cell according to the first key information and the second indication information received in S704. The specific derivation method is described above. It is understandable that the terminal uses the same security key when accessing the first candidate cell or the second candidate cell.

[0303] In addition, the second access network device also derives the security key corresponding to the target cell based on the first key information and / or the second key information obtained in S702. The specific derivation method is described above. It is understandable that the second access network device uses the same security key when the terminal accesses the first candidate cell or the second candidate cell.

[0304] As described in Example 3, the first access network device requests the second access network device for key information and configuration of candidate cells. The second access network device then determines the key information. After obtaining the key information, the first access network device sends it to the terminal. This ensures data security in the inter-gNB LTM after LTM is switched to the second access network device.

[0305] In an optional embodiment, before S704, the first access network device further requests the second access network device for configuration of the second candidate cell, including the following steps S801 and S802:

[0306] S801: A first access network device (eg, a source base station) sends a second request message to a second access network device (eg, a candidate base station). Correspondingly, the second access network device receives the second request message from the first access network device.

[0307] The second request message is used to request the configuration of the second candidate cell. For the specific content of the second request message, refer to the UE context establishment request message in FIG. 3 .

[0308] Exemplarily, the second request message includes: an identifier of the second candidate cell and LTM configuration request information; wherein the identifier of the second candidate cell is used to indicate a request for LTM configuration of the second candidate cell; and the LTM configuration request information is used to request LTM configuration.

[0309] In another exemplary embodiment, the second request information is further used to request the second access network device to obtain the security key corresponding to the second candidate cell, including key request information.

[0310] It should be noted that the embodiment of the present application does not limit the form of the second request information, nor the specific information included in the second request information.

[0311] S802: The second access network device sends the configuration of the second candidate cell and first indication information to the first access network device. Correspondingly, the first access network device receives the configuration of the second candidate cell and the first indication information from the second access network device.

[0312] It can be understood that the second access network device determines that the second candidate cell and the first candidate cell use the same key information.

[0313] Exemplarily, the first indication information is used to indicate key information corresponding to the second candidate cell; wherein the key information corresponding to the second candidate cell is the same as the key information corresponding to the first candidate cell. The first indication information can be a direct indication, for example, a newly added parameter, or an implicit indication, for example, the key information parameter is not carried.

[0314] In another exemplary embodiment, the first indication information is used to indicate that the key information corresponding to the second candidate cell is the same as the key information corresponding to the first candidate cell.

[0315] In another exemplary embodiment, the configuration of the second candidate cell also includes the first indication information. In this way, when the first access network device sends the configuration of the second candidate cell to the terminal, the terminal can obtain the first indication information from the configuration of the second candidate cell, and then the terminal can determine, based on the first indication information, that the second candidate cell shares the corresponding security key of the first candidate cell.

[0316] Through the contents introduced in S801 and S802, the first candidate cell and the second candidate cell use the same key, so that in the scenario of moving within the second network device, there is no need to update the key, thereby reducing the switching delay within the base station.

[0317] Furthermore, based on the fact that the first candidate cell and the second candidate cell use the same key, the second access network device determines a cell for key derivation from the first candidate cell and the second candidate cell, thereby obtaining the key used by the second access network device. The cell for key derivation may be determined by the second access network device itself, or may be instructed by the first access network device to the second access network device. The specific implementation is as follows:

[0318] Implementation method 1: The first access network device determines the cell for key derivation and indicates it to the second access network device through the first request message in S701, and also indicates it to the terminal in S704.

[0319] At this time, the first request message includes information of a third candidate cell, and the information of the third candidate cell is used to obtain or determine the security key corresponding to the first candidate cell; wherein the third candidate cell is the same as or different from the first candidate cell.

[0320] Exemplarily, the first candidate cell is the same as the third candidate cell, and the first access network device requests configuration of the first candidate cell and indicates that the key of the first candidate cell is also determined based on the first candidate cell.

[0321] In another exemplary embodiment, the first candidate cell is different from the third candidate cell, and the first access network device requests configuration of the first candidate cell and simultaneously instructs to determine the key of the first candidate cell based on the third candidate cell.

[0322] In the second implementation method, the second access network device responds to the first request message and determines the cell for key derivation by itself, and indicates it to the first access network device through the first response message in S703; then, the first access network device indicates the cell for key derivation to the terminal through S704.

[0323] At this time, the first response message also includes the first key information and information of the third candidate cell corresponding to the first key information, and the information of the third candidate cell is used to obtain or determine the security key corresponding to the first candidate cell; wherein, the third candidate cell is the same as or different from the first candidate cell.

[0324] Exemplarily, the first candidate cell is the same as the third candidate cell, and the second access network device sends the configuration of the first candidate cell to the first access network device, and indicates that the key of the first candidate cell is also determined based on the first candidate cell.

[0325] In another exemplary embodiment, the first candidate cell is different from the third candidate cell, and the second access network device sends the configuration of the first candidate cell to the first access network device, and at the same time instructs to determine the key of the first candidate cell based on the third candidate cell.

[0326] Example 4

[0327] FIG8 is a flow chart of a communication method according to a fourth embodiment of the present application. As shown in FIG8 , the method includes:

[0328] S901: A first access network device (eg, a source base station) decides to configure LTM and sends a first request message to a second access network device (eg, a candidate base station). Accordingly, the second access network device receives the first request message from the first access network device.

[0329] The first request message is used to request the configuration of the first candidate cell, and the first request message is also used to indicate the key information corresponding to the first candidate cell. For example, the first request message includes: a security key corresponding to the first candidate cell and cell information corresponding to the security key, and the cell information corresponding to the security key is used as an input parameter for deducing the security key, for example, the first candidate cell. For the specific content of the first request message, please refer to the UE context establishment request message in Figure 3 above. The first request message also includes key information (such as NCC) for deducing the security key.

[0330] Exemplarily, the first request message includes: an identifier of the first candidate cell and LTM configuration request information; wherein, the identifier of the first candidate cell is used to indicate a request for LTM configuration of the first candidate cell or a request for a cell as a candidate cell; and the LTM configuration request information is used to request LTM configuration.

[0331] In S901, the derivation of the key information (such as NCC) of the security key includes multiple acquisition methods, as follows:

[0332] Acquisition method A: The first access network device uses key information (such as the first NCC) as the key information for deducing the security key. The first NCC is the NCC corresponding to the source cell, which is the key information of the terminal device and is used to identify the first NH.

[0333] Acquisition method B: The first access network device acquires from the core network device. For example, FIG8 further includes the following steps S1001 and S1002A (or S1002B):

[0334] S1001: A first access network device sends a third request message to a core network device (eg, AMF). Correspondingly, the core network device receives the third request message from the first access network device.

[0335] The third request message is used to request key information, and includes an identifier of the first candidate cell and / or key request information, wherein the key information corresponds to the first candidate cell.

[0336] S1002A: The core network device sends first key information (eg, a second NCC) and second key information (eg, a second NH) to the first access network device.

[0337] Correspondingly, the first access network device receives the first key information and the second key information from the core network device.

[0338] Alternatively, S1002B, the core network device sends first key information (eg, second NCC), first extended key information (eg, first H-NCC), and second key information (eg, second NH) to the first access network device.

[0339] Accordingly, the first access network device receives the first key information, the first extended key information, and the second key information from the core network device. The first key information and the first extended key information are used to jointly identify the second key information. When the number of candidate base stations is greater than the number of NCCs, additional extended key information is required to identify the second key information using the first key information and the first extended key information to avoid key misalignment.

[0340] S902: The second access network device sends the configuration of the first candidate cell to the first access network device. Correspondingly, the first access network device receives the configuration of the first candidate cell from the second access network device.

[0341] Wherein, referring to the introduction of the aforementioned Figure 3, the configuration of the first candidate cell includes at least one of the following information: the lower layer RRC configuration, TCI state configuration, RACH resource configuration and RS configuration corresponding to the first candidate cell. The configuration of the first candidate cell also includes the key information corresponding to the first candidate cell. In this way, when the terminal receives the configuration of the first candidate cell, the terminal can obtain the key information from the configuration of the first candidate cell, and then the terminal can obtain the security key corresponding to the first candidate cell based on the key information (for example, the first NCC, or the second NCC, or the second NCC and the first H-NCC). For example, the terminal obtains the second K based on the first NH corresponding to the first NCC (or the second NH corresponding to the second NCC, or the second NH corresponding to the second NCC and the first H-NCC), the PCI of the first candidate cell and the downlink frequency of the first candidate cell. gNB ; Using the second K gNB Provide security protection for data between the terminal and the candidate base station.

[0342] S903, the first access network device sends the first list information, first key information, and second indication information to the terminal according to the first response message. Correspondingly, the terminal receives the first list information, first key information, and second indication information from the first access network device.

[0343] (7-1) The first list is used to indicate at least one cell information, including an identifier of a first candidate cell. It should be noted that the first list may include only one candidate cell identifier, i.e., the identifier of the first candidate cell, or may include identifiers of multiple candidate cells, where the multiple candidate cells include the first candidate cell. In one possible embodiment, the first list also includes an identifier of a second candidate cell described in subsequent S1001.

[0344] (7-2) Key information corresponding to the first candidate cell. The key information (e.g., the first NCC, the second NCC, or the second NCC and the first H-NCC) is used to identify the second key information (e.g., the first NH or the second NH). It can be understood that the first NH or the second NH serves as one of the input parameters for key derivation of the first list, and the key information corresponds to the first list. The first NCC is the NCC used by the first access network device. The second NCC is the NCC obtained by the first access network device from the core network device.

[0345] (7-3), the second indication information is used to indicate that the input parameters of the key deduction correspond to the first candidate cell. It can be understood that the PCI and downlink frequency of the first candidate cell are used as the input parameters for the key deduction of the first list. The cells in the first list all use the same security key. The specific deduction method is described above.

[0346] Exemplarily, the second indication information includes an identifier of the first candidate cell, and the identifier of the first candidate cell indicates that an input parameter for key derivation corresponds to the first candidate cell.

[0347] In another exemplary embodiment, the second indication information is used to indicate the first candidate cell as the cell for key derivation in the first list, so as to indicate that the PCI and downlink frequency of the first candidate cell are used as input parameters for key derivation in the first list.

[0348] It should be noted that the embodiment of the present application does not limit the form of the second indication information and the specific information included in the second indication information.

[0349] S904: The first access network device decides to perform LTM on the candidate cell and sends a first handover message to the terminal. Correspondingly, the terminal receives the first handover message from the first access network device.

[0350] The first handover message is used to instruct the terminal device to switch to the target cell. The first handover message is transmitted via a MAC control element (CE). The target cell is the first candidate cell or the second candidate cell introduced in the subsequent S1001. It can be understood that the candidate cell to which the terminal device switches is now called the target cell, and the base station corresponding to the target cell is now called the target base station. For the specific content of the first handover message, see the LTM command in Figure 3 above.

[0351] S905: The terminal accesses the target cell.

[0352] For details on accessing the target cell, please refer to the introduction in FIG3 .

[0353] S906: The terminal communicates with the second access network device in the target cell according to the security key.

[0354] The terminal derives the security key corresponding to the target cell based on the first key information and the second indication information received in S903. The specific derivation method is described above. It is understandable that the terminal uses the same security key when accessing the first candidate cell or the second candidate cell.

[0355] In addition, the security key used by the second access network device is indicated by the first request message in S901. It can be understood that the second access network device uses the same security key when the terminal accesses the first candidate cell or the second candidate cell.

[0356] As described in Example 4, the first access network device derives a security key for a candidate cell for the second access network device. Then, while requesting configuration of the first candidate cell from the second access network device via a first request message, the first access network device provides key information and the security key to the second access network device. This ensures data security in the inter-gNB LTM after LTM is switched to the second network device.

[0357] In an optional embodiment, before S903, the first access network device further requests the second access network device for configuration of the second candidate cell, including the following steps S1101 and S1102:

[0358] S1101: A first access network device (eg, a source base station) sends a second request message to a second access network device (eg, a candidate base station). Correspondingly, the second access network device receives the second request message from the first access network device.

[0359] The second request message is used to request configuration of a second candidate cell or to request a cell as a candidate cell. For the specific content of the second request message, refer to the UE context establishment request message in FIG. 3 .

[0360] Exemplarily, the second request message includes: an identifier of the second candidate cell and LTM configuration request information; wherein the identifier of the second candidate cell is used to indicate a request for LTM configuration of the second candidate cell; and the LTM configuration request information is used to request LTM configuration.

[0361] It should be noted that the embodiment of the present application does not limit the form of the second request information, nor the specific information included in the second request information.

[0362] S1102: The second access network device sends the configuration of the second candidate cell and first indication information to the first access network device. Correspondingly, the first access network device receives the configuration of the second candidate cell and the first indication information from the second access network device.

[0363] It can be understood that the second access network device determines that the second candidate cell and the first candidate cell use the same security key.

[0364] Exemplarily, the first indication information is used to indicate key information corresponding to the second candidate cell; wherein the key information corresponding to the second candidate cell is the same as the key information corresponding to the first candidate cell. The first indication information can be a direct indication, for example, a newly added parameter, or an implicit indication, for example, the key information parameter is not carried.

[0365] In another exemplary embodiment, the first indication information is used to indicate that the key information corresponding to the second candidate cell is the same as the key information corresponding to the first candidate cell.

[0366] In another exemplary embodiment, the configuration of the second candidate cell also includes the first indication information. In this way, when the first access network device sends the configuration of the second candidate cell to the terminal, the terminal can obtain the first indication information from the configuration of the second candidate cell, and then the terminal can determine, based on the first indication information, that the second candidate cell shares the corresponding security key of the first candidate cell.

[0367] Through the contents introduced in S1101 and S1102, the first candidate cell and the second candidate cell use the same key, so that in the scenario of moving within the second network device, there is no need to update the key, thereby reducing the switching delay within the base station.

[0368] Based on S905, after the terminal switches to the candidate cell corresponding to the second access network device, the second access network device obtains or determines key information for a candidate access network device of the second access network device (e.g., a third access network device) to deduce the security key of the candidate cell corresponding to the third access network device. For example, FIG8 further includes the following steps S1201 and S1202A (or S1202B):

[0369] S1201: A second access network device sends a fourth request message to a core network device. Correspondingly, the core network device receives the fourth request message from the second access network device.

[0370] S1202A: The core network device sends third key information (eg, third NCC) and fourth key information (eg, third NH) to the second access network device. Correspondingly, the second access network device receives the third key information and fourth key information from the core network device.

[0371] The third key information is used to identify the fourth key information, and the fourth key information is used for security protection of data between the terminal and the third access network device.

[0372] Alternatively, in S1202B, the core network device sends third key information (e.g., a third NCC), second extended key information (e.g., a second H-NCC), and fourth key information (e.g., a third NH) to the second access network device. Correspondingly, the second access network device receives the third key information, second extended key information (e.g., a second H-NCC), and fourth key information from the core network device.

[0373] The third key information and the second extended key information are used to jointly identify the fourth key information, and the fourth key information is used for security protection of data between the terminal and the third access network device.

[0374] Illustratively, the second H-NCC is the same as or different from the first H-NCC in S1002B.

[0375] In another example, the third NCC is different from the second NCC and the first NCC in the aforementioned S901 .

[0376] The above mainly introduces the solution provided by the embodiment of the present application from the perspective of the interaction between the terminal and the network device. It is understandable that in order to implement the above functions, the terminal and the network device may include hardware structures and / or software modules corresponding to the execution of each function. Those skilled in the art should easily appreciate that, in combination with the units and algorithm steps of each example described in the embodiments disclosed herein, the embodiments of the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in a hardware or computer software driven hardware manner depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0377] In the embodiments of the present application, the network device can be divided into functional units according to the above method examples. For example, each functional unit can be divided according to each function, or two or more functions can be integrated into one unit. The above integrated unit can be implemented in the form of hardware or software functional units.

[0378] In the case of adopting an integrated unit, Figure 9 shows a possible exemplary block diagram of the device involved in the embodiments of the present application. As shown in Figure 9, the device 900 may include: a processing unit 902 and a communication unit 903. The processing unit 902 is used to control and manage the actions of the device 900. The communication unit 903 is used to support the communication between the device 900 and other devices. Optionally, the communication unit 903 is also called a transceiver unit, and may include a receiving unit and / or a sending unit, which are used to perform receiving and sending operations respectively. The device 900 may also include a storage unit 901 for storing program code and / or data of the device 900.

[0379] (1) The apparatus 900 may be the second access network device in the above-described embodiments. The processing unit 902 may support the apparatus 900 in executing the actions of the second access network device in the above-described embodiment 1 or embodiment 3. Alternatively, the processing unit 902 may primarily execute the internal actions of the second access network device in the method example, and the communication unit 903 may support communication between the apparatus 900 and other devices.

[0380] For example, in one embodiment, the communication unit 903 is used to receive a first request message from a first access network device, where the first request message is used to request the configuration of a first candidate cell; the processing unit 902 is used to obtain first key information and second key information from a core network device based on the first request message, where the first key information is used to identify the second key information, and the second key information is used for security protection of data between the terminal device and the second access network device; wherein the first key information and the second key information correspond to the first candidate cell; the communication unit 903 is used to send a first response message to the first access network device, where the first response message includes the configuration of the first candidate cell and the first key information.

[0381] In one possible design, the communication unit 903 is also used to: receive a second request message from the first access network device, the second request message is used to request the configuration of a second candidate cell; send the configuration of the second candidate cell and first indication information to the first access network device, the first indication information is used to indicate the key information corresponding to the second candidate cell; wherein the key information corresponding to the second candidate cell is the same as the key information corresponding to the first candidate cell.

[0382] In one possible design, the first request message includes key request information, and the key request information is used to request the second access network device to obtain the security key corresponding to the first candidate cell.

[0383] In one possible design, the key request information includes information of a third candidate cell, and the information of the third candidate cell is used to obtain the security key corresponding to the first candidate cell; wherein the third candidate cell is the same as or different from the first candidate cell.

[0384] In one possible design, the first response message also includes information of a third candidate cell corresponding to the first key information, and the information of the third candidate cell is used to obtain the security key corresponding to the first candidate cell; wherein the third candidate cell is the same as or different from the first candidate cell.

[0385] In one possible design, the processing unit 902 is also used to deduce the security key corresponding to the first candidate cell based on the second key information, the PCI of the third candidate cell and the downlink frequency of the third candidate cell; the communication unit 903 is also used to receive data from the terminal device and process the data of the terminal device according to the security key corresponding to the first candidate cell.

[0386] In one possible design, the processing unit 902 is used to obtain the first key information and the second key information from the core network device based on the first request message, specifically used to: send a third request message to the core network device through the communication unit 903 based on the first request message, and the third request message is used to request the key information corresponding to the first candidate cell; receive the first key information and the second key information from the core network device through the communication unit 903.

[0387] (2) The apparatus 900 may be the first access network device in the above-described embodiment. The processing unit 902 may support the apparatus 900 in executing the actions of the first access network device in the above-described embodiment 1 or embodiment 3. Alternatively, the processing unit 902 may primarily execute the internal actions of the first access network device in the method example, and the communication unit 903 may support communication between the apparatus 900 and other devices.

[0388] For example, in one embodiment, the communication unit 903 is used to: send a first request message to a second access network device, where the first request message is used to request the configuration of a first candidate cell; receive a first response message from the second access network device, where the first response message includes the configuration of the first candidate cell and first key information; wherein the first key information corresponds to the first candidate cell.

[0389] In one possible design, the communication unit 903 is also used to: send a second request message to the second access network device, the second request message is used to request the configuration of the second candidate cell; receive the configuration and first indication information of the second candidate cell from the second access network device, the first indication information is used to indicate the key information corresponding to the second candidate cell; wherein the key information corresponding to the second candidate cell is the same as the key information corresponding to the first candidate cell.

[0390] In one possible design, the first request message includes key request information, and the key request information is used to request the second access network device to obtain the security key corresponding to the first candidate cell.

[0391] In one possible design, the key request information includes information of a third candidate cell, and the information of the third candidate cell is used to obtain the security key corresponding to the first candidate cell; wherein the third candidate cell is the same as or different from the first candidate cell.

[0392] In one possible design, the first response message also includes information of a third candidate cell corresponding to the first key information, and the information of the third candidate cell is used to obtain the security key corresponding to the first candidate cell; wherein the third candidate cell is the same as or different from the first candidate cell.

[0393] In one possible design, the communication unit 903 is also used to: send information of a first list, the first key information, and second indication information to a terminal device; wherein the first list includes identifiers of multiple candidate cells, and the multiple candidate cells include a first candidate cell; the first list corresponds to the first key information; the second indication information is used to indicate that the input parameters of the key derivation correspond to the first candidate cell; and send a first switching message to the terminal device, and the first switching message is used to instruct the terminal device to switch to a candidate cell in the first list.

[0394] In one possible design, the communication unit 903 is further used to send a second switching message to the second access network device, where the second switching message is used to indicate that a switch has been initiated to a candidate cell in the first list.

[0395] (3) The apparatus 900 may be a terminal in the above-described embodiment. The processing unit 902 may support the apparatus 900 in executing the actions of the terminal device in the above-described embodiment 1 or embodiment 3. Alternatively, the processing unit 902 may primarily execute the internal actions of the terminal device in the method example, and the communication unit 903 may support communication between the apparatus 900 and other devices.

[0396] For example, in one embodiment, the communication unit 903 is used to: receive information from a first list, first key information, and second indication information from a first access network device; wherein the first list includes identifiers of multiple candidate cells, and the multiple candidate cells include a first candidate cell; the second indication information is used to indicate that the input parameters of the key deduction correspond to the first candidate cell; receive a first switching message from the first access network device, and the first switching message is used to instruct the terminal device to switch to a candidate cell in the first list; access a candidate cell in the first list; deduce the security key corresponding to the first candidate cell based on the first key information and the second indication information; the processing unit 902 is used to: communicate with the second access network device on a candidate cell in the first list based on the security key.

[0397] In one possible design, the processing unit 902 is used to: deduce the security key corresponding to the first candidate cell based on the first key information and the second indication information, specifically to: deduce the security key corresponding to the first candidate cell based on the second key information corresponding to the first key information, the PCI of the first candidate cell and the downlink frequency of the first candidate cell.

[0398] (4) The apparatus 900 may be a core network device (e.g., AMF) in the above-mentioned embodiments. The processing unit 902 may support the apparatus 900 in executing the actions of the core network device (e.g., AMF) in the above-mentioned embodiments 1 or 2. Alternatively, the processing unit 902 may primarily execute the internal actions of the core network device in the method example, and the communication unit 903 may support communication between the apparatus 900 and other devices.

[0399] For example, in one embodiment, the communication unit 903 is used to: receive a third request message from a second access network device, wherein the third request message is used to request key information; and send first key information and second key information to the second access network device; wherein the first key information is used to identify the second key information, and the second key information is used for security protection of data between the terminal device and the second access network device.

[0400] In one possible design, the third request message also includes information of a third candidate cell corresponding to the first key information, and the information of the third candidate cell is used to obtain the security key corresponding to the first candidate cell; wherein the third candidate cell is the same as or different from the first candidate cell.

[0401] (5) The apparatus 900 may be the first access network device in the above-described embodiment. The processing unit 902 may support the apparatus 900 in executing the actions of the first access network device in the above-described embodiment 2 or embodiment 4. Alternatively, the processing unit 902 may primarily execute the internal actions of the first access network device in the method example, and the communication unit 903 may support communication between the apparatus 900 and other devices.

[0402] For example, in one embodiment, the communication unit 903 is used to: send a first request message to a second access network device, where the first request message is used to request the configuration of a first candidate cell, and the first request message is also used to indicate the key information corresponding to the first candidate cell; and receive the configuration of the first candidate cell from the second access network device.

[0403] In one possible design, the communication unit 903 is also used to: send a second request message to the second access network device, the second request message is used to request the configuration of the second candidate cell; receive the configuration and first indication information of the second candidate cell from the second access network device, the first indication information is used to indicate the key information corresponding to the second candidate cell; wherein the key information corresponding to the second candidate cell is the same as the key information corresponding to the first candidate cell.

[0404] In one possible design, the first request message includes: information about the first security key corresponding to the first candidate cell and the cell corresponding to the first security key; wherein the information about the first security key corresponding to the first candidate cell and the cell corresponding to the first security key is used to indicate the key information corresponding to the first candidate cell.

[0405] In one possible design, the cell corresponding to the first security key is the first candidate cell, and the processing unit 902 is used to: deduce the first security key based on the second key information corresponding to the first key information, the PCI of the first candidate cell, and the downlink frequency of the first candidate cell; wherein the first key information is used to identify the second key information, and the second key information is used for security protection of data between the terminal device and the second access network device; the first key information and the second key information correspond to the first candidate cell.

[0406] In one possible design, the communication unit 903 is also used to: send a third request message to the core network device, wherein the third request message is used to request the key information corresponding to the first candidate cell; receive the first key information and the second key information from the core network device; or, the processing unit 902 is used to: determine the key information corresponding to the second security key as the first key information; wherein the second security key corresponds to the source cell.

[0407] In one possible design, the first request message also includes: the first key information.

[0408] In one possible design, the communication unit 903 is also used to: send a first list information, the first key information, and second indication information to the terminal device; wherein the first list includes identifiers of multiple candidate cells, and the multiple candidate cells include the first candidate cell; the first list corresponds to the first key information; the second indication information is used to indicate that the input parameters of the key derivation correspond to the first candidate cell; and send a first switching message to the terminal device, and the first switching message is used to instruct the terminal device to switch to a candidate cell in the first list.

[0409] In one possible design, the cell corresponding to the first security key is the first candidate cell, and the processing unit 902 is further used to: deduce the first security key based on the second key information, the PCI of the first candidate cell, and the downlink frequency of the first candidate cell; wherein the second key information is jointly identified by the first key information and the first extended key information, and the second key information is used for security protection of data between the terminal device and the second access network device; the first key information and the second key information correspond to the first candidate cell.

[0410] In one possible design, the communication unit 903 is also used to: send a third request message to the core network device, wherein the third request message is used to request the key information corresponding to the first candidate cell; receive the first key information, the first extended key information and the second key information from the core network device; or, the processing unit 902 is used to determine the key information corresponding to the second security key as the first key information; wherein the second security key corresponds to the source cell.

[0411] In one possible design, the first request message also includes: the first key information and the first extended key information.

[0412] In one possible design, the communication unit 903 is also used to: send information of a first list, the first key information, the first extended key information, and second indication information to the terminal device; wherein the first list includes identifiers of multiple candidate cells, and the multiple candidate cells include the first candidate cell; the first list corresponds to the first key information and the first extended key information; the second indication information is used to indicate that the input parameters of key derivation correspond to the first candidate cell; and send a first switching message to the terminal device, and the first switching message is used to instruct the terminal device to switch to a candidate cell in the first list.

[0413] In one possible design, the communication unit 903 is further used to: send a second switching message to the second access network device, where the second switching message is used to indicate that a switch has been initiated to a candidate cell in the first list.

[0414] (6) The apparatus 900 may be the second access network device in the above-described embodiments. The processing unit 902 may support the apparatus 900 in executing the actions of the second access network device in the above-described second or fourth embodiments. Alternatively, the processing unit 902 may primarily execute the internal actions of the second access network device in the method examples, and the communication unit 903 may support communication between the apparatus 900 and other devices.

[0415] For example, in one embodiment, the communication unit 903 is used to: receive a first request message from a first access network device, where the first request message is used to request the configuration of a first candidate cell, and the first request message is also used to indicate the key information corresponding to the first candidate cell; and send the configuration of the first candidate cell to the first access network device.

[0416] In one possible design, the communication unit 903 is also used to: receive a second request message from the first access network device, the second request message is used to request the configuration of a second candidate cell; send the configuration of the second candidate cell and first indication information to the first access network device, the first indication information is used to indicate the key information corresponding to the second candidate cell; wherein the key information corresponding to the second candidate cell is the same as the key information corresponding to the first candidate cell.

[0417] In one possible design, the first request message includes: information about the first security key corresponding to the first candidate cell and the cell corresponding to the first security key; wherein the information about the first security key corresponding to the first candidate cell and the cell corresponding to the first security key is used to indicate the key information corresponding to the first candidate cell.

[0418] In one possible design, the first request message also includes: first key information; wherein, the first key information is used to identify second key information, and the second key information is used for security protection of data between the terminal device and the second access network device.

[0419] In one possible design, the first request message also includes: first key information and first extended key information; wherein, the first key information and the first extended key information are used to jointly identify second key information, and the second key information is used for security protection of data between the terminal device and the second access network device.

[0420] In one possible design, the communication unit 903 is further used to: receive a second switching message from the first access network device, where the second switching message is used to indicate that a switch has been initiated to a candidate cell included in the second access device.

[0421] In one possible design, the communication unit 903 is also used to: send a fourth request message to the core network device; receive third key information and fourth key information from the core network device; wherein the third key information is used to identify the fourth key information, and the fourth key information is used for security protection of data between the terminal device and the third access network device.

[0422] In one possible design, the communication unit 903 is also used to: send a fourth request message to the core network device; receive third key information, second extended key information and fourth key information from the core network device; wherein the third key information and the second extended key information are used to identify the fourth key information, and the fourth key information is used for security protection of data between the terminal device and the third access network device.

[0423] (7) The apparatus 900 may be a terminal in the aforementioned embodiment. The processing unit 902 may support the apparatus 900 in executing the actions of the terminal device in the second or fourth embodiment above. Alternatively, the processing unit 902 may primarily execute the internal actions of the terminal device in the method example, and the communication unit 903 may support communication between the apparatus 900 and other devices.

[0424] For example, in one embodiment, the communication unit 903 is used to: receive information from a first list, first key information, and second indication information from a first access network device; wherein the first list includes identifiers of multiple candidate cells, and the multiple candidate cells include a first candidate cell; the second indication information is used to indicate that the input parameters of the key deduction correspond to the first candidate cell; receive a first switching message from the first access network device, and the first switching message is used to instruct the terminal device to switch to the candidate cell in the first list; the processing unit 902 is used to: access a candidate cell in the first list; deduce the security key corresponding to the first candidate cell based on the first key information and the second indication information; and communicate with the second access network device on a candidate cell in the first list based on the security key.

[0425] In one possible design, the processing unit 902 is used to deduce the security key corresponding to the first candidate cell based on the first key information and the second indication information, and is specifically used to deduce the security key corresponding to the first candidate cell based on the second key information corresponding to the first key information, the PCI of the first candidate cell and the downlink frequency of the first candidate cell.

[0426] (8) The apparatus 900 may be a terminal in the aforementioned embodiment. The processing unit 902 may support the apparatus 900 in executing the actions of the terminal device in the second or fourth embodiment above. Alternatively, the processing unit 902 may primarily execute the internal actions of the terminal device in the method example, and the communication unit 903 may support communication between the apparatus 900 and other devices.

[0427] For example, in one embodiment, the communication unit 903 is used to: receive information from a first list, first key information and first extended key information, and second indication information from a first access network device; wherein the first list includes identifiers of multiple candidate cells, and the multiple candidate cells include a first candidate cell; the second indication information is used to indicate that the input parameters of the key deduction correspond to the first candidate cell; receive a first switching message from the first access network device, and the first switching message is used to instruct the terminal device to switch to a candidate cell in the first list; the processing unit 902 is used to: access a candidate cell in the first list; deduce the security key corresponding to the first candidate cell based on the first key information, the first extended key information and the second indication information; and communicate with the second access network device on a candidate cell in the first list based on the security key.

[0428] In one possible design, the processing unit 902 is used to: deduce the security key corresponding to the first candidate cell based on the first key information, the first extended key information and the second indication information, and specifically to: deduce the security key corresponding to the first candidate cell based on the second key information, the PCI of the first candidate cell and the downlink frequency of the first candidate cell; wherein the second key information is jointly identified by the first key information and the first extended key information.

[0429] (9) The apparatus 900 may be a terminal in the aforementioned embodiment. The processing unit 902 may support the apparatus 900 in executing the actions of the terminal device in the second or fourth embodiment above. Alternatively, the processing unit 902 may primarily execute the internal actions of the terminal device in the method example, and the communication unit 903 may support communication between the apparatus 900 and other devices.

[0430] For example, in one embodiment, the communication unit 903 is used to: receive a third request message from a first access network device, wherein the third request message is used to request key information corresponding to the first candidate cell; and send first key information and second key information to the first access network device; wherein the first key information is used to identify the second key information, and the second key information is used for security protection of data between the terminal device and the second access network device.

[0431] Alternatively, in another embodiment, the communication unit 903 is used to: receive a third request message from the first access network device, wherein the third request message is used to request key information corresponding to the first candidate cell; and send first key information, first extended key information, and second key information to the first access network device; wherein the first key information and the first extended key information are used to jointly identify the second key information, and the second key information is used for security protection of data between the terminal device and the second access network device.

[0432] Alternatively, in one embodiment, the communication unit 903 is used to: receive a fourth request message from the second access network device, wherein the fourth request message is used to request key information; and send third key information and fourth key information to the first access network device; wherein the third key information is used to identify the fourth key information, and the fourth key information is used for security protection of data between the terminal device and the third access network device.

[0433] Alternatively, in another embodiment, the communication unit 903 is used to: receive a fourth request message from the second access network device, wherein the fourth request message is used to request key information; and send third key information, second extended key information and fourth key information to the first access network device; wherein the third key information and the second extended key information are used to jointly identify the fourth key information, and the fourth key information is used for security protection of data between the terminal device and the third access network device.

[0434] It should be understood that the division of units in the above device is merely a division of logical functions. In actual implementation, they can be fully or partially integrated into one physical entity, or they can be physically separated. Moreover, the units in the device can all be implemented in the form of software calling through processing elements; or they can all be implemented in the form of hardware; or some units can be implemented in the form of software calling through processing elements, and some units can be implemented in the form of hardware. For example, each unit can be a separately established processing element, or it can be integrated into a certain chip of the device. In addition, it can also be stored in the memory in the form of a program, called by a certain processing element of the device and execute the function of the unit. In addition, all or part of these units can be integrated together, or they can be implemented independently. The processing element described here can also be a processor, which can be an integrated circuit with signal processing capabilities. In the implementation process, each operation of the above method or each unit above can be implemented by the integrated logic circuit of the hardware in the processor element or in the form of software calling through the processing element.

[0435] In one example, the unit in any of the above devices may be one or more integrated circuits configured to implement the above method, such as one or more application specific integrated circuits (ASICs), one or more digital singnal processors (DSPs), one or more field programmable gate arrays (FPGAs), or a combination of at least two of these integrated circuit forms. For another example, when the unit in the device can be implemented in the form of a processing element scheduler, the processing element can be a processor, such as a general-purpose central processing unit (CPU), or other processor that can call a program. For another example, these units can be integrated together and implemented in the form of a system-on-a-chip (SOC).

[0436] The above-mentioned receiving unit is an interface circuit of the device, which is used to receive signals from other devices. For example, when the device is implemented as a chip, the receiving unit is the interface circuit of the chip used to receive signals from other chips or devices. The above-mentioned sending unit is an interface circuit of the device, which is used to send signals to other devices. For example, when the device is implemented as a chip, the sending unit is the interface circuit of the chip used to send signals to other chips or devices.

[0437] Based on the above embodiments, embodiments of the present application further provide a communication device. Referring to FIG. 10 , the communication device 1000 may include a transceiver 1001 and a processor 1002. Optionally, the communication device 1000 may further include a memory 1003. The memory 1003 may be disposed within the communication device 1000 or external to the communication device 1000. The processor 1002 may control the transceiver 1001 to receive and send messages, etc.

[0438] Specifically, the processor 1002 may be a central processing unit (CPU), a network processor (NP), or a combination of a CPU and an NP. The processor 1002 may further include a hardware chip. The hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof. The PLD may be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof.

[0439] The transceiver 1001, the processor 1002, and the memory 1003 are interconnected. Optionally, the transceiver 1001, the processor 1002, and the memory 1003 are interconnected via a bus 1004; the bus 1004 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus. The bus may be divided into an address bus, a data bus, a control bus, and the like. For ease of representation, FIG10 shows only one thick line, but this does not mean that there is only one bus or one type of bus.

[0440] In an optional embodiment, the memory 1003 is used to store programs, etc. Specifically, the programs may include program code, which includes computer operating instructions. The memory 1003 may include RAM, or may also include non-volatile memory (non-volatile memory), such as one or more disk storage devices. The processor 1002 executes the application program stored in the memory 1003 to implement the above functions, thereby realizing the functions of the communication device 1000.

[0441] Exemplarily, the communication device 1000 may be the first DU in the above embodiment; or the second DU in the above embodiment.

[0442] In one embodiment, when the communication device 1000 implements the functions of the first DU in the above method embodiment, the transceiver 1001 may implement the transceiver operations performed by the first DU in the above method embodiment; and the processor 1002 may implement other operations performed by the first DU in the above method embodiment except for the transceiver operations. For specific details, please refer to the relevant descriptions in the above embodiments and will not be described in detail here.

[0443] In another embodiment, when the communication device 1000 implements the functions of the second DU in the above method embodiment, the transceiver 1001 may implement the transceiver operations performed by the second DU in the above method embodiment; and the processor 1002 may implement other operations performed by the second DU in the above method embodiment in addition to the transceiver operations. For specific details, please refer to the relevant descriptions in the above embodiments and will not be described in detail here.

[0444] The terms "system" and "network" in the embodiments of the present application can be used interchangeably. "At least one" refers to one or more, and "plurality" refers to two or more. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent: the existence of A alone, the existence of A and B at the same time, and the existence of B alone, where A and B can be singular or plural. The character " / " generally indicates that the associated objects before and after are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, "at least one of A, B and C" includes A, B, C, AB, AC, BC or ABC. And, unless otherwise specified, the ordinal numbers such as "first" and "second" mentioned in the embodiments of the present application are used to distinguish multiple objects, and are not used to limit the order, timing, priority or importance of multiple objects.

[0445] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0446] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each flow and / or box in the flow chart and / or block diagram, as well as the combination of the flow chart and / or box in the flow chart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device produce a device for implementing the functions specified in one or more flow charts and / or one or more boxes in the block diagram.

[0447] These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a product including an instruction device that implements the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0448] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, so that the instructions executed on the computer or other programmable device provide steps for implementing the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0449] Obviously, those skilled in the art may make various changes and modifications to this application without departing from the spirit and scope of this application. Thus, if these modifications and variations of this application fall within the scope of the claims of this application and their equivalents, this application is intended to include these modifications and variations.

Claims

1. A communication method, characterized in that: Applicable to the second access network equipment, including: receiving a first request message from a first access network device, where the first request message is used to request configuration of a first candidate cell; Acquire, according to the first request message, first key information and second key information from a core network device, where the first key information is used to identify the second key information, and the second key information is used for security protection of data between the terminal device and the second access network device; wherein the first key information and the second key information correspond to the first candidate cell; A first response message is sent to the first access network device, where the first response message includes the configuration of the first candidate cell and the first key information.

2. The method according to claim 1, characterized in that The method further comprises: receiving a second request message from the first access network device, where the second request message is used to request configuration of a second candidate cell; Send the configuration of the second candidate cell and first indication information to the first access network device, where the first indication information is used to indicate the key information corresponding to the second candidate cell; wherein the key information corresponding to the second candidate cell is the same as the key information corresponding to the first candidate cell.

3. The method according to claim 1 or 2, characterized in that: The first request message includes key request information, and the key request information is used to request the second access network device to obtain the security key corresponding to the first candidate cell.

4. The method according to claim 3, characterized in that The key request information includes information of a third candidate cell, and the information of the third candidate cell is used to obtain a security key corresponding to the first candidate cell; wherein the third candidate cell is the same as or different from the first candidate cell.

5. The method according to any one of claims 1 to 3, characterized in that The first response message also includes information of a third candidate cell corresponding to the first key information, where the information of the third candidate cell is used to obtain a security key corresponding to the first candidate cell; wherein the third candidate cell is the same as or different from the first candidate cell.

6. The method according to claim 4 or 5, characterized in that: The method further comprises: Deducing a security key corresponding to the first candidate cell according to the second key information, the PCI of the third candidate cell, and the downlink frequency of the third candidate cell; Receive data from the terminal device, and process the data of the terminal device according to the security key corresponding to the first candidate cell.

7. The method according to any one of claims 1 to 3, characterized in that The acquiring, according to the first request message, the first key information and the second key information from the core network device includes: Sending a third request message to the core network device according to the first request message, where the third request message is used to request key information corresponding to the first candidate cell; Receive the first key information and the second key information from the core network device.

8. A communication method, characterized in that: Applied to a first access network device, the method includes: Sending a first request message to the second access network device, where the first request message is used to request configuration of the first candidate cell; A first response message is received from the second access network device, where the first response message includes the configuration of the first candidate cell and first key information; wherein the first key information corresponds to the first candidate cell.

9. The method according to claim 8, characterized in that The method further comprises: Sending a second request message to the second access network device, where the second request message is used to request configuration of a second candidate cell; Receive the configuration of the second candidate cell and first indication information from the second access network device, where the first indication information is used to indicate the key information corresponding to the second candidate cell; wherein the key information corresponding to the second candidate cell is the same as the key information corresponding to the first candidate cell.

10. The method according to claim 8 or 9, characterized in that: The first request message includes key request information, and the key request information is used to request the second access network device to obtain the security key corresponding to the first candidate cell.

11. The method according to claim 10, characterized in that The key request information includes information of a third candidate cell, and the information of the third candidate cell is used to obtain a security key corresponding to the first candidate cell; wherein the third candidate cell is the same as or different from the first candidate cell.

12. The method according to any one of claims 8 to 10, characterized in that The first response message also includes information of a third candidate cell corresponding to the first key information, where the information of the third candidate cell is used to obtain a security key corresponding to the first candidate cell; wherein the third candidate cell is the same as or different from the first candidate cell.

13. The method according to any one of claims 8 to 12, characterized in that The method further comprises: Sending information of a first list, the first key information, and second indication information to a terminal device; wherein the first list includes identifiers of multiple candidate cells, and the multiple candidate cells include a first candidate cell; the first list corresponds to the first key information; and the second indication information is used to indicate that an input parameter of key derivation corresponds to the first candidate cell; A first switching message is sent to the terminal device, where the first switching message is used to instruct the terminal device to switch to a candidate cell in the first list.

14. The method according to claim 13, characterized in that The method further comprises: A second switching message is sent to the second access network device, where the second switching message is used to indicate that a switching has been initiated to a candidate cell in the first list.

15. A communication method, characterized in that: Applied to terminal equipment, including: Receiving information of a first list, first key information, and second indication information from a first access network device; wherein the first list includes identifiers of multiple candidate cells, and the multiple candidate cells include a first candidate cell; and the second indication information is used to indicate that an input parameter of key derivation corresponds to the first candidate cell; receiving a first switching message from the first access network device, where the first switching message is used to instruct the terminal device to switch to a candidate cell in the first list; Accessing a candidate cell in the first list; deducing a security key corresponding to the first candidate cell according to the first key information and the second indication information; Communicate with the second access network device on a candidate cell in the first list according to the security key.

16. The method according to claim 15, characterized in that The deducing, according to the first key information and the second indication information, a security key corresponding to the first candidate cell includes: A security key corresponding to the first candidate cell is derived based on the second key information corresponding to the first key information, the PCI of the first candidate cell, and the downlink frequency of the first candidate cell.

17. A communication method, characterized in that: Applied to a first access network device, the method includes: Sending a first request message to the second access network device, where the first request message is used to request configuration of a first candidate cell, and the first request message is also used to indicate key information corresponding to the first candidate cell; Receive the configuration of the first candidate cell from the second access network device.

18. The method according to claim 17, characterized in that The first request message includes: information about a first security key corresponding to the first candidate cell and a cell corresponding to the first security key; wherein the first security key corresponding to the first candidate cell and information about a cell corresponding to the first security key are used to indicate key information corresponding to the first candidate cell.

19. The method according to claim 18, characterized in that The cell corresponding to the first security key is the first candidate cell, and the method further includes: The first security key is deduced based on the second key information corresponding to the first key information, the PCI of the first candidate cell, and the downlink frequency of the first candidate cell; wherein the first key information is used to identify the second key information, and the second key information is used for security protection of data between the terminal device and the second access network device; the first key information and the second key information correspond to the first candidate cell.

20. The method according to claim 19, characterized in that The method further comprises: Sending a third request message to a core network device, where the third request message is used to request key information corresponding to the first candidate cell; receiving the first key information and the second key information from the core network device; or, The key information corresponding to the second security key is determined as the first key information; wherein the second security key corresponds to the source cell.

21. The method according to claim 18, characterized in that The cell corresponding to the first security key is the first candidate cell, and the method further includes: The first security key is deduced based on the second key information, the PCI of the first candidate cell, and the downlink frequency of the first candidate cell; wherein the second key information is jointly identified by the first key information and the first extended key information, and the second key information is used for security protection of data between the terminal device and the second access network device; the first key information and the second key information correspond to the first candidate cell.

22. A communication method, characterized in that: Applied to a second access network device, the method comprises: receiving a first request message from a first access network device, where the first request message is used to request configuration of a first candidate cell, and the first request message is also used to indicate key information corresponding to the first candidate cell; Send the configuration of the first candidate cell to the first access network device.

23. The method according to claim 22, characterized in that The method further comprises: Sending a fourth request message to the core network device; receiving third key information and fourth key information from the core network device; wherein the third key information is used to identify the fourth key information, and the fourth key information is used for security protection of data between the terminal device and the third access network device; or, Receive the third key information, the second extended key information and the fourth key information from the core network device; wherein the third key information and the second extended key information are used to jointly identify the fourth key information, and the fourth key information is used for security protection of data between the terminal device and the third access network device.

24. A communication method, characterized in that: Applied to a terminal device, the method comprises: Receiving information of a first list, first key information, and second indication information from a first access network device; wherein the first list includes identifiers of multiple candidate cells, and the multiple candidate cells include a first candidate cell; and the second indication information is used to indicate that an input parameter of key derivation corresponds to the first candidate cell; receiving a first switching message from the first access network device, where the first switching message is used to instruct the terminal device to switch to a candidate cell in the first list; Accessing a candidate cell in the first list; deducing a security key corresponding to the first candidate cell according to the first key information and the second indication information; Communicate with the second access network device on a candidate cell in the first list according to the security key.

25. A communication method, characterized in that: Applied to a terminal device, the method comprises: Receiving information of a first list, first key information, first extended key information, and second indication information from a first access network device; wherein the first list includes identifiers of multiple candidate cells, and the multiple candidate cells include a first candidate cell; and the second indication information is used to indicate that an input parameter of key derivation corresponds to the first candidate cell; receiving a first switching message from the first access network device, where the first switching message is used to instruct the terminal device to switch to a candidate cell in the first list; Accessing a candidate cell in the first list; deducing a security key corresponding to the first candidate cell according to the first key information, the first extended key information and the second indication information; Communicate with the second access network device on a candidate cell in the first list according to the security key.

26. A communication device, characterized in that: Comprising means for executing the method as claimed in any one of claims 1 to 25.

27. A communication device, characterized in that: It includes a processor, which is coupled to a memory, and a computer program is stored in the memory; the processor is used to call the computer program in the memory so that the communication device executes any method as claimed in claims 1 to 25.

28. A communication system, characterized in that: The communication system includes a first communication device, a second communication device and a third communication device; wherein the first communication device is used to execute the method described in any one of claims 1 to 7, the second communication device is used to execute the method described in any one of claims 8 to 14, and the third communication device is used to execute the method described in claim 15 or 16; or, the first communication device is used to execute the method described in any one of claims 17 to 21, the second communication device is used to execute the method described in claim 22 or 23, and the third communication device is used to execute the method described in claim 24 or 25.

29. A computer-readable storage medium, characterized in that: The storage medium stores a computer program or instruction, and when the computer program or instruction is executed by a computer, the method as claimed in any one of claims 1 to 25 is implemented.

30. A computer program product, characterized in that When a computer reads and executes the computer program product, the computer is enabled to execute the method according to any one of claims 1 to 25.

Images