Communication method, communication apparatus, and communication system

Abstract

A communication method, a communication apparatus, and a communication system. On the basis of the method, in a service flow offloading scenario, a first user plane anchor and a terminal device obtain a first session key, so that the terminal device and the first user plane anchor can perform end-to-end security protection on user plane data of a first session between the terminal device and the first user plane anchor on the basis of the first session key; and a second user plane anchor and the terminal device obtain a second session key, so that the terminal device and the second user plane anchor can perform end-to-end security protection on user plane data of a first session between the terminal device and the second user plane anchor on the basis of the second session key. Therefore, the method achieves security protection for user plane data between a terminal device and a plurality of user plane anchors in a service flow offloading scenario.

Description

Communication method, communication apparatus and communication system

[0001] Cross-reference to Related Applications

[0002] This application claims priority to the Chinese Patent Application No. 202410980860.X, filed on July 19, 2024, and entitled “A communication method, a communication apparatus and a communication system”, the content of which is incorporated herein by reference in its entirety. TECHNICAL FIELD

[0003] The present application relates to the field of communication technology, and in particular to a communication method, a communication apparatus and a communication system. BACKGROUND

[0004] In the current mobile communication network, the user plane data sent by the terminal device is sent to the user plane network element through the access network device, and the user plane data is protected by the security mechanism of each hop in the transmission process. Specifically:

[0005] (1) For the transmission of user plane data between the terminal device and the access network device, in the uplink direction, the terminal device sends the user plane data that has been encrypted and / or integrity protected to the access network device, and the access network device decrypts and / or integrity checks the user plane data using a decryption key and / or an integrity protection key; in the downlink direction, the access network device sends the user plane data that has been encrypted and / or integrity protected to the terminal device, and the terminal device decrypts and / or integrity checks the user plane data using a decryption key and / or an integrity protection key.

[0006] (2) For the transmission of user plane data between the access network device and the user plane network element, the access network device and the user plane network element (or the front security gateway of the user plane network element) establish an internet protocol security (IPsec) tunnel to encrypt and / or integrity protect the user plane data transmitted in the general packet radio service (GPRS) tunnelling protocol user plane (GTP-U) tunnel. In the uplink direction, the access network device sends the user plane data that has been encrypted and / or integrity protected to the user plane network element, and the user plane network element decrypts and / or integrity checks the user plane data using a decryption key and / or an integrity protection key; in the downlink direction, the user plane network element sends the user plane data that has been encrypted and / or integrity protected to the access network device, and the access network device decrypts and / or integrity checks the user plane data using a decryption key and / or an integrity protection key.

[0007] Therefore, the uplink user plane data sent by the terminal device needs to be decrypted and then encrypted by the access network device before being transmitted to the user plane network element, that is, the uplink user plane data sent by the terminal device appears in plaintext form at the access network device at a certain stage. Similarly, the downlink user plane data from the user plane network element needs to be decrypted and then encrypted by the access network device before being transmitted to the terminal device, that is, the downlink user plane data sent by the user plane network element appears in plaintext form at the access network device at a certain stage. Since the access network device is deployed in a low position, that is, relative to the core network in the core room, the access network device is mainly deployed in the wild environment, and thus is more vulnerable to near-end probing and physical attacks.

[0008] In a fifth generation (5G) communication system and future communication systems, some traffic flows in a protocol data unit (PDU) session can be split to local breakout by a split mode. This split mode can be implemented by inserting a split node on a user plane path of the PDU session, which is used to split traffic flows between a terminal device and multiple user plane anchors. The split node can be a branching point (BP) or an uplink classifier (ULCL).

[0009] Security solutions in the split scenario are worth studying. SUMMARY

[0010] Embodiments of the present application provide a communication method, a communication apparatus and a communication system for securely protecting user plane data between a terminal and multiple user plane network elements in a split scenario.

[0011] In a first aspect, an embodiment of the present application provides a communication method, which can be applied to a network side, such as a session management network element of the network side, a module (such as a circuit, a chip or a chip system, etc.) in the session management network element, or a logic node, a logic module or software capable of realizing all or part of the functions of the session management network element. The method comprises: determining a first intermediate key according to a session root key of a first session of a terminal device, the first intermediate key being used to derive a first session key, the first session key being used to protect user plane data of the first session between the terminal device and a first user plane anchor point; sending the first intermediate key or the first session key to the first user plane anchor point; determining a second intermediate key according to the session root key, the second intermediate key being used to derive a second session key, the second session key being used to protect user plane data of the first session between the terminal device and a second user plane anchor point; and sending the second intermediate key or the second session key to the second user plane anchor point; wherein the user plane data of the first session between the terminal device and the first user plane anchor point and the user plane data of the first session between the terminal device and the second user plane anchor point are both routed by a split node of the first session.

[0012] The above scheme, in the split scenario of service flow, sends the first session key or the first intermediate key used to determine the first session key to the first user plane anchor point, so that the first user plane anchor point can obtain the first session key, and the first user plane anchor point can perform end-to-end security protection on the user plane data of the first session between the terminal device and the first user plane anchor point based on the first session key. And the second session key or the second intermediate key used to determine the second session key is sent to the second user plane anchor point, so that the second user plane anchor point can obtain the second session key, and the second user plane anchor point can perform end-to-end security protection on the user plane data of the first session between the terminal device and the second user plane anchor point based on the second session key. Therefore, the method realizes security protection on the user plane data between the terminal device and multiple user plane anchor points in the split scenario of service flow.

[0013] In a possible implementation method, a first identifier is sent to the terminal device, the first identifier being an identifier of the first intermediate key or an identifier of the first session key, and the first identifier being used to route the user plane data of the first session to the first user plane anchor point; a second identifier is sent to the terminal device, the second identifier being an identifier of the second intermediate key or an identifier of the second session key, and the second identifier being used to route the user plane data of the first session to the second user plane anchor point.

[0014] The terminal device sends the user plane data of the first session to the first user plane anchor point, and the first session carries the first identifier in the user plane data, so that the offloading node can route the user plane data to the first user plane anchor point according to the first identifier. The terminal device sends the user plane data of the first session to the second user plane anchor point, and the first session carries the second identifier in the user plane data, so that the offloading node can route the user plane data to the second user plane anchor point according to the second identifier. Therefore, based on the first identifier and the second identifier, the method can route the user plane data of the first session sent by the terminal device to the correct user plane anchor point.

[0015] In a possible implementation method, the offloading node is sent a flow splitting rule, wherein the flow splitting rule is used to indicate that the user plane data of the first session carrying the first identifier from the terminal device is sent to the first user plane anchor point, and the user plane data of the first session carrying the second identifier from the terminal device is sent to the second user plane anchor point; and / or the flow splitting rule is used to indicate that the user plane data of the first session carrying the first identifier from the first user plane anchor point is sent to the terminal device, and the user plane data of the first session carrying the second identifier from the second user plane anchor point is sent to the terminal device.

[0016] The offloading node is sent a flow splitting rule, so that the offloading node can correctly route the user plane data of the first session based on the flow splitting rule. In the uplink direction, the offloading node receives the user plane data of the first session from the terminal device, and if it is identified based on the flow splitting rule that the first identifier is carried in the user plane data, the user plane data is routed to the first user plane anchor point, and if it is identified based on the flow splitting rule that the second identifier is carried in the user plane data, the user plane data is routed to the second user plane anchor point, thereby realizing routing the user plane data of the first session sent by the terminal device to the correct user plane anchor point. In the downlink direction, the offloading node receives the user plane data of the first session from the first user plane anchor point or the second user plane anchor point, and if it is identified based on the flow splitting rule that the first identifier or the second identifier is carried in the user plane data, the user plane data is routed to the terminal device, thereby realizing correctly routing the user plane data of the first session from the first user plane anchor point or the second user plane anchor point to the terminal device.

[0017] In a possible implementation, the determining the first intermediate key according to the session root key of the first session of the terminal device comprises: determining the first intermediate key according to the session root key, a first value of a first counter and / or an identifier of the first user plane anchor point, the first counter being used to record a number of times of deriving an intermediate key for the first session; and the determining the second intermediate key according to the session root key comprises: determining the second intermediate key according to the session root key, a second value of the first counter and / or an identifier of the second user plane anchor point.

[0018] The above scheme uses the first value of the first counter and / or the identifier of the first user plane anchor point to determine the first intermediate key, and uses the second value of the first counter and / or the identifier of the second user plane anchor point to determine the second intermediate key, which can accurately determine the intermediate keys for different user plane anchor points, and is simple and easy to implement and has low complexity.

[0019] In a possible implementation, the determining the first intermediate key according to the session root key of the first session of the terminal device comprises: determining the first intermediate key according to the session root key, a first value of a first counter and / or an identifier of the first user plane anchor point, the first counter being used to record a number of times of deriving an intermediate key for the first session; and the determining the second intermediate key according to the session root key comprises: determining the second intermediate key according to the session root key, a second value of the first counter and / or an identifier of the second user plane anchor point.

[0020] The above scheme uses different counters as inputs when determining intermediate keys for different user plane anchor points, which can isolate different intermediate keys and help to ensure the privacy and security of the intermediate keys.

[0021] In a possible implementation, the identifier of the second user plane anchor point is a preset value.

[0022] In a possible implementation, before the determining the first intermediate key according to the session root key of the first session of the terminal device, it is determined that the terminal device uses a BP manner to split a service flow, and the split node is the BP.

[0023] The above scheme determines that the terminal device uses the BP manner to split the service flow, and selects the BP as the split node, which helps to select a correct split node.

[0024] In a possible implementation, the determining that the terminal device uses the BP mode for the traffic flow splitting includes: receiving indication information from the terminal device, the indication information being used to indicate that the terminal device uses the BP mode for the traffic flow splitting, and the splitting node is the BP.

[0025] The foregoing scheme explicitly indicates, by using the indication information, that the terminal device uses the BP mode for the traffic flow splitting, which helps to select a correct splitting node.

[0026] In a possible implementation, the determining the first intermediate key according to the session root key of the first session of the terminal device includes: determining that information of a home session management network element is not received, and then determining the first intermediate key according to the session root key.

[0027] In a possible implementation, the first session key is derived according to the first intermediate key and a first security algorithm, and the first security algorithm includes a first confidentiality protection algorithm and / or a first integrity protection algorithm; and the second session key is derived according to the second intermediate key and a second security algorithm, and the second security algorithm includes a second confidentiality protection algorithm and / or a second integrity protection algorithm.

[0028] In a possible implementation, the determining the first intermediate key according to the session root key of the first session of the terminal device includes: in a case where it is determined that the user plane data of the first session is split, determining the first intermediate key according to the session root key.

[0029] The foregoing scheme determines the first intermediate key according to the session root key in a case where it is determined that the user plane data of the first session is split, thereby avoiding waste of computing resources caused by determining the first intermediate key when splitting is not needed, and therefore the method helps to reduce resource overhead.

[0030] In a second aspect, an embodiment of the present application provides a communication method, which can be applied to a terminal device side, such as a terminal device or a communication module in the terminal device, or a circuit or chip responsible for communication functions in the terminal device (such as a modem chip, also known as a baseband chip, or a system on chip (SoC) chip or a system in package (SIP) chip containing a modem core). The method comprises: determining a first intermediate key according to a session root key of a first session of a terminal device, and deriving a first session key according to the first intermediate key, the first session key being used to protect user plane data of the first session between the terminal device and a first user plane anchor; determining a second intermediate key according to the session root key, and deriving a second session key according to the second intermediate key, the second session key being used to protect user plane data of the first session between the terminal device and a second user plane anchor; wherein the user plane data of the first session between the terminal device and the first user plane anchor and the user plane data of the first session between the terminal device and the second user plane anchor are both routed by a split node of the first session.

[0031] The above scheme, in a split scenario of a service flow, a terminal device determines a first session key, and performs end-to-end security protection on user plane data of a first session between the terminal device and a first user plane anchor based on the first session key. In addition, the terminal device determines a second session key, and performs end-to-end security protection on user plane data of the first session between the terminal device and a second user plane anchor based on the second session key. Therefore, the method realizes security protection on user plane data between the terminal device and multiple user plane anchors in a split scenario of a service flow.

[0032] In a possible implementation method, a first identifier is received, the first identifier being an identifier of the first intermediate key or an identifier of the first session key; first data of the first session is sent, the first data carrying the first identifier, the first identifier being used to route the first data to the first user plane anchor, the first data being securely protected according to the first session key; a second identifier is received, the second identifier being an identifier of the second intermediate key or an identifier of the second session key; second data of the first session is sent, the second data carrying the second identifier, the second identifier being used to route the second data to the second user plane anchor, the second data being securely protected according to the second session key.

[0033] The terminal device can carry the first identifier in the user plane data when sending the user plane data of the first session that is protected by security to the first user plane anchor point, so that the offloading node can route the user plane data to the first user plane anchor point according to the first identifier. The terminal device can carry the second identifier in the user plane data when sending the user plane data of the first session that is protected by security to the second user plane anchor point, so that the offloading node can route the user plane data to the second user plane anchor point according to the second identifier. Therefore, the method can route the user plane data of the first session sent by the terminal device to the correct user plane anchor point based on the first identifier and the second identifier.

[0034] In a possible implementation method, the user plane data of the first session is securely processed based on the first session key, and the securely processed user plane data of the first session is sent, and the header of the securely processed user plane data of the first session carries information of the first user plane anchor point; the user plane data of the first session is securely processed based on the second session key, and the securely processed user plane data of the first session is sent, and the header of the securely processed user plane data of the first session carries information of the second user plane anchor point.

[0035] The terminal device can carry the first user plane anchor point information in the user plane data when sending the user plane data of the first session that is protected by security to the first user plane anchor point, so that the offloading node can route the user plane data to the first user plane anchor point according to the first user plane anchor point information. The terminal device can carry the second user plane anchor point information in the user plane data when sending the user plane data of the first session that is protected by security to the second user plane anchor point, so that the offloading node can route the user plane data to the second user plane anchor point according to the second user plane anchor point information. Therefore, the method can route the user plane data of the first session sent by the terminal device to the correct user plane anchor point based on the first user plane anchor point information and the second user plane anchor point information.

[0036] In a possible implementation method, the first intermediate key is determined according to the session root key of the first session of the terminal device, including: determining the first intermediate key according to the session root key, and a first value of a first counter and / or an identifier of the first user plane anchor point, the first counter being used to record a number of times of deriving intermediate keys for the first session; the second intermediate key is determined according to the session root key, including: determining the second intermediate key according to the session root key, and a second value of the first counter and / or an identifier of the second user plane anchor point.

[0037] The first intermediate key is determined by using the first value of the first counter and / or the identifier of the first user plane anchor point, and the second intermediate key is determined by using the second value of the first counter and / or the identifier of the second user plane anchor point, which can accurately determine the intermediate key for different user plane anchor points, and the method is simple and easy to implement, and has low complexity.

[0038] In a possible implementation method, the determining the first intermediate key according to the session root key of the first session of the terminal device comprises: determining the first intermediate key according to the session root key, and an identifier of the first user plane anchor point and / or a first counter, the first counter being used to record a number of times of deriving an intermediate key for the first user plane anchor point as a primary user plane anchor point; and the determining the second intermediate key according to the session root key comprises: determining the second intermediate key according to the session root key, and an identifier of the second user plane anchor point and / or a second counter, the second counter being used to record a number of times of deriving an intermediate key for the second user plane anchor point as a secondary user plane anchor point.

[0039] The different counters are used as inputs when determining the intermediate keys for different user plane anchor points, which can isolate different intermediate keys, and helps to ensure the privacy and security of the intermediate keys.

[0040] In a possible implementation method, the identifier of the second user plane anchor point is a preset value.

[0041] In a possible implementation method, before the determining the first intermediate key according to the session root key of the first session of the terminal device, the method further comprises: determining that the terminal device uses a BP mode for traffic flow splitting, and the splitting node is a BP.

[0042] The terminal device uses the BP mode for traffic flow splitting, which helps to accurately determine the type of the splitting node.

[0043] In a possible implementation method, the sending the indication information, the indication information being used to indicate that the terminal device uses the BP mode for traffic flow splitting, and the splitting node is a BP.

[0044] The terminal device uses the BP mode for traffic flow splitting by using the indication information to explicitly indicate, which helps to select a correct splitting node.

[0045] In a third aspect, the present application provides a communication apparatus, which has the functions of the first aspect, e.g., the communication apparatus includes modules, units or means for performing the operations of the first aspect, which can be implemented in software, or in hardware, or in a combination of software and hardware.

[0046] In a fourth aspect, the present application provides a communication apparatus, which has the functions of the second aspect, e.g., the communication apparatus includes modules, units or means for performing the operations of the second aspect, which can be implemented in software, or in hardware, or in a combination of software and hardware.

[0047] In a fifth aspect, the present application provides a communication apparatus, which includes an interface circuit and one or more processors. The one or more processors are coupled to a memory. The memory is configured to store part or all of the necessary computer programs or instructions for implementing the functions of the first aspect. The one or more processors can execute the computer programs or instructions, which, when executed, cause the communication apparatus to implement the method in any possible design or implementation manner of the first aspect. The interface circuit is configured to implement communication functions within the communication apparatus and / or communication functions between the communication apparatus and other apparatuses or components.

[0048] The communication apparatus can be a session management network element, a module (e.g., a circuit, a chip or a chip system, etc.) in the session management network element, or a logic node, a logic module or software capable of implementing all or part of the functions of the session management network element.

[0049] In a sixth aspect, the present application provides a communication apparatus, which includes an interface circuit and one or more processors. The one or more processors are coupled to a memory. The memory is configured to store part or all of the necessary computer programs or instructions for implementing the functions of the second aspect. The one or more processors can execute the computer programs or instructions, which, when executed, cause the communication apparatus to implement the method in any possible design or implementation manner of the second aspect. The interface circuit is configured to implement communication functions within the communication apparatus and / or communication functions between the communication apparatus and other apparatuses or components.

[0050] In a possible design, the processor is configured to communicate with other apparatuses or components via the interface circuit.

[0051] In a possible design, the communication apparatus can further include the memory.

[0052] The communication device can be a terminal device, a communication module in the terminal device, or a chip responsible for communication functions in the terminal device, such as a modem chip (also known as a baseband chip) or a SoC or SIP chip containing a modem module.

[0053] In a seventh aspect, a computer-readable storage medium is provided, and the computer-readable storage medium stores a computer program or instructions, and when the computer program or instructions are executed, the method in any possible design of the first aspect to the second aspect is implemented.

[0054] In an eighth aspect, a computer program product is provided, and the computer program product includes a computer program or instructions, and when the computer program or instructions are executed, the method in any possible design of the first aspect to the second aspect is implemented.

[0055] In a ninth aspect, a communication system is provided, and the communication system includes at least two devices: a session management network element, a first user plane anchor, a second user plane anchor, a split node, and a terminal device.

[0056] The session management network element is configured to perform the method in any possible implementation of the first aspect.

[0057] The first user plane anchor is configured to receive a first intermediate key or a first session key from the session management network element.

[0058] The second user plane anchor is configured to receive a second intermediate key or a second session key from the session management network element.

[0059] The split node is configured to route user plane data of a first session between the terminal device and the first user plane anchor and user plane data of the first session between the terminal device and the second user plane anchor.

[0060] The terminal device is configured to perform the method in any possible implementation of the second aspect.

[0061] In a possible implementation, the first user plane anchor is further configured to derive the first session key according to the first intermediate key and a first security algorithm when the first intermediate key is received; and the second user plane anchor is further configured to derive the second session key according to the second intermediate key and a second security algorithm when the second intermediate key is received.

[0062] In a possible implementation, the first user plane anchor is further configured to send or receive user plane data of the first session between the terminal device and the first user plane anchor according to the first session key; and the second user plane anchor is further configured to send or receive user plane data of the first session between the terminal device and the second user plane anchor according to the second session key. BRIEF DESCRIPTION OF DRAWINGS

[0063] FIG. 1 is a schematic diagram of a 5G network architecture based on a service-based architecture;

[0064] FIG. 2 is a schematic diagram of traffic splitting;

[0065] FIG. 3(a) is a schematic diagram of a communication method according to an embodiment of the present application;

[0066] FIG. 3(b) is a schematic diagram of a communication method according to an embodiment of the present application;

[0067] FIG. 4 is a schematic diagram of a communication method according to an embodiment of the present application;

[0068] FIG. 5 is a schematic diagram of a communication method according to an embodiment of the present application;

[0069] FIG. 6 is a schematic diagram of a communication method according to an embodiment of the present application;

[0070] FIG. 7 is a schematic diagram of a communication method according to an embodiment of the present application;

[0071] FIG. 8 is a schematic diagram of a possible example of a communication device according to an embodiment of the present application;

[0072] FIG. 9 is a schematic diagram of a terminal device according to an embodiment of the present application; DETAILED DESCRIPTION

[0073] To meet the challenge of wireless broadband technology, maintain the leading advantage of the 3rd generation partnership project (3GPP) network, the 3GPP standard group formulates a 5G network architecture. This architecture not only supports the wireless access technology defined by the 3GPP standard group (such as long term evolution (LTE) access technology, 5G radio access network (RAN) access technology, etc.) to access the 5G core network (CN), but also supports the use of non-3GPP (non-3GPP) access technology to access the core network through non-3GPP interworking function (N3IWF) or next generation packet data gateway (ngPDG).

[0074] FIG. 1 is a schematic diagram of a 5G network architecture based on a service-based architecture. The 5G network architecture shown in FIG. 1 can include access network devices and core network devices. A terminal device accesses a data network (DN) through the access network devices and the core network devices. The core network devices include, but are not limited to, some or all of the following network elements: an authentication server function (AUSF) network element, a unified data management (UDM) network element, a unified data repository (UDR) network element, a network repository function (NRF) network element, a network exposure function (NEF) network element, an application function (AF) network element, a policy control function (PCF) network element, an access and mobility management function (AMF) network element, a session management function (SMF) network element, and a user plane function (UPF) network element.

[0075] The access network device, which can also be referred to as a RAN node, a RAN entity, or an access node, etc., is used to help the terminal device to implement wireless access.

[0076] In a possible scenario, the access network device can be a base station, an evolved NodeB (eNodeB), an access point (AP), a transmission reception point (TRP), a next generation NodeB (gNB), a base station in a future mobile communication system, or an access node in a WiFi system, etc. The access network device can be a macro base station, a micro base station, or an indoor station, a relay node or a donor node. Optionally, the access network device can also be a server, a wearable device, a vehicle or a vehicle-mounted device, etc. For example, the access network device in vehicle to everything (V2X) technology can be a road side unit (RSU). All or part of the functions of the access network device in this application can also be implemented by software functions running on hardware, or by virtualized functions instantiated on a platform (such as a cloud platform). The access network device can also be provided with a communication module, circuit or chip for performing corresponding communication functions, and program instructions for performing corresponding communication functions. The access network device in this application can also be a logic node, logic module or software that can implement all or part of the functions of the access network device.

[0077] In another possible scenario, multiple access network devices cooperate to assist a terminal device to implement wireless access, and different access network devices respectively implement part of the functions of a base station. For example, the access network device can be a central unit (CU), a distributed unit (DU), a CU-control plane (CP), a CU-user plane (UP), or a radio unit (RU), etc. The CU and the DU can be separately arranged, or can be included in the same network element, such as a baseband unit (BBU). The RU can be included in a radio frequency device or a radio frequency unit, such as a remote radio unit (RRU), an active antenna processing unit (AAU), or a remote radio head (RRH).

[0078] In different systems, the CU (or CU-CP and CU-UP), DU or RU can also have different names, but those skilled in the art can understand their meanings. For example, in an open radio access network (ORAN) system, the CU can also be referred to as an O-CU (open CU), the DU can also be referred to as an O-DU, the CU-CP can also be referred to as an O-CU-CP, the CU-UP can also be referred to as an O-CU-UP, and the RU can also be referred to as an O-RU. For the convenience of description, the CU, CU-CP, CU-UP, DU and RU are taken as examples for description in this application. Any one of the CU (or CU-CP, CU-UP), DU and RU in this application can be implemented by a software module, a hardware module, or a combination of a software module and a hardware module.

[0079] The terminal device can also be referred to as a terminal, user equipment (UE), mobile station, mobile terminal, etc. The terminal device can be widely applied to various scenarios, such as device-to-device (D2D), vehicle to everything (V2X) communication, machine-type communication (MTC), internet of things (IOT), virtual reality, augmented reality, industrial control, automatic driving, remote medical treatment, smart power grid, smart furniture, smart office, smart wear, smart transportation, smart city, etc. The terminal device can be a mobile phone, tablet computer, computer with wireless transceiver function, wearable device, vehicle, unmanned aerial vehicle, helicopter, airplane, ship, robot, mechanical arm, smart home device, wireless communication function transport vehicle, communication module, etc. Embodiments of the present application do not limit the device form of the terminal device. The terminal device is usually provided with a communication module, circuit or chip for executing corresponding communication functions. The terminal device is also configured with program instructions for executing corresponding communication functions.

[0080] The access network device and the terminal device can be fixed in position or movable. The access network device and the terminal device can be deployed on land, including indoors or outdoors, handheld or vehicle-mounted; can also be deployed on the water surface; and can also be deployed on airplanes, balloons and artificial satellites in the air. Embodiments of the present application do not limit the application scenarios of the access network device and the terminal device.

[0081] The AMF network element contains functions such as performing mobility management, or access authentication / authorization. In addition, it is also responsible for transmitting user policies between the terminal device and the PCF network element.

[0082] SMF network element, containing functions such as performing session management, performing control policies issued by the PCF network element, selecting a UPF network element, or allocating an internet protocol (IP) address of a terminal device.

[0083] UPF network element, containing functions such as completing user plane data forwarding, session / stream level-based charging statistics, or bandwidth limitation.

[0084] UDM network element, containing functions such as performing management of subscription data or user access authorization.

[0085] UDR, containing access functions of types of data such as subscription data, policy data, or application data.

[0086] NEF network element, used to support the opening of capabilities and events, so that third parties can indirectly interact with some network elements inside the 3GPP network.

[0087] AF network element, delivering application-side requirements for the network side, such as quality of service (QoS) requirements or user state event subscriptions. The AF can be a third-party functional entity or an application service deployed by an operator, such as an IP Multimedia Subsystem (IMS) voice call service. Among them, the AF network element includes an AF network element in the core network (i.e., an operator's AF network element) and a third-party AF network element (such as an application server of a certain enterprise).

[0088] PCF network element, containing policy control functions such as charging, QoS bandwidth guarantee, and mobility management for sessions and service flow levels, or terminal device policy decision.

[0089] NRF network element, which can be used to provide network element discovery functions and provide network element information corresponding to a network element type based on the request of other network elements. The NRF network element also provides network element management services such as network element registration, update, deregistration, or network element state subscription and push.

[0090] AUSF network element, responsible for authenticating users to determine whether to allow the user or device to access the network.

[0091] DN is a network located outside the operator network, the operator network can access multiple DN, and multiple services can be deployed on the DN, which can provide data and / or voice services for terminal devices. For example, the DN is a private network of a certain intelligent factory, the sensors installed in the workshop of the intelligent factory can be terminal devices, and the control server of the sensors is deployed in the DN, which can provide services for the sensors. The sensors can communicate with the control server, obtain instructions from the control server, and transmit the collected sensor data to the control server according to the instructions, etc. For another example, the DN is an internal office network of a certain company, the mobile phones or computers of the employees of the company can be terminal devices, and the mobile phones or computers of the employees can access information and data resources on the internal office network of the company.

[0092] Nausf, Npcf, Nudr, Nudm, Naf, Namf, Nsmf, Nnef, and Nnrf in FIG. 1 are service-based interfaces (SBI) provided by the above-mentioned AUSF, PCF, UDR, UDM, AF, AMF, SMF, NEF, and NRF, respectively, for invoking corresponding service-based operations. N1, N2, N3, N4, and N6 are interface sequence numbers, and the meanings of these interface sequence numbers are as follows:

[0093] 1) N1: the interface between the AMF network element and the terminal device, which can be used to transmit non-access stratum (NAS) signaling (such as QoS rules from the AMF network element) to the terminal device, etc.

[0094] 2) N2: the interface between the AMF network element and the access network device, which can be used to transmit wireless bearer control information from the core network side to the access network device, etc.

[0095] 3) N3: the interface between the access network device and the UPF network element, which is mainly used to transmit uplink and downlink user plane data between the access network device and the UPF network element.

[0096] 4) N4: the interface between the SMF network element and the UPF network element, which can be used to transmit information between the control plane and the user plane, including the downward transmission of forwarding rules, QoS rules, and traffic statistics rules from the control plane to the user plane, and the information reporting of the user plane.

[0097] 5) N6: the interface between the UPF network element and the DN, which is used to transmit uplink and downlink user data streams between the UPF network element and the DN.

[0098] The various network function network elements in the architecture shown in FIG. 1 are connected through a service bus and interact through service interfaces. The service bus has the advantages of improving the flexibility, openness, scalability and intelligence of the network, and can support diversified business scenarios and needs. The service bus can be used to transmit various types of data and signaling, such as real-time signaling (for example, service interface call signaling between network element function network elements) that is sensitive to latency, real-time data (for example, real-time artificial intelligence inference data) that is sensitive to latency, and non-real-time data (for example, data for offline artificial intelligence training). Moreover, when the service bus transmits these data or signaling, the data or signaling are coupled together, that is, the service bus can be used to transmit real-time signaling, real-time data and non-real-time data at the same time.

[0099] It should be noted that the above various network elements (such as SMF network elements, UPF network elements, etc.) can omit the "network element" when described, for example, the SMF network element is simply referred to as SMF, the UPF network element is simply referred to as UPF, etc. In FIG. 1, this kind of brief description is also used.

[0100] It can be understood that the above network elements or functions can be network elements in a hardware device, or software functions running on a dedicated hardware, or virtualized functions instantiated on a platform (for example, a cloud platform). Optionally, the above network elements or functions can be implemented by one device, or can be implemented by multiple devices together, or can be a functional module in a device, and the embodiments of the present application do not make specific limitations.

[0101] The user plane network element and the session management network element in the present application can be the UPF network element and the SMF network element in FIG. 1, or can be network elements having the functions of the above UPF network element and SMF network element in future communication networks, and the present application does not make limitations.

[0102] In the current mobile communication network, the user plane data sent by the terminal device is sent to the user plane network element through the access network device, and the user plane data is protected by a hop-by-hop security mechanism during transmission. Specifically:

[0103] (1) For the transmission of user plane data between the terminal device and the access network device, in the uplink direction, the terminal device sends the user plane data that has been encrypted and / or integrity protected to the access network device, and the access network device uses a decryption key and / or an integrity protection key to decrypt and / or integrity check the user plane data; in the downlink direction, the access network device sends the user plane data that has been encrypted and / or integrity protected to the terminal device, and the terminal device uses a decryption key and / or an integrity protection key to decrypt and / or integrity check the user plane data.

[0104] (2) For the transmission of user plane data between the access network device and the user plane network element, the access network device and the user plane network element (or the front security gateway of the user plane network element) establish IPsec between them to encrypt and / or integrity protect the user plane data transmitted in the GTP-U tunnel. In the uplink direction, the access network device sends the user plane data encrypted and / or integrity protected to the user plane network element, and the user plane network element decrypts and / or integrity checks the user plane data using the decryption key and / or integrity protection key; in the downlink direction, the user plane network element sends the user plane data encrypted and / or integrity protected to the access network device, and the access network device decrypts and / or integrity checks the user plane data using the decryption key and / or integrity protection key.

[0105] Therefore, the uplink user plane data sent by the terminal device needs to be decrypted and then encrypted at the access network device before being transmitted to the user plane network element, i.e., the uplink user plane data sent by the terminal device appears in plaintext form at the access network device at some stage. Similarly, the downlink user plane data from the user plane network element needs to be decrypted and then encrypted at the access network device before being transmitted to the terminal device, i.e., the downlink user plane data sent by the user plane network element appears in plaintext form at the access network device at some stage. Since the access network device is deployed in a lower position, i.e., relative to the core network in the core room, the access network device is mainly deployed in the wild environment, and thus is more vulnerable to near-end probing and physical attacks.

[0106] In future communications, in many scenarios, users and upper-layer services prefer to be able to establish end-to-end security protection directly between the terminal device and the user plane network element, and the access network device can only forward the encrypted user plane data and cannot obtain the specific content of the transmitted user plane data.

[0107] In the 5G communication system and future communication systems, some traffic flows in a PDU session can be split to local routing by a split manner. This split manner can be implemented by inserting a split node on the user plane path of the PDU session, and the split node is used to split traffic flows between the terminal device and multiple user plane anchors. The split node can be a BP or a ULCL. The function of the split node can be performed by a user plane network element, i.e., the split node can be a user plane network element or a functional unit on the user plane network element.

[0108] The difference between UL CL and BP is that in the UL CL architecture, the terminal device is not aware of whether the PDU session is inserted with UL CL, or in other words, the terminal device is not aware of the anchor point switching of user plane data, that is, the address information (such as IP address and port number) in the uplink data packet and the downlink data packet in the PDU session of the terminal device remains unchanged before and after the insertion of UL CL; in the BP architecture, the terminal device is aware of whether the PDU session is inserted with BP, or in other words, the terminal device is aware of the anchor point switching of user plane data, that is, the address information in the uplink data packet and the downlink data packet in the PDU session of the terminal device will change before and after the insertion of BP, and the address information in the data packet from different user plane network elements is different.

[0109] Suppose that the user plane network element selected when establishing the PDU session of the terminal device is user plane network element #1, which is also called PDU session anchor (PSA), and is denoted as PSA#1 below. When there is a need for traffic splitting, the session management network element (which can be, for example, an SMF network element) inserts user plane network element #2 for the PDU session, which is denoted as PSA#2 below. Then the session management network element inserts a splitting node for the PDU session. At this time, one PDU session of the terminal device has two PSAs, namely PSA#1 and PSA#2, and the splitting node is used for splitting traffic between PSA#1 and PSA#2. In the uplink direction, the splitting node receives the uplink traffic from the terminal device and sends the uplink traffic to PSA#1 or PSA#2 according to the forwarding rule or the splitting rule. In the downlink direction, the splitting node receives the downlink traffic from PSA#1 and PSA#2 and sends the downlink traffic to the terminal device according to the forwarding rule or the splitting rule.

[0110] In this application, the PSA first selected for the PDU session of the terminal device is called the primary PSA, the primary user plane anchor or the primary anchor user plane network element, and the PSA inserted due to the need for splitting is called the secondary PSA, the secondary user plane anchor or the secondary anchor user plane network element. The primary PSA remains unchanged during the existence of the PDU session, and the secondary PSA can be switched.

[0111] Fig. 2 is a schematic diagram of traffic splitting. There are traffic flow #1 and traffic flow #2 between the terminal device and the DN. In the uplink direction, there is uplink traffic flow #1 between the terminal device and PSA #1, and there is uplink traffic flow #2 between the terminal device and PSA #2; in the downlink direction, there is downlink traffic flow #1 between the terminal device and PSA #1, and there is downlink traffic flow #2 between the terminal device and PSA #2. In the uplink direction, the splitting node receives uplink traffic flow #1 and uplink traffic flow #2 from the terminal device, and sends uplink traffic flow #1 to PSA #1 and uplink traffic flow #2 to PSA #2. In the downlink direction, the splitting node receives downlink traffic flow #1 from PSA #1 and downlink traffic flow #2 from PSA #2, aggregates downlink traffic flow #1 and downlink traffic flow #2 into an N3 tunnel between the splitting node and the access network device, and sends to the access network device, which then sends to the terminal device.

[0112] According to the foregoing description, in transmitting user plane data of a traffic flow, the future communication network has a demand for establishing end-to-end security protection between the terminal device and the user plane network element for the user plane data. Based on this demand, in the traffic splitting scenario, before inserting the splitting node, when establishing the PDU session, the end-to-end security protection between the terminal device and PSA #1 is first established, and after inserting the splitting node, if the transmitted user plane data still uses the end-to-end security protection between the terminal device and PSA #1, the splitting node will not be able to obtain the address information of the user plane data, and thus the splitting node cannot split the user plane data, resulting in the failure to implement the traffic splitting of the traffic flow.

[0113] To solve the above problems, the present application provides corresponding solutions.

[0114] The communication method and the communication device will be further described below in conjunction with the drawings. It can be understood that the present application takes the session management network element and the terminal device as an example to illustrate the execution subject of the interaction, but the present application does not limit the execution subject of the interaction. For example, the method executed by the session management network element in the present application can also be implemented by a module (such as a circuit, a chip or a chip system, etc.) in the session management network element, or a logical node, a logical module or software capable of implementing all or part of the functions of the session management network element; the method executed by the terminal device in the present application can also be implemented by a communication module in the terminal device or a circuit or chip (such as a modem chip (also known as a baseband chip), or a SoC chip containing a modem core, or a SIP chip) responsible for communication functions in the terminal device.

[0115] FIG. 3(a) is a flowchart of a communication method provided by an embodiment of the present application. The method is applicable to a traffic splitting scenario of a first session of a terminal device, and specifically, the first session of the terminal device corresponds to two user plane anchors (also referred to as user plane network elements, anchor user plane network elements, or user plane anchor network elements, etc.), namely a first user plane anchor and a second user plane anchor. User plane data of the first session between the terminal device and the first user plane anchor and user plane data of the first session between the terminal device and the second user plane anchor are both routed or split by a splitting node (such as a BP or a UL CL, etc.) of the first session.

[0116] The first user plane anchor is a user plane network element selected by a session management network element when the terminal device establishes the first session. The first user plane anchor can be referred to as a primary user plane anchor (also referred to as a primary user plane anchor network element or a primary anchor user plane network element). For example, referring to the example of FIG. 2, the first user plane anchor can be PSA#1 in FIG. 2.

[0117] The second user plane anchor is a user plane network element newly inserted by the session management network element when there is a traffic splitting requirement for the first session after the terminal device establishes the first session and the session management network element selects the first user plane anchor. The second user plane anchor can be referred to as a secondary user plane anchor (also referred to as a secondary user plane anchor network element or a secondary anchor user plane network element). Alternatively, the second user plane anchor can also be a user plane anchor that replaces the secondary user plane anchor after the primary user plane anchor is selected and the secondary user plane anchor is initially inserted. For example, referring to the example of FIG. 2, the first user plane anchor can be PSA#1 and the second user plane anchor can be PSA#2 in FIG. 2. PSA#2 can be a PSA that is initially inserted after PSA#1 is selected, or PSA#2 can be a PSA that is non-initially inserted after PSA#1 is selected.

[0118] The method includes the following steps:

[0119] Step 301a, a session management network element determines a first intermediate key according to a session root key of a first session of a terminal device.

[0120] The first session can be a PDU session or another type of session of the terminal device, and the type of the first session is not limited in the present application.

[0121] The session root key of the first session is a root key at a session granularity, that is, there is a corresponding session root key for each session of the terminal device.

[0122] The application does not limit the way in which the session management network element obtains the session root key of the first session. For example, the session management network element can derive the session root key of the first session according to the identifier of the first session. For another example, the session management network element obtains the session root key of the first session from other network elements (such as a UDM network element, an NRF network element, or a UDR, etc.).

[0123] The first intermediate key is used to derive a first session key, which is used to protect user plane data of the first session between the terminal device and the first user plane anchor point. That is, when the first user plane anchor point sends user plane downlink data to the terminal device, the first session key is used to securely protect the user plane downlink data, and when the terminal device sends user plane uplink data to the first user plane anchor point, the first session key is used to securely protect the user plane uplink data.

[0124] The first session key can be derived by the session management network element or by the first user plane anchor point.

[0125] If the first session key is derived by the session management network element, the session management network element can derive the first session key according to the first intermediate key and a first security algorithm. The first security algorithm includes a first confidentiality protection algorithm and / or a first integrity protection algorithm. For example, if the first security algorithm includes the first confidentiality protection algorithm, the first session key derived by the session management network element includes a first session encryption and decryption key. For another example, if the first security algorithm includes the first integrity protection algorithm, the first session key derived by the session management network element includes a first session integrity protection key. For another example, if the first security algorithm includes the first confidentiality protection algorithm and the first integrity protection algorithm, the first session key derived by the session management network element includes the first session encryption and decryption key and the first session integrity protection key.

[0126] For example, the session management network element can determine the first security algorithm used to derive the first session key according to any one of the following methods 1 to 2:

[0127] Method 1: The session management network element obtains the user plane security capability of the terminal device, which is used to indicate the user plane security algorithm supported by the terminal device, and determines the first security algorithm according to the user plane security capability of the terminal device. The user plane security algorithm supported by the terminal device includes the first security algorithm, and the first user plane anchor point supports the first security algorithm.

[0128] For example, the user plane security capability of the terminal device indicates that the terminal device supports confidentiality protection algorithm #1, confidentiality protection algorithm #2 and confidentiality protection algorithm #3, and supports integrity protection algorithm #1, integrity protection algorithm #2 and integrity protection algorithm #3. The session management network element selects confidentiality protection algorithm #1 and integrity protection algorithm #3, that is, the first security algorithm determined by the session management network element includes confidentiality protection algorithm #1 and integrity protection algorithm #3.

[0129] For example, the user plane security capability of the terminal device indicates that the terminal device supports confidentiality protection algorithm #1, confidentiality protection algorithm #2 and confidentiality protection algorithm #3, and supports integrity protection algorithm #1, integrity protection algorithm #2 and integrity protection algorithm #3. The session management network element selects confidentiality protection algorithm #1 and integrity protection algorithm #3, that is, the first security algorithm determined by the session management network element includes confidentiality protection algorithm #1 and integrity protection algorithm #3.

[0130] For example, the user plane security capability of the terminal device indicates that the terminal device supports confidentiality protection algorithm #1, confidentiality protection algorithm #2 and confidentiality protection algorithm #3, and supports integrity protection algorithm #1, integrity protection algorithm #2 and integrity protection algorithm #3. The session management network element selects confidentiality protection algorithm #1 and integrity protection algorithm #3, that is, the first security algorithm determined by the session management network element includes confidentiality protection algorithm #1 and integrity protection algorithm #3.

[0131] For example, the user plane security capability of the terminal device indicates that the terminal device supports confidentiality protection algorithm #1, confidentiality protection algorithm #2 and confidentiality protection algorithm #3, and supports integrity protection algorithm #1, integrity protection algorithm #2 and integrity protection algorithm #3. The session management network element selects confidentiality protection algorithm #1 and integrity protection algorithm #3, that is, the first security algorithm determined by the session management network element includes confidentiality protection algorithm #1 and integrity protection algorithm #3.

[0132] For example, the user plane security capability of the terminal device indicates that the terminal device supports confidentiality protection algorithm #1, confidentiality protection algorithm #2 and confidentiality protection algorithm #3, and supports integrity protection algorithm #1, integrity protection algorithm #2 and integrity protection algorithm #3. The session management network element selects confidentiality protection algorithm #1 and integrity protection algorithm #3, that is, the first security algorithm determined by the session management network element includes confidentiality protection algorithm #1 and integrity protection algorithm #3.

[0133] Step 302a, the session management network element sends the first intermediate key or the first session key to the first user plane anchor.

[0134] In one implementation method, if the first session key is determined by the session management network element, in this step 302a, the session management network element sends the first session key to the first user plane anchor.

[0135] In another implementation method, if the first session key is determined by the first user plane anchor point, the session management network element sends the first intermediate key to the first user plane anchor point, and then the first user plane anchor point derives the first session key according to the first intermediate key.

[0136] Exemplarily, if the first session key is derived by the first user plane anchor point according to the first intermediate key, after receiving the first intermediate key from the session management network element, the first user plane anchor point can derive the first session key according to the first intermediate key and the first security algorithm. The meaning of the first security algorithm can be referred to the related description in step 301a.

[0137] In an implementation method, if the first session key is determined by the first user plane anchor point, when the session management network element sends the first intermediate key to the first user plane anchor point, the session management network element can also send the user plane security capability of the terminal device to the first user plane anchor point, where the user plane security capability is used to indicate the user plane security algorithm supported by the terminal device, and the first user plane anchor point determines the first security algorithm according to the user plane security algorithm supported by the terminal device. The user plane security algorithm supported by the terminal device includes the first security algorithm, and the first user plane anchor point supports the first security algorithm. It should be noted that the first intermediate key and the user plane security capability of the terminal device sent by the session management network element to the first user plane anchor point can be carried in the same message, or can be carried in different messages respectively.

[0138] In another implementation method, if the first session key is determined by the first user plane anchor point, when the session management network element sends the first intermediate key to the first user plane anchor point, the session management network element can also send the first security algorithm to the first user plane anchor point, so that the first user plane anchor point can obtain the first security algorithm used to derive the first session key from the session management network element. The determination of the first security algorithm by the session management network element can be referred to the description in step 301a, and will not be described herein. It should be noted that the first intermediate key and the first security algorithm sent by the session management network element to the first user plane anchor point can be carried in the same message, or can be carried in different messages respectively.

[0139] In step 303a, the session management network element determines a second intermediate key according to the session root key of the first session of the terminal device.

[0140] The second intermediate key is used to derive a second session key, and the second session key is used to protect the user plane data of the first session between the terminal device and the second user plane anchor point. That is, when the second user plane anchor point sends the user plane downlink data to the terminal device, the second session key is used to perform security protection on the user plane downlink data, and when the terminal device sends the user plane uplink data to the second user plane anchor point, the second session key is used to perform security protection on the user plane uplink data.

[0141] The second session key can be derived from either the session management network element or the second user plane anchor point.

[0142] If the second session key is derived from the session management network element, the session management network element can then derive the second session key based on the second intermediate key and the second security algorithm. The second security algorithm includes a second confidentiality protection algorithm and / or a second integrity protection algorithm. For example, if the second security algorithm includes a second confidentiality protection algorithm, the second session key derived by the session management network element includes a second session encryption / decryption key. Similarly, if the second security algorithm includes a second integrity protection algorithm, the second session key derived by the session management network element includes a second session integrity protection key. Furthermore, if the second security algorithm includes both a second confidentiality protection algorithm and a second integrity protection algorithm, the second session key derived by the session management network element includes both a second session encryption / decryption key and a second session integrity protection key.

[0143] For example, the session management network element can determine the second security algorithm for deriving the second session key according to any one of the following methods A to C:

[0144] Method A: The session management network element obtains the user plane security capabilities of the terminal device. These user plane security capabilities indicate the user plane security algorithms supported by the terminal device. Then, the session management network element determines a second security algorithm based on the user plane security capabilities of the terminal device. Specifically, the user plane security algorithms supported by the terminal device include the second security algorithm, and the second user plane anchor point supports the second security algorithm.

[0145] For example, the user plane security capabilities of a terminal device indicate that the terminal device supports confidentiality protection algorithms #1, #2, and #3, as well as integrity protection algorithms #1, #2, and #3. The session management network element selects confidentiality protection algorithm #2 and integrity protection algorithm #1, meaning the second security algorithm includes confidentiality protection algorithm #2 and integrity protection algorithm #1.

[0146] For example, the session management network element determines the second security algorithm based on the user plane security capabilities of the terminal device and the user plane security algorithms supported by the second user plane anchor. The session management network element may be locally configured with the user plane security algorithms supported by the second user plane anchor, or it may obtain the supported user plane security algorithms from the second user plane anchor.

[0147] Method B involves the session management network element acquiring the user plane security capabilities of the terminal device. These user plane security capabilities indicate the user plane security algorithms supported by the terminal device. The session management network element then sends the user plane security capabilities of the terminal device to a second user plane anchor point. The second user plane anchor point, based on the user plane security capabilities of the terminal device, determines a second security algorithm and sends the second security algorithm to the session management network element. Specifically, the user plane security algorithms supported by the terminal device include the second security algorithm, and the second user plane anchor point supports the second security algorithm.

[0148] For example, the user plane security capability of the terminal device indicates that the terminal device supports confidentiality protection algorithms #1, #2, and #3, as well as integrity protection algorithms #1, #2, and #3. The second user plane anchor point selects confidentiality protection algorithm #2 and integrity protection algorithm #1, that is, the second security algorithm includes confidentiality protection algorithm #2 and integrity protection algorithm #1. Then the second user plane anchor point sends indication information to the session management network element to indicate the second security algorithm.

[0149] As one implementation method, the session management network element can obtain the user plane security capabilities of the terminal device from the terminal device, or it can obtain the user plane security capabilities of the terminal device from other network elements (such as UDM network elements, NRF network elements, or UDR, etc.). This application does not limit the implementation method of the session management network element obtaining the user plane security capabilities of the terminal device.

[0150] In method C, the session management network element uses the first security algorithm, which is used to deduce the first session key, as the second security algorithm.

[0151] In other words, the second security algorithm determined by the session management network element for deriving the second session key is the same as the first security algorithm used for deriving the first session key. Based on this implementation method, the session management network element uses the same security algorithm to derive the first and second session keys, thus simplifying the operation and reducing the computational complexity of the session management network element.

[0152] Optionally, when selecting a second user plane anchor point, the session management network element selects the second user plane anchor point according to a second security algorithm. Specifically, the session management network element selects a user plane network element that supports the second security algorithm as the second user plane anchor point.

[0153] Step 304a: The session management network element sends the second intermediate key or the second session key to the second user plane anchor point.

[0154] In one implementation method, if the second session key is determined by the session management network element, then in step 304a, the session management network element sends the second session key to the second user plane anchor point.

[0155] In another implementation method, if the second session key is determined by the second user plane anchor, then in step 304a, the session management network element sends the second intermediate key to the second user plane anchor, and then the second user plane anchor deduces the second session key based on the second intermediate key.

[0156] For example, if the second user plane anchor point derives the second session key from the second intermediate key, then after receiving the second intermediate key from the session management network element, the second user plane anchor point can derive the second session key based on the second intermediate key and the second security algorithm. The meaning of the second security algorithm can be found in the relevant description in step 303a.

[0157] In one implementation method, if the second session key is determined by the second user plane anchor, when the session management network element sends the second intermediate key to the second user plane anchor, it can also send the user plane security capabilities of the terminal device to the second user plane anchor. These user plane security capabilities indicate the user plane security algorithms supported by the terminal device. The second user plane anchor determines the second security algorithm based on the user plane security algorithms supported by the terminal device. Specifically, the user plane security algorithms supported by the terminal device include the second security algorithm, and the second user plane anchor supports the second security algorithm. It should be noted that the second intermediate key and the user plane security capabilities of the terminal device sent by the session management network element to the second user plane anchor can be carried in the same message or in separate messages.

[0158] In another implementation, if the second session key is determined by the second user plane anchor, the session management network element can send the second intermediate key to the second user plane anchor, and also send the second security algorithm to the second user plane anchor. Therefore, the second user plane anchor can obtain the second security algorithm used to deduce the second session key from the session management network element. It should be noted that the second intermediate key and the second security algorithm sent by the session management network element to the second user plane anchor can be carried in the same message or in separate messages.

[0159] Based on the above scheme, in the scenario of service flow splitting, the first user plane anchor point obtains the first session key, the second user plane anchor point obtains the second session key, and the terminal device also derives the first session key and the second session key in the same way as the session management network element or the first user plane anchor point. Subsequently, the terminal device and the first user plane anchor point can perform end-to-end security protection on the user plane data of the first session between the terminal device and the first user plane anchor point based on the first session key, and the terminal device and the second user plane anchor point can perform end-to-end security protection on the user plane data of the first session between the terminal device and the second user plane anchor point based on the second session key. This achieves security protection of user plane data between the terminal device and multiple user plane anchor points in the scenario of service flow splitting. Furthermore, in this scheme, the terminal device can detect the newly inserted second user plane anchor point.

[0160] Since the user plane data in the first session is used for end-to-end security protection between the terminal device and the user plane anchor point, the access network device can only forward the encrypted user plane data and cannot obtain the specific content of the transmitted user plane data. Therefore, it can reduce the security risk of user plane data being stolen due to near-end probing or physical attacks on the access network device.

[0161] In the embodiment shown in Figure 3(a) above, after selecting the first user plane anchor point, the session management network element derives the first intermediate key corresponding to the first user plane anchor point. The second intermediate key can be derived either before or after selecting the second user plane anchor point. For example, in one implementation, after selecting the first user plane anchor point, the session management network element derives the first intermediate key corresponding to the first user plane anchor point. Subsequently, when there is a traffic splitting requirement in the service flow of the first session, the session management network element inserts a new second user plane anchor point and derives the second intermediate key corresponding to the second user plane anchor point. For example, in another implementation method, after selecting the first user plane anchor point, the session management network element deduces the first intermediate key corresponding to the first user plane anchor point and the second intermediate key. Since the second user plane anchor point has not yet been inserted, the second intermediate key can be understood as a backup intermediate key. Subsequently, when there is a traffic splitting requirement for the service flow of the first session, the session management network element inserts a new second user plane anchor point and uses the previously deduced second intermediate key as the intermediate key corresponding to the second user plane anchor point.

[0162] The following is a detailed description of some implementation details of the embodiment shown in Figure 3(a).

[0163] Since the user plane data of the first session is protected by end-to-end security between the terminal device and the user plane anchor point, this user plane data is also invisible to the offloading node, meaning the offloading node cannot obtain the specific content of the user plane data of the first session. To ensure that the offloading node can correctly offload the user plane data of the first session, this application provides a corresponding solution. For example, the session management network element can send offloading rules (also called forwarding rules) to the offloading node. These offloading rules instruct that the user plane data of the first session carrying a first identifier from the terminal device be sent to the first user plane anchor point, and that the user plane data of the first session carrying a second identifier from the terminal device be sent to the second user plane anchor point. Alternatively, the offloading rules instruct that the user plane data of the first session carrying a first identifier from the first user plane anchor point be sent to the terminal device, and that the user plane data of the first session carrying a second identifier from the second user plane anchor point be sent to the terminal device. The first identifier is used to route the user plane data of the first session to the first user plane anchor point or the terminal device, and the second identifier is used to route the user plane data of the first session to the second user plane anchor point or the terminal device.

[0164] Accordingly, the routing node receives the routing rule and routes the user plane data of the first session according to the routing rule.

[0165] For example, in the uplink direction, the terminal device needs to send the first user plane uplink data (e.g., first data) of the first user plane to the first user plane anchor point. The terminal device carries a first identifier in the first user plane uplink data. This first user plane uplink data is securely protected using the first session key. When the diversion node receives this first user plane uplink data, it cannot parse the specific content of the first user plane uplink data, but it can obtain the first identifier and divert the first user plane uplink data to the first user plane anchor point based on the first identifier. As another example, in the uplink direction, the terminal device needs to send the second user plane uplink data (e.g., second data) of the first user plane to the second user plane anchor point. The terminal device carries a second identifier in the second user plane uplink data. This second user plane uplink data is securely protected using the second session key. When the diversion node receives this second user plane uplink data, it cannot parse the specific content of the second user plane uplink data, but it can obtain the second identifier and divert the second user plane uplink data to the second user plane anchor point based on the second identifier. For example, in the downlink direction, the first user plane anchor needs to send the first user plane downlink data (e.g., the third data) of the first session to the terminal device. The first user plane anchor carries a first identifier in the first user plane downlink data. This first user plane downlink data is securely protected using the first session key. When the diversion node receives this first user plane downlink data, it cannot parse the specific content of the first user plane downlink data, but it can obtain the first identifier and divert the first user plane downlink data to the terminal device based on the first identifier. Similarly, in the downlink direction, the second user plane anchor needs to send the second user plane downlink data (e.g., the fourth data) of the first session to the terminal device. The second user plane anchor carries a second identifier in the second user plane downlink data. This second user plane downlink data is securely protected using the second session key. When the diversion node receives this second user plane downlink data, it cannot parse the specific content of the second user plane downlink data, but it can obtain the second identifier and divert the second user plane downlink data to the terminal device based on the second identifier.

[0166] In another implementation, in the uplink direction, the terminal device needs to send the first user plane uplink data of the first session to the first user plane anchor point. The header of the first user plane uplink data carries the information of the first user plane anchor point (such as port number and / or address). The first user plane uplink data is protected by the first session key. When the diversion node receives the first user plane uplink data, it cannot parse the specific content of the first user plane uplink data, but it can obtain the information of the first user plane anchor point in the header, and divert the first user plane uplink data to the first user plane anchor point based on the information of the first user plane anchor point. For example, in the uplink direction, the terminal device needs to send the second user plane uplink data of the first session to the second user plane anchor point. The header of the second user plane uplink data carries the information of the second user plane anchor point (such as port number and / or address). This second user plane uplink data is securely protected using the second session key. When the splitter receives this second user plane uplink data, it cannot parse the specific content of the second user plane uplink data, but it can obtain the information of the second user plane anchor point in the header, and based on the information of the second user plane anchor point, it splits the second user plane uplink data to the second user plane anchor point. Similarly, in the downlink direction, the first user plane anchor point needs to send the first user plane downlink data of the first session to the terminal device. The first user plane anchor point carries the information of the terminal device (such as port number and / or address) in the first user plane downlink data. This first user plane downlink data is securely protected using the first session key. When the splitter receives this first user plane downlink data, it cannot parse the specific content of the first user plane downlink data, but it can obtain the information of the terminal device in the header, and based on the information of the terminal device, it splits the first user plane downlink data to the terminal device. For example, in the downlink direction, the second user plane anchor needs to send the second user plane downlink data of the first session to the terminal device. The second user plane anchor carries the terminal device information (such as port number and / or address) in the second user plane downlink data. This second user plane downlink data is protected by the first session key. When the diversion node receives the second user plane downlink data, it cannot parse the specific content of the second user plane downlink data, but it can obtain the terminal device information in the packet header, and divert the second user plane downlink data to the terminal device based on the terminal device information.

[0167] In one implementation method, the first identifier is the identifier of the first intermediate key, and the second identifier is the identifier of the second intermediate key, both of which are determined by the session management network element. For example, in step 301a above, after determining the first intermediate key, the session management network element also determines the identifier of the first intermediate key; and in step 303a above, after determining the second intermediate key, the session management network element also determines the identifier of the second intermediate key. Exemplarily, after determining the first identifier (i.e., the identifier of the first intermediate key), the session management network element also sends the first identifier to the terminal device and / or the first user plane anchor point. Exemplarily, after determining the second identifier (i.e., the identifier of the second intermediate key), the session management network element also sends the second identifier to the terminal device and / or the second user plane anchor point.

[0168] In another implementation, the first identifier is the identifier of the first intermediate key, and the second identifier is the identifier of the second intermediate key. The first identifier is determined by the first user plane anchor point, and the second identifier is determined by the second user plane anchor point. For example, in step 302a above, the session management network element sends the first intermediate key to the first user plane anchor point, and then the first user plane anchor point determines the first session key and the identifier of the first intermediate key based on the first intermediate key. And in step 304a above, the session management network element sends the second intermediate key to the second user plane anchor point, and then the second user plane anchor point determines the second session key and the identifier of the second intermediate key based on the second intermediate key. Exemplarily, after determining the first identifier (i.e., the identifier of the first intermediate key), the first user plane anchor point also sends the first identifier to the terminal device. Exemplarily, after determining the second identifier (i.e., the identifier of the second intermediate key), the second user plane anchor point also sends the second identifier to the terminal device.

[0169] In another implementation, the first identifier is the identifier of the first session key, and the second identifier is the identifier of the second session key, both of which are determined by the session management network element. For example, in step 301a above, after determining the first intermediate key, the session management network element also determines the first session key and its identifier; similarly, in step 303a above, after determining the second intermediate key, the session management network element also determines the second session key and its identifier. Exemplarily, after determining the first identifier (i.e., the identifier of the first session key), the session management network element also sends the first identifier to the terminal device and / or the first user plane anchor point. Exemplarily, after determining the second identifier (i.e., the identifier of the second session key), the session management network element also sends the second identifier to the terminal device and / or the second user plane anchor point.

[0170] In another implementation, the first identifier is the identifier of the first session key, and the second identifier is the identifier of the second session key. The first identifier is determined by the first user plane anchor point, and the second identifier is determined by the second user plane anchor point. For example, in step 302a above, the session management network element sends a first intermediate key to the first user plane anchor point, and then the first user plane anchor point determines the first session key and its identifier based on the first intermediate key. Similarly, in step 304a above, the session management network element sends a second intermediate key to the second user plane anchor point, and then the second user plane anchor point determines the second session key and its identifier based on the second intermediate key. Exemplarily, after determining the first identifier (i.e., the identifier of the first session key), the first user plane anchor point also sends the first identifier to the terminal device. Exemplarily, after determining the second identifier (i.e., the identifier of the second session key), the second user plane anchor point also sends the second identifier to the terminal device.

[0171] The following describes the specific implementation methods for determining the first intermediate key by the session management network element in step 301a and the second intermediate key by the session management network element in step 303a. For example, two different implementation methods are provided below: Method 1 and Method 2.

[0172] Method 1: The session management network element determines a first intermediate key based on the session root key of the first session of the terminal device, the first value of the first counter, and / or the identifier of the first user plane anchor point. The session management network element also determines a second intermediate key based on the session root key of the first session of the terminal device, the second value of the first counter, and / or the identifier of the second user plane anchor point. The first counter is used to record the number of times the intermediate key is derived for the first session.

[0173] For example, the session management network element determines the first intermediate key based on the session root key of the first session and the identifier of the first user plane anchor point, and the session management network element determines the second intermediate key based on the session root key of the first session and the identifier of the second user plane anchor point.

[0174] For example, the session management network element determines the first intermediate key based on the session root key of the first session and the first value of the first counter, and the session management network element determines the second intermediate key based on the session root key of the first session and the second value of the first counter.

[0175] For example, the session management network element determines the first intermediate key based on the session root key of the first session, the first value of the first counter, and the identifier of the first user plane anchor point, and the session management network element determines the second intermediate key based on the session root key of the first session, the second value of the first counter, and the identifier of the second user plane anchor point.

[0176] In this method, the first counter is maintained independently by the session management network element and the terminal device. The first counter is a session-level counter; specifically, it corresponds to the first session. This first counter indicates the number of times the intermediate key corresponding to the first session has been derived, i.e., the number of times it has been used to derive the intermediate key. For example, the initial value of the first counter is set to 0. Each time the session management network element uses the current record value of the first counter to derive the intermediate key for a user plane anchor point, it increments the record value of the first counter, for example, by adding 1. Based on this example, the first value of the first counter is 0, and the second value is 1, or the first value of the first counter is 1, and the second value is 2, and so on. For example, the initial value of the session management counter is set to N, where N is a positive integer. Each time the session management network element uses the current recorded value of the first counter to deduce the intermediate key of a user plane anchor point, it decrements the recorded value of the first counter, for example, by 1. Based on this example, the first value of the first counter is 100, and the second value of the first counter is 99, or the first value of the first counter is 99, and the second value of the first counter is 98, and so on. Exemplarily, the first counter can also have other names, such as the session management counter (SMcounter).

[0177] Method 2: The session management network element determines a first intermediate key based on the session root key of the first session of the terminal device, and a first counter and / or the identifier of the first user plane anchor point. The session management network element also determines a second intermediate key based on the session root key of the first session of the terminal device, and a second counter and / or the identifier of the second user plane anchor point. The first counter is used to record the number of times the intermediate key is derived for the primary user plane anchor point of the first session, and the first user plane anchor point is the primary user plane anchor point. The second counter is used to record the number of times the intermediate key is derived for the secondary user plane anchor point of the first session, and the second user plane anchor point is the secondary user plane anchor point.

[0178] For example, the session management network element determines the first intermediate key based on the session root key of the first session and the identifier of the first user plane anchor point, and the session management network element determines the second intermediate key based on the session root key of the first session and the identifier of the second user plane anchor point.

[0179] For example, the session management network element determines the first intermediate key based on the session root key and the first counter of the first session, and the session management network element determines the second intermediate key based on the session root key and the second counter of the first session.

[0180] For example, the session management network element determines the first intermediate key based on the session root key, the first counter, and the identifier of the first user plane anchor point of the first session, and the session management network element determines the second intermediate key based on the session root key, the second counter, and the identifier of the second user plane anchor point of the first session.

[0181] In Method Two, the first counter and the second counter are two different counters, each maintained independently by the session management network element and the terminal device. The first counter corresponds to the primary user plane anchor point and indicates the number of times the intermediate key corresponding to the primary user plane anchor point is derived; that is, it indicates the number of times the first counter is used to derive the intermediate key corresponding to the primary user plane anchor point. The second counter corresponds to the secondary user plane anchor point and indicates the number of times the intermediate key corresponding to the secondary user plane anchor point is derived; that is, it indicates the number of times the second counter is used to derive the intermediate key corresponding to the secondary user plane anchor point. The secondary user plane anchor point includes the second user plane anchor point. Since there is only one primary user plane anchor point (the first user plane anchor point), there may be only one or multiple secondary user plane anchor points. For example, a secondary user plane anchor point may be the second user plane anchor point, or after the second user plane anchor point is switched to the third user plane anchor point, the third user plane anchor point may become a secondary user plane anchor point, or after the third user plane anchor point is switched to the fourth user plane anchor point, the fourth user plane anchor point may become a secondary user plane anchor point, and so on. Therefore, the first counter can also be understood as indicating the number of times the intermediate key corresponding to the first user plane anchor point is derived. As for the second counter, there are two different implementations: In the first implementation, the second counter is a counter at the user plane anchor point granularity, meaning that the aforementioned second, third, and fourth user plane anchor points all correspond to the same counter, namely the second counter. In the second implementation, the second counter is a counter at the user plane anchor point granularity, meaning that the aforementioned second user plane anchor point can correspond to the second counter, the aforementioned third user plane anchor point can correspond to the third counter, the aforementioned fourth user plane anchor point can correspond to the fourth counter, and so on, and the first, second, third, and fourth counters are different from each other. Based on this implementation, there is no necessary relationship between the value of the first counter used to derive the first intermediate key and the value of the second counter used to derive the second intermediate key.

[0182] It should be noted that, for Method 1 or Method 2 above, if the session management network element derives the second intermediate key before inserting the second user plane anchor point, and uses the identifier of the second user plane anchor point when deriving the second intermediate key, then since the session management network element cannot yet obtain the identifier of the second user plane anchor point, the identifier of the second user plane anchor point used when deriving the second intermediate key can be a preset value. The preset value, for example, is all zeros. In this case, for Method 1 above, it can also be understood that the session management network element determines the second intermediate key based on the session root key of the first session and the preset value, or the session management network element determines the second intermediate key based on the session root key of the first session, the second value of the first counter, and the preset value. For Method 2 above, it can also be understood that the session management network element determines the second intermediate key based on the session root key of the first session and the preset value, or the session management network element determines the second intermediate key based on the session root key of the first session, the second counter, and the preset value.

[0183] In one possible implementation, prior to step 301a above, the session management network element further determines to offload the user plane data of the first session. That is, when the session management network element determines to offload the user plane data of the first session, it executes step 301a and subsequent steps in the embodiment of FIG3(a). Exemplarily, the session management network element receives an indication from the terminal device or the AF network element, which indicates that the user plane data of the first session should be offloaded.

[0184] In one possible implementation, prior to step 301a above, the session management network element determines that the terminal device uses the BP (Back-to-Back) method for service flow splitting. Subsequently, when there is a service flow splitting requirement in the first session, the session management network element selects the BP as the splitting node. For example, the session management network element receives indication information from the terminal device, which instructs the terminal device to use the BP method for service flow splitting. Based on this indication information, the session management network element determines that the terminal device uses the BP method for service flow splitting. For instance, this indication information can be a 1-bit message. When the indication information is bit 0, it indicates that the terminal device uses the BP method for service flow splitting; when the indication information is bit 1, it indicates that the terminal device does not use the BP method for service flow splitting; or when the indication information is bit 1, it indicates that the terminal device uses the BP method for service flow splitting, and when the indication information is bit 0, it indicates that the terminal device does not use the BP method for service flow splitting. For example, this indication information is used to indicate that the terminal device supports multi-home IPv6 type sessions. The session management network element determines that the terminal device supports multi-home type sessions based on this indication information, and then determines that the terminal device uses the BP method to split the service flow.

[0185] In one possible implementation, the session management network element used to perform the method embodiment of FIG3(a) above can be a visited session management network element (e.g., a visited SMF (v-SMF)) or a home session management network element (e.g., a home SMF (h-SMF)). For example, if the visited session management network element determines that the first session uses home route (HR), then the visited session management network element is determined to execute the method embodiment of Figure 3(a) above. Specifically, if the visited session management network element receives information from the home session management network element (e.g., the identifier and address of the home session management network element), then the visited session management network element determines to execute the method embodiment of Figure 3(a) above. If the visited session management network element determines that the first session uses local breakout (LBO), then the visited session management network element is determined to execute the method embodiment of Figure 3(a) above. Specifically, if the visited session management network element does not receive information from the home session management network element (e.g., the identifier and address of the home session management network element), then the visited session management network element determines to execute the method embodiment of Figure 3(a) above.

[0186] Figure 3(b) is a flowchart illustrating a communication method provided in an embodiment of this application. This method is an execution method on the terminal device side corresponding to the embodiment in Figure 3(a) above, therefore the applicable scenarios of this method are the same as those applicable to the embodiment in Figure 3(a) above.

[0187] The method includes the following steps:

[0188] Step 301b: The terminal device determines the first intermediate key based on the session root key of the first session of the terminal device, and determines the first session key based on the first intermediate key.

[0189] The meanings of the session root key and the first intermediate key can be found in the description of the embodiment in Figure 3(a) above.

[0190] The method by which the terminal device determines the first intermediate key is the same as the method by which the session management network element determines the first intermediate key. Therefore, the first intermediate key determined by the terminal device is the same as the first intermediate key determined by the session management network element.

[0191] After determining the first intermediate key, the terminal device further determines the first session key based on the first intermediate key. The method by which the terminal device determines the first session key is the same as the method by which the session management network element or the first user plane anchor point determines the first session key. Therefore, the first session key determined by the terminal device is the same session key as the first session key determined by the session management network element or the first user plane anchor point.

[0192] Step 302b: The terminal device determines the second intermediate key based on the session root key of the first session of the terminal device, and determines the second session key based on the second intermediate key.

[0193] The meaning of the second intermediate key can be found in the description of the embodiment in Figure 3(a) above.

[0194] The terminal device determines the second intermediate key using the same method as the session management network element. Therefore, the second intermediate key determined by the terminal device is the same as the second intermediate key determined by the session management network element.

[0195] After determining the second intermediate key, the terminal device further determines the second session key based on the second intermediate key. The method by which the terminal device determines the second session key is the same as the method used by the session management network element or the second user plane anchor point to determine the second session key. Therefore, the second session key determined by the terminal device is the same session key as the second session key determined by the session management network element or the second user plane anchor point.

[0196] Based on the above scheme, in the scenario of service flow splitting, the terminal device obtains a first session key and a second session key. The terminal device and the first user plane anchor can perform end-to-end security protection on the user plane data of the first session between the terminal device and the first user plane anchor based on the first session key. Similarly, the terminal device and the second user plane anchor can perform end-to-end security protection on the user plane data of the first session between the terminal device and the second user plane anchor based on the second session key. This achieves security protection for user plane data between the terminal device and multiple user plane anchors in the scenario of service flow splitting. Furthermore, in this scheme, the terminal device can detect the newly inserted second user plane anchor.

[0197] In one possible implementation, the terminal device also receives a first identifier from a session management network element or a first user plane anchor point, and a second identifier from a session management network element or a second user plane anchor point. The meaning and function of the first identifier and the second identifier can be referred to the description in the embodiment of FIG3(a).

[0198] In one possible implementation, prior to step 301b above, the terminal device determines that it uses the BP (Backpropagation) method for service flow splitting, and then executes the embodiment shown in Figure 3(b). Exemplarily, the terminal device also notifies the session management network element that it uses the BP method for service flow splitting. For example, the terminal device sends an indication message to the session management network element, which instructs the terminal device to use the BP method for service flow splitting. The session management network element determines that the terminal device uses the BP method for service flow splitting based on this indication message. For a detailed description of the implementation of this indication message, please refer to the embodiment shown in Figure 3(b).

[0199] In one possible implementation, prior to step 301b above, the terminal device further determines to offload the user plane data of the first session. That is, when the terminal device determines to offload the user plane data of the first session, it executes step 301b and subsequent steps.

[0200] The embodiments in Figure 3(a) and Figure 3(b) can be implemented in combination. Specifically, on the network side, a first session key is determined by the session management network element or the first user plane anchor point. This first session key is used to protect the user plane data of the first session between the terminal device and the first user plane anchor point. Similarly, a second session key is determined by the session management network element or the second user plane anchor point. This second session key is used to protect the user plane data of the first session between the terminal device and the second user plane anchor point. On the terminal side, the terminal device determines both the first and second session keys. The network side determines that the first session key is the same as the first session key determined by the terminal device, and the second session key is the same as the second session key determined by the terminal device. Subsequently, the user plane data of the first session between the terminal device and the first user plane anchor point can be transmitted after secure protection based on the first session key, and the user plane data of the first session between the terminal device and the second user plane anchor point can be transmitted after secure protection based on the second session key. Furthermore, the splitter node cannot obtain the specific data content of the user plane data of the first session, but it can obtain the packet header of the user plane data of the first session. In the uplink direction, if the terminal device sends the user plane data of the first session to the first user plane anchor point, the packet header carries the information of the first user plane anchor point or the first identifier; if the terminal device sends the user plane data of the first session to the second user plane anchor point, the packet header carries the information of the second user plane anchor point or the second identifier. In the downlink direction, if the first user plane anchor point sends the user plane data of the first session to the terminal device, the packet header carries the information of the terminal device or the first identifier; if the second user plane anchor point sends the user plane data of the first session to the terminal device, the packet header carries the information of the terminal device or the second identifier. For a detailed description of user plane data transmission, please refer to the relevant description in the embodiment of Figure 3(a), which will not be repeated here.

[0201] The following, in conjunction with Figures 4 to 7, provides some specific examples of the embodiments shown in Figures 3(a) and 3(b). In the following embodiments, the Session Management Network Element (SMF) and the User Plane Network Element (UPF) are used as examples for illustration. Furthermore, in the following embodiments, PSA#1 is a specific example of the first User Plane anchor point in the aforementioned embodiments, and PSA#2 is a specific example of the second User Plane anchor point in the aforementioned embodiments. Also, the first session is a PDU session.

[0202] Figure 4 is a flowchart illustrating a communication method provided in an embodiment of this application. The method includes the following steps:

[0203] Step 400: The terminal device executes the registration process and registers with the network.

[0204] In step 401a, the terminal device sends a nonaccess stratum (NAS) message to the AMF. Correspondingly, the AMF receives the NAS message.

[0205] The NAS message carries session-related information and a session establishment request. The session-related information includes, for example, single network slice selection assistance information (S-NSSAI) and data network name (DNN). The session establishment request carries session establishment information, which includes, for example, S-NSSAI and DNN. Optionally, the session establishment request may also carry indication information, which may be used to indicate whether the terminal device supports traffic offloading using the BP (Browser-Based) method or to indicate the use of a multihomed IPv6 session.

[0206] In step 401b, the AMF sends a session establishment request to the SMF. Accordingly, the SMF receives the session establishment request.

[0207] In one implementation, after receiving a NAS message, the AMF retrieves session-related information from the NAS message and sends the session-related information to the UDM network element. The UDM network element retrieves the routing indication information corresponding to the session-related information and sends the routing indication information to the AMF. This routing indication information is used to indicate whether the routing method is HR or LBO.

[0208] In the LBO scenario, the AMF selects the v-SMF based on session-related information and sends a session establishment request to the v-SMF. That is, in the LBO scenario, in step 401b, the AMF sends a session establishment request to the v-SMF, and all SMFs involved in the steps after step 401b are v-SMFs.

[0209] In the HR scenario, the AMF selects the v-SMF and h-SMF based on session-related information. The AMF then sends a session establishment request and the h-SMF's identification information to the v-SMF. Upon receiving the h-SMF's identification information, the v-SMF determines not to perform key deduction operations; instead, the h-SMF performs these operations. That is, all subsequent steps after step 401b are performed by the h-SMF. The v-SMF further sends some or all of the parameters required for session establishment in the session establishment request to the h-SMF. In other words, in the HR scenario, all SMFs involved in steps after step 401b are h-SMFs.

[0210] Step 402: SMF obtains the session root key of the first session (represented by K_PDU) and derives the first intermediate key corresponding to PSA#1 (represented by K_UPF#1) based on the session root key.

[0211] For example, if the session establishment request received by the SMF carries indication information indicating that the terminal device supports traffic splitting using the BP method, the SMF will execute step 402 based on this indication information; that is, the indication information triggers the SMF to execute step 402. As another example, if the SMF determines that the terminal device supports multihomed IPv6 sessions, it will execute step 402. This is because only when the terminal device supports multihomed IPv6 sessions can BP be configured for the terminal device.

[0212] The session root key is the root key at the session level; that is, each session has a corresponding session root key.

[0213] For a detailed description of the implementation of K_UPF#1 derived from the session root key, please refer to the description of the embodiment in Figure 3(a) above.

[0214] Step 403: SMF sends a configuration request to PSA#1. PSA#1 receives the configuration request accordingly.

[0215] The configuration request includes K_UPF#1.

[0216] For example, if the SMF is a v-SMF, the v-SMF can send the configuration request to PSA#1 through the interface between the v-SMF and PSA#1, or it can send the configuration request to PSA#1 via the h-SMF.

[0217] For example, if the SMF is an h-SMF, the h-SMF can send the configuration request to PSA#1 through the interface between the h-SMF and PSA#1, or it can send the configuration request to PSA#1 via the v-SMF.

[0218] Step 404: PSA#1 derives the first session key corresponding to PSA#1 based on K_UPF#1 and the first security algorithm.

[0219] The first security algorithm includes a first confidentiality protection algorithm and / or a first integrity protection algorithm. The first session key includes a first session encryption / decryption key and / or a first session integrity protection key. The first session encryption / decryption key is derived based on K_UPF#1 and the first confidentiality protection algorithm, and is used for end-to-end confidentiality protection of user plane data in the first session between PSA#1 and the terminal device. The first session integrity protection key is derived based on K_UPF#1 and the first integrity protection algorithm, and is used for end-to-end integrity protection of user plane data in the first session between PSA#1 and the terminal device.

[0220] For details on the specific implementation method of deriving the first session key based on K_UPF#1, please refer to the description of the embodiment in Figure 3(a) above.

[0221] In step 405, PSA#1 sends a first message to the terminal device. Correspondingly, the terminal device receives the first message.

[0222] The first message can be a security mode command (SMC) message or a security mode complete (SMP) message.

[0223] For example, PSA#1 can send the first message to the terminal device via the control plane, through SMF and AMF forwarding. Alternatively, PSA#1 can send the first message to the terminal device via the user.

[0224] The first message includes the first identifier.

[0225] In one implementation, the first identifier is the identifier of the first intermediate key (represented by K_UPF#1ID). The first identifier is generated by SMF in step 402 and sent to PSA#1 through the configuration request in step 403.

[0226] In another implementation, the first identifier is the identifier of the first session key, and the first identifier is generated by PSA#1 in step 404.

[0227] The first message also indicates the first security algorithm.

[0228] If the identifier of PSA#1 (represented by PSA#1ID) is used as input when deducing K_UPF#1, then the first message also includes PSA#1ID.

[0229] In one implementation method, if the first session integrity protection key corresponding to PSA#1 is deduced in step 404, then the first message can be protected for integrity using the first session integrity protection key.

[0230] Step 406: The terminal device obtains the session root key (i.e., K_PDU) of the first session, and derives the first intermediate key (i.e., K_UPF#1) corresponding to PSA#1 based on the session root key, and derives the first session key corresponding to PSA#1 based on K_UPF#1 and the first security algorithm.

[0231] The terminal device uses the same method as SMF to derive K_UPF#1 from K_PDU. The K_PDU used by the terminal device is the same as the K_PDU used by SMF.

[0232] If PSA#1ID is used as input when SMF derives K_UPF#1, then the first message above carries PSA#1ID, and the terminal device also uses PSA#1ID as input when deriving K_UPF#1.

[0233] After generating K_UPF#1, the terminal device derives the first session key corresponding to PSA#1 using the same method as PSA#1. That is, the first session key is derived based on K_UPF#1 and the first security algorithm. This first session key is used to protect the user plane data of the first session between the terminal device and PSA#1.

[0234] Step 407: SMF inserts PSA#2 and a splitter node (e.g., BP) into the first session according to business requirements, and derives the second intermediate key (represented by K_UPF#2) corresponding to PSA#2 based on the session root key (i.e., K_PDU) of the first session.

[0235] The session root key is the same as the session root key used in the preceding steps to deduce K_UPF#1.

[0236] For a detailed description of the implementation of K_UPF#2 derived from the session root key, please refer to the description of the embodiment in Figure 3(a) above.

[0237] For example, the SMF determines the insertion offloading node based on indication information from the terminal device or AF network element, which is used to indicate offloading of user plane data for the first session.

[0238] In step 408, SMF sends a configuration request to PSA#2. PSA#2 then receives the configuration request.

[0239] The configuration request includes K_UPF#2.

[0240] For example, if the SMF is a v-SMF, the v-SMF can send the configuration request to PSA#2 through the interface between the v-SMF and PSA#2, or it can send the configuration request to PSA#2 via the h-SMF.

[0241] For example, if the SMF is an h-SMF, the h-SMF can send the configuration request to PSA#2 through the interface between the h-SMF and PSA#2, or it can send the configuration request to PSA#2 via the v-SMF.

[0242] Step 409: PSA#2 derives the second session key corresponding to PSA#2 based on K_UPF#2 and the second security algorithm.

[0243] The second security algorithm includes a second confidentiality protection algorithm and / or a second integrity protection algorithm. The second session key includes a second session encryption / decryption key and / or a second session integrity protection key. The second session encryption / decryption key is derived from K_UPF#2 and the second confidentiality protection algorithm, and is used for end-to-end confidentiality protection of user plane data in the first session between PSA#2 and the terminal device. The second session integrity protection key is derived from K_UPF#2 and the second integrity protection algorithm, and is used for end-to-end integrity protection of user plane data in the first session between PSA#2 and the terminal device.

[0244] For details on the specific implementation method of deriving the second session key based on K_UPF#2, please refer to the description of the embodiment in Figure 3(a) above.

[0245] In step 410, PSA#2 sends a second message to the terminal device. Correspondingly, the terminal device receives the second message.

[0246] The second message can be an SMC message or an SMP message.

[0247] For example, PSA#2 can send a second message to the terminal device via the control plane, through SMF and AMF forwarding. Alternatively, PSA#2 can send a second message to the terminal device via the user.

[0248] The second message includes a second identifier.

[0249] In one implementation, the second identifier is the identifier of the second intermediate key (represented by K_UPF#2ID). The second identifier is generated by SMF in step 407 and sent to PSA#2 through the configuration request in step 408.

[0250] In another implementation, the second identifier is an identifier for the second session key, and the second identifier is generated by PSA#2 in step 409.

[0251] The second message also instructs on a second security algorithm.

[0252] If the identifier of PSA#2 (represented by PSA#2ID) is used as input when deducing K_UPF#2, then the second message also includes PSA#2ID.

[0253] In one implementation method, if the second session integrity protection key corresponding to PSA#2 is deduced in step 409, the second message can be protected for integrity using the second session integrity protection key.

[0254] Step 411: The terminal device obtains the session root key (i.e., K_PDU) of the first session, and derives the second intermediate key (i.e., K_UPF#2) corresponding to PSA#2 based on the session root key, and derives the second session key corresponding to PSA#2 based on K_UPF#2 and the second security algorithm.

[0255] The terminal device uses the same method as SMF to derive K_UPF#2 from K_PDU. The K_PDU used by the terminal device is the same as the K_PDU used by SMF.

[0256] If PSA#2ID is used as input when SMF derives K_UPF#2, then the second message above carries PSA#2ID, and the terminal device also uses PSA#2ID as input when deriving K_UPF#2.

[0257] After generating K_UPF#2, the terminal device derives the second session key corresponding to PSA#2 using the same method as deriving the second session key corresponding to PSA#2 from PSA#2. That is, the second session key is derived based on K_UPF#2 and the second security algorithm. This second session key is used to protect the user plane data of the first session between the terminal device and PSA#2.

[0258] After the terminal device and PSA#2 complete the SMC or SMP procedure and enable the corresponding security, the terminal device enables packet marking for the uplink data packets of the first session, adding a first identifier or a second identifier to the packet header. Correspondingly, PSA#2 enables packet marking for the downlink data packets of the first session, adding a second identifier to the packet header.

[0259] In step 412, SMF sends a configuration request to the splitter node. Correspondingly, the splitter node receives the configuration request.

[0260] The configuration request includes a traffic splitting rule that instructs that data packets carrying a first identifier from the terminal device be sent to PSA#1, and data packets carrying a first identifier from PSA#1 be sent to the terminal device, and / or instructs that data packets carrying a second identifier from the terminal device be sent to PSA#2, and data packets carrying a second identifier from PSA#2 be sent to the terminal device.

[0261] For example, if the SMF is a v-SMF, the v-SMF can send the configuration request to the splitter node through the interface between the v-SMF and the splitter node, or it can send the configuration request to the splitter node via the h-SMF.

[0262] For example, if the SMF is an h-SMF, the h-SMF can send the configuration request to the splitter node through the interface between the h-SMF and the splitter node, or it can send the configuration request to the splitter node via the v-SMF.

[0263] Step 413: SMF sends a configuration request to PSA#1. PSA#1 then receives the configuration request.

[0264] This configuration request is used to instruct PSA#1 to enable the marking of downlink packets for the first session.

[0265] Based on this configuration request, PSA#1 enables packet marking for downlink packets in the first session, that is, adds a first identifier to the packet header.

[0266] For example, if the SMF is a v-SMF, the v-SMF can send the configuration request to PSA#1 through the interface between the v-SMF and PSA#1, or it can send the configuration request to PSA#1 via the h-SMF.

[0267] For example, if the SMF is an h-SMF, the h-SMF can send the configuration request to PSA#1 through the interface between the h-SMF and PSA#1, or it can send the configuration request to PSA#1 via the v-SMF.

[0268] Step 414: SMF configures the uplink tunnel for the access network device and continues the subsequent session process.

[0269] For example, SMF can configure the receiving port of the uplink tunnel of the access network device as the port of the splitter node through AMF.

[0270] Based on the above scheme, when using the traffic splitting node to split the service flow of the terminal device's session, the terminal device establishes different secure tunnels with different PSAs to achieve end-to-end security, so as to realize end-to-end security protection between the terminal device and multiple PSAs.

[0271] Figure 5 is a flowchart illustrating a communication method provided in an embodiment of this application. The method includes the following steps:

[0272] Step 500 is the same as step 400 in the embodiment shown in Figure 4.

[0273] Step 501a is the same as step 401a in the embodiment of Figure 4.

[0274] Step 501b is the same as step 401b in the embodiment of Figure 4.

[0275] Step 502: SMF obtains the session root key of the first session (represented by K_PDU), and derives the first intermediate key (represented by K_UPF#1) corresponding to PSA#1 based on the session root key, and derives the second intermediate key (represented by K_UPF#2).

[0276] PSA#1 is the primary user plane anchor point or primary PSA for the first session.

[0277] For example, if the session establishment request received by the SMF carries indication information indicating that the terminal device supports traffic splitting using the BP method, the SMF will execute step 502 based on this indication information; that is, the indication information triggers the SMF to execute step 502. As another example, if the SMF determines that the terminal device supports multihomed IPv6 sessions, it will execute step 502. This is because only when the terminal device supports multihomed IPv6 sessions can BP be configured for the terminal device.

[0278] The session root key is the root key at the session level, meaning that there is one session root key for each PDU session.

[0279] For a detailed description of the implementation of K_UPF#1 derived from the session root key, please refer to the description of the embodiment in Figure 3(a) above.

[0280] For a detailed explanation of how to derive K_UPF#2 from the session root key, please refer to the description of the embodiment in Figure 3(a) above. It should be noted that if the PSA identifier is used when deriving K_UPF#2, since no PSA#2 has been selected for insertion at this time, the PSA identifier can be a preset value. For example, the preset value can be all zeros or a null value.

[0281] Steps 503 to 505 are the same as steps 403 to 405 in the embodiment of Figure 4.

[0282] Step 506: The terminal device obtains the session root key (i.e., K_PDU) of the first session, and derives the first intermediate key (i.e., K_UPF#1) corresponding to PSA#1 based on the session root key, as well as the second intermediate key (i.e., K_UPF#2) based on the derived second intermediate key (i.e., K_UPF#2), and derives the first session key corresponding to PSA#1 based on K_UPF#1 and the first security algorithm.

[0283] The terminal device uses the same method as SMF to deduce K_UPF#1 corresponding to PSA#1 based on K_PDU, and to deduce K_UPF#2 based on K_PDU.

[0284] If PSA#1ID is used as input when SMF derives K_UPF#1, then the first message above carries PSA#1ID, and the terminal device also uses PSA#1ID as input when deriving K_UPF#1.

[0285] If the PSA identifier is used when deriving K_UPF#2, since no PSA#2 has been selected for insertion at this time, the PSA identifier can be the default value.

[0286] After generating K_UPF#1, the terminal device derives the first session key corresponding to PSA#1 using the same method as PSA#1. That is, the first session key is derived based on K_UPF#1 and the first security algorithm. This first session key is used to protect the user plane data of the first session between the terminal device and PSA#1.

[0287] Step 507: SMF inserts PSA#2 and a splitter node (e.g., BP) for the first session according to business requirements, and determines the intermediate key corresponding to PSA#2 (represented by K_UPF).

[0288] Since the PSA#2 inserted by SMF for the first session is the first PSA inserted by SMF, the K_UPF corresponding to PSA#2 determined by SMF in step 507 is K_UPF#2. That is, SMF uses the K_UPF#2 pre-derived in step 502 as the K_UPF corresponding to PSA#2. This PSA#2 is the secondary user plane anchor point or secondary PSA of the first session.

[0289] It should be noted that if the secondary PSA of the first session changes, for example, from PSA#2 to PSA#3, the SMF needs to redetermine the intermediate key corresponding to PSA#3 (denoted as K_UPF#3). For example, the SMF can deduce the K_UPF#3 corresponding to PSA#3 based on the session root key (i.e., K_PDU) of the first session.

[0290] Step 508: SMF sends a configuration request to PSA#2. PSA#2 receives the configuration request accordingly.

[0291] The configuration request includes K_UPF corresponding to PSA#2, which is K_UPF#2.

[0292] For example, if the SMF is a v-SMF, the v-SMF can send the configuration request to PSA#2 through the interface between the v-SMF and PSA#2, or it can send the configuration request to PSA#2 via the h-SMF.

[0293] For example, if the SMF is an h-SMF, the h-SMF can send the configuration request to PSA#2 through the interface between the h-SMF and PSA#2, or it can send the configuration request to PSA#2 via the v-SMF.

[0294] Step 509: Based on the K_UPF (i.e. K_UPF#2) corresponding to PSA#2 and the second security algorithm, the second session key corresponding to PSA#2 is derived.

[0295] The second security algorithm includes a second confidentiality protection algorithm and / or a second integrity protection algorithm. The second session key includes a second session encryption / decryption key and / or a second session integrity protection key. The second session encryption / decryption key is derived from K_UPF#2 and the second confidentiality protection algorithm, and is used for end-to-end confidentiality protection of user plane data in the first session between PSA#2 and the terminal device. The second session integrity protection key is derived from K_UPF#2 and the second integrity protection algorithm, and is used for end-to-end integrity protection of user plane data in the first session between PSA#2 and the terminal device.

[0296] For details on the specific implementation method of deriving the second session key based on K_UPF#2, please refer to the description of the embodiment in Figure 3(a) above.

[0297] In step 510, PSA#2 sends a second message to the terminal device. Correspondingly, the terminal device receives the second message.

[0298] The second message can be an SMC message or an SMP message.

[0299] For example, PSA#2 can send a second message to the terminal device via the control plane, through SMF and AMF forwarding. Alternatively, PSA#2 can send a second message to the terminal device via the user.

[0300] The second message includes a second identifier.

[0301] In one implementation, the second identifier is the identifier of the second intermediate key (represented by K_UPF#2ID). The second identifier is generated by SMF in step 502 or step 507 and sent to PSA#2 through the configuration request in step 508.

[0302] In another implementation, the second identifier is an identifier for the second session key, and the second identifier is generated by PSA#2 in step 509.

[0303] The second message also instructs on a second security algorithm.

[0304] If the identifier of PSA#2 (represented by PSA#2ID) is used as input when deducing K_UPF#2, then the second message also includes PSA#2ID.

[0305] In one implementation method, if the second session integrity protection key corresponding to PSA#2 is deduced in step 509, then the second message can be protected for integrity using the second session integrity protection key.

[0306] Step 511: The terminal device determines the intermediate key (represented by K_UPF) corresponding to PSA#2, and derives the second session key corresponding to PSA#2 based on the K_UPF corresponding to PSA#2 and the second security algorithm.

[0307] Since PSA#2 inserted by SMF for the first session is the first PSA inserted by SMF, in step 511, the terminal device uses the same method as SMF to determine that the K_UPF corresponding to PSA#2 is K_UPF#2. That is, the terminal device uses the K_UPF#2 pre-derived in step 506 as the K_UPF corresponding to PSA#2. This PSA#2 is the secondary user plane anchor point or secondary PSA of the first session.

[0308] It should be noted that if the secondary PSA of the subsequent first session changes, for example, from PSA#2 to PSA#3, the terminal device will re-determine the intermediate key corresponding to PSA#3 (represented by K_UPF#3) in the same way as SMF.

[0309] After determining K_UPF#2 corresponding to PSA#2, the terminal device derives the second session key corresponding to PSA#2 using the same method as PSA#2, that is, it derives the second session key based on K_UPF#2 and the second security algorithm. This second session key is used to protect the user plane data of the first session between the terminal device and PSA#2.

[0310] After the terminal device and PSA#2 complete the SMC or SMP procedure and enable the corresponding security, the terminal device enables packet marking for the uplink data packets of the first session, adding a first identifier or a second identifier to the packet header. Correspondingly, PSA#2 enables packet marking for the downlink data packets of the first session, adding a second identifier to the packet header.

[0311] Steps 512 to 514 are the same as steps 412 to 414 in the embodiment of Figure 4.

[0312] Based on the above scheme, when using the traffic splitting node to split the service flow of the terminal device's session, the terminal device establishes different secure tunnels with different PSAs to achieve end-to-end security, so as to realize end-to-end security protection between the terminal device and multiple PSAs.

[0313] The main difference between the embodiment in Figure 5 and the embodiment in Figure 4 is that in the embodiment in Figure 4, when establishing a session, after selecting PSA#1, the intermediate key corresponding to PSA#1 is deduced, and after selecting and inserting PSA#2, the intermediate key corresponding to PSA#2 is deduced again; while in the embodiment in Figure 5, when establishing a session, after selecting PSA#1, the intermediate key corresponding to PSA#1 is deduced, and a backup intermediate key is also deduced. Subsequently, after selecting and inserting PSA#2, it is not necessary to deduce the intermediate key corresponding to PSA#2, but the previously deduced backup intermediate key is used as the intermediate key corresponding to PSA#2.

[0314] Figure 6 is a flowchart illustrating a communication method provided in an embodiment of this application. The method includes the following steps:

[0315] Step 600 is the same as step 400 in the embodiment of Figure 4.

[0316] Step 601a is the same as step 401a in the embodiment of Figure 4.

[0317] Step 601b is the same as step 401b in the embodiment of Figure 4.

[0318] Step 602 is the same as step 402 in the embodiment of Figure 4.

[0319] Step 603: SMF deduces the first session key corresponding to PSA#1 based on K_UPF#1 and the first security algorithm.

[0320] The first security algorithm includes a first confidentiality protection algorithm and / or a first integrity protection algorithm. The first session key includes a first session encryption / decryption key and / or a first session integrity protection key. The first session encryption / decryption key is derived based on K_UPF#1 and the first confidentiality protection algorithm, and is used for end-to-end confidentiality protection of user plane data in the first session between PSA#1 and the terminal device. The first session integrity protection key is derived based on K_UPF#1 and the first integrity protection algorithm, and is used for end-to-end integrity protection of user plane data in the first session between PSA#1 and the terminal device.

[0321] For a detailed description of the implementation method for obtaining the first session key based on SMF, please refer to the description of the embodiment in Figure 3(a) above.

[0322] In step 604, the SMF sends a configuration request to PSA#1. PSA#1 then receives the configuration request.

[0323] The configuration request includes K_UPF#1 and a first identifier, which is either the identifier of the first intermediate key (represented by K_UPF#1ID) or the identifier of the first session key.

[0324] For example, if the SMF is a v-SMF, the v-SMF can send the configuration request to PSA#1 through the interface between the v-SMF and PSA#1, or it can send the configuration request to PSA#1 via the h-SMF.

[0325] For example, if the SMF is an h-SMF, the h-SMF can send the configuration request to PSA#1 through the interface between the h-SMF and PSA#1, or it can send the configuration request to PSA#1 via the v-SMF.

[0326] In step 605, the SMF sends a first message to the terminal device. Correspondingly, the terminal device receives the first message.

[0327] The first message can be an SMC message or an SMP message.

[0328] The first message includes the first identifier.

[0329] The first message also indicates the first security algorithm.

[0330] If the identifier of PSA#1 (represented by PSA#1ID) is used as input when deducing K_UPF#1, then the first message also includes PSA#1ID.

[0331] In one implementation method, if the first session integrity protection key corresponding to PSA#1 is deduced in step 603, then the first message can be protected for integrity using the first session integrity protection key.

[0332] The order of steps 604 and 605 is not limited.

[0333] Steps 606 to 607 are the same as steps 406 to 407 in the embodiment of Figure 4.

[0334] Step 608: SMF deduces the second session key corresponding to PSA#2 based on K_UPF#2 and the second security algorithm.

[0335] The second security algorithm includes a second confidentiality protection algorithm and / or a second integrity protection algorithm. The second session key includes a second session encryption / decryption key and / or a second session integrity protection key. The second session encryption / decryption key is derived from K_UPF#2 and the second confidentiality protection algorithm, and is used for end-to-end confidentiality protection of user plane data in the first session between PSA#2 and the terminal device. The second session integrity protection key is derived from K_UPF#2 and the second integrity protection algorithm, and is used for end-to-end integrity protection of user plane data in the first session between PSA#2 and the terminal device.

[0336] For a detailed description of the implementation method for obtaining the second session key based on SMF, please refer to the description of the embodiment in Figure 3(a) above.

[0337] In step 609, SMF sends a configuration request to PSA#2. PSA#2 then receives the configuration request.

[0338] The configuration request includes K_UPF#2 and a second identifier, which is either the identifier of the second intermediate key (represented by K_UPF#2ID) or the identifier of the second session key.

[0339] For example, if the SMF is a v-SMF, the v-SMF can send the configuration request to PSA#2 through the interface between the v-SMF and PSA#2, or it can send the configuration request to PSA#2 via the h-SMF.

[0340] For example, if the SMF is an h-SMF, the h-SMF can send the configuration request to PSA#2 through the interface between the h-SMF and PSA#2, or it can send the configuration request to PSA#2 via the v-SMF.

[0341] In step 610, the SMF sends a second message to the terminal device. Correspondingly, the terminal device receives the second message.

[0342] The second message can be an SMC message or an SMP message.

[0343] The second message includes a second identifier.

[0344] If the identifier of PSA#2 (represented by PSA#2ID) is used as input when deducing K_UPF#2, then the second message also includes PSA#2ID.

[0345] In one implementation method, if the second session integrity protection key corresponding to PSA#2 is deduced in step 608, then the second message can be protected for integrity using the second session integrity protection key.

[0346] The order of steps 609 and 610 above is not limited.

[0347] Steps 611 to 614 are the same as steps 411 to 414 in the embodiment of Figure 4.

[0348] Based on the above scheme, when using the traffic splitting node to split the service flow of the terminal device's session, the terminal device establishes different secure tunnels with different PSAs to achieve end-to-end security, so as to realize end-to-end security protection between the terminal device and multiple PSAs.

[0349] The main difference between the embodiment in Figure 6 and the embodiment in Figure 4 is that in the embodiment in Figure 4, the first session key is derived from PSA#1 and a first message is sent to the terminal device, and the second session key is derived from PSA#2 and a second message is sent to the terminal device; while in the embodiment in Figure 6, the first session key is derived from SMF and a first message is sent to the terminal device, and the second session key is derived from SMF and a second message is sent to the terminal device.

[0350] Figure 7 is a flowchart illustrating a communication method provided in an embodiment of this application. The method includes the following steps:

[0351] Step 700 is the same as step 500 in the embodiment shown in Figure 5.

[0352] Step 701a is the same as step 501a in the embodiment of Figure 5.

[0353] Step 701b is the same as step 501b in the embodiment of Figure 5.

[0354] Step 702 is the same as step 502 in the embodiment of Figure 5.

[0355] Step 703: SMF deduces the first session key corresponding to PSA#1 based on K_UPF#1 and the first security algorithm.

[0356] The first security algorithm includes a first confidentiality protection algorithm and / or a first integrity protection algorithm. The first session key includes a first session encryption / decryption key and / or a first session integrity protection key. The first session encryption / decryption key is derived based on K_UPF#1 and the first confidentiality protection algorithm, and is used for end-to-end confidentiality protection of user plane data in the first session between PSA#1 and the terminal device. The first session integrity protection key is derived based on K_UPF#1 and the first integrity protection algorithm, and is used for end-to-end integrity protection of user plane data in the first session between PSA#1 and the terminal device.

[0357] For a detailed description of the implementation method for obtaining the first session key based on SMF, please refer to the description of the embodiment in Figure 3(a) above.

[0358] In step 704, the SMF sends a configuration request to PSA#1. PSA#1 then receives the configuration request.

[0359] The configuration request includes K_UPF#1 and a first identifier, which is either the identifier of the first intermediate key (represented by K_UPF#1ID) or the identifier of the first session key.

[0360] For example, if the SMF is a v-SMF, the v-SMF can send the configuration request to PSA#1 through the interface between the v-SMF and PSA#1, or it can send the configuration request to PSA#1 via the h-SMF.

[0361] For example, if the SMF is an h-SMF, the h-SMF can send the configuration request to PSA#1 through the interface between the h-SMF and PSA#1, or it can send the configuration request to PSA#1 via the v-SMF.

[0362] Step 705: SMF sends a first message to the terminal device. Correspondingly, the terminal device receives the first message.

[0363] The first message can be an SMC message or an SMP message.

[0364] The first message includes the first identifier.

[0365] The first message also indicates the first security algorithm.

[0366] If the identifier of PSA#1 (represented by PSA#1ID) is used as input when deducing K_UPF#1, then the first message also includes PSA#1ID.

[0367] In one implementation method, if the first session integrity protection key corresponding to PSA#1 is deduced in step 703, then the first message can be protected for integrity using the first session integrity protection key.

[0368] The order of steps 704 and 705 is not limited.

[0369] Steps 706 to 707 are the same as steps 506 to 507 in the embodiment of Figure 5.

[0370] Step 708: SMF deduces the second session key corresponding to PSA#2 based on K_UPF (i.e. K_UPF#2) corresponding to PSA#2 and the second security algorithm.

[0371] The second security algorithm includes a second confidentiality protection algorithm and / or a second integrity protection algorithm. The second session key includes a second session encryption / decryption key and / or a second session integrity protection key. The second session encryption / decryption key is derived from K_UPF#2 and the second confidentiality protection algorithm, and is used for end-to-end confidentiality protection of user plane data in the first session between PSA#2 and the terminal device. The second session integrity protection key is derived from K_UPF#2 and the second integrity protection algorithm, and is used for end-to-end integrity protection of user plane data in the first session between PSA#2 and the terminal device.

[0372] For a detailed description of the implementation method for obtaining the second session key based on SMF, please refer to the description of the embodiment in Figure 3(a) above.

[0373] In step 709, the SMF sends a configuration request to PSA#2. PSA#2 then receives the configuration request.

[0374] The configuration request includes the K_UPF (i.e. K_UPF#2) corresponding to PSA#2 and a second identifier, which is the identifier of the second intermediate key (represented by K_UPF#2ID) or the identifier of the second session key.

[0375] For example, if the SMF is a v-SMF, the v-SMF can send the configuration request to PSA#2 through the interface between the v-SMF and PSA#2, or it can send the configuration request to PSA#2 via the h-SMF.

[0376] For example, if the SMF is an h-SMF, the h-SMF can send the configuration request to PSA#2 through the interface between the h-SMF and PSA#2, or it can send the configuration request to PSA#2 via the v-SMF.

[0377] In step 710, the SMF sends a second message to the terminal device. Correspondingly, the terminal device receives the second message.

[0378] The second message can be an SMC message or an SMP message.

[0379] The second message includes a second identifier.

[0380] If the identifier of PSA#2 (represented by PSA#2ID) is used as input when deducing K_UPF#2, then the second message also includes PSA#2ID.

[0381] In one implementation method, if the second session integrity protection key corresponding to PSA#2 is deduced in step 708, then the second message can be protected for integrity using the second session integrity protection key.

[0382] The order of steps 709 and 710 above is not limited.

[0383] Steps 711 to 714 are the same as steps 511 to 514 in the embodiment of Figure 5.

[0384] Based on the above scheme, when using the traffic splitting node to split the service flow of the terminal device's session, the terminal device establishes different secure tunnels with different PSAs to achieve end-to-end security, so as to realize end-to-end security protection between the terminal device and multiple PSAs.

[0385] The main difference between the embodiment in Figure 7 and the embodiment in Figure 5 is that in the embodiment in Figure 5, the first session key is derived from PSA#1 and a first message is sent to the terminal device, and the second session key is derived from PSA#2 and a second message is sent to the terminal device; while in the embodiment in Figure 7, the first session key is derived from SMF and a first message is sent to the terminal device, and the second session key is derived from SMF and a second message is sent to the terminal device.

[0386] Figure 8 illustrates a possible exemplary block diagram of the communication device involved in the embodiments of this application. As shown in Figure 8, the communication device 800 may include modules or units for implementing the methods described above. In one possible design, the communication device 800 includes a processing unit 802 and a communication unit 803. Optionally, the communication device 800 may further include a storage unit 801 for storing device program code and / or data.

[0387] The communication device 800 can also be a network-side device in the above embodiments, such as a session management network element on the network side, a module (e.g., circuit, chip or chip system) in the session management network element, or a logical node, logical module or software that can implement all or part of the functions of the session management network element.

[0388] For example, in one embodiment, processing unit 802 is configured to determine a first intermediate key based on the session root key of the first session of the terminal device. The first intermediate key is used to deduce a first session key, and the first session key is used to protect the user plane data of the first session between the terminal device and the first user plane anchor. Communication unit 803 is configured to send the first intermediate key or the first session key to the first user plane anchor. Processing unit 802 is further configured to determine a second intermediate key based on the session root key. The second intermediate key is used to deduce a second session key, and the second session key is used to protect the user plane data of the first session between the terminal device and the second user plane anchor. Communication unit 803 is further configured to send the second intermediate key or the second session key to the second user plane anchor. The user plane data of the first session between the terminal device and the first user plane anchor, and the user plane data of the first session between the terminal device and the second user plane anchor, are both routed by the routing node of the first session.

[0389] In one possible implementation, the communication unit 803 is further configured to send a first identifier to the terminal device, the first identifier being an identifier of the first intermediate key or an identifier of the first session key, the first identifier being used to route user plane data of the first session to the first user plane anchor point; and to send a second identifier to the terminal device, the second identifier being an identifier of the second intermediate key or an identifier of the second session key, the second identifier being used to route user plane data of the first session to the second user plane anchor point.

[0390] In one possible implementation, the communication unit 803 is further configured to send a traffic splitting rule to the splitting node; wherein the traffic splitting rule is configured to instruct the user plane data of the first session carrying the first identifier from the terminal device to be sent to the first user plane anchor point, and the user plane data of the first session carrying the second identifier from the terminal device to the second user plane anchor point; and / or, the traffic splitting rule is configured to instruct the user plane data of the first session carrying the first identifier from the first user plane anchor point to be sent to the terminal device, and the user plane data of the first session carrying the second identifier from the second user plane anchor point to be sent to the terminal device.

[0391] In one possible implementation, processing unit 802 is configured to determine a first intermediate key based on the session root key of a first session of the terminal device, including: determining the first intermediate key based on the session root key, a first value of a first counter, and / or the identifier of the first user plane anchor point, wherein the first counter is used to record the number of times the intermediate key is derived for the first session; processing unit 802 is configured to determine a second intermediate key based on the session root key, including: determining the second intermediate key based on the session root key, a second value of the first counter, and / or the identifier of the second user plane anchor point.

[0392] In one possible implementation, processing unit 802 is configured to determine a first intermediate key based on the session root key of a first session of the terminal device, including: determining the first intermediate key based on the session root key, a first counter, and / or the identifier of the first user plane anchor, wherein the first counter is used to record the number of times the intermediate key is derived for the primary user plane anchor of the first session, and the first user plane anchor is the primary user plane anchor; processing unit 802 is configured to determine a second intermediate key based on the session root key, including: determining the second intermediate key based on the session root key, a second counter, and / or the identifier of the second user plane anchor, wherein the second counter is used to record the number of times the intermediate key is derived for the secondary user plane anchor of the first session, and the second user plane anchor is the secondary user plane anchor.

[0393] In one possible implementation, the identifier of the second user plane anchor point is a preset value.

[0394] In one possible implementation, the processing unit 802 is further configured to determine, before determining the first intermediate key based on the session root key of the first session of the terminal device, that the terminal device uses a branch point (BP) method to split the service flow, wherein the splitting node is a BP.

[0395] In one possible implementation, the processing unit 802 is configured to determine that the terminal device uses the BP method to split the service flow, including: receiving indication information from the terminal device through the communication unit 803, the indication information being used to instruct the terminal device to use the BP method to split the service flow, wherein the splitting node is a BP.

[0396] In one possible implementation, the processing unit 802 is configured to determine a first intermediate key based on the session root key of the first session of the terminal device, including: determining the first intermediate key based on the session root key if it is determined that no information from the home session management network element has been received.

[0397] In one possible implementation, the first session key is derived based on the first intermediate key and a first security algorithm, the first security algorithm including a first confidentiality protection algorithm and / or a first integrity protection algorithm; the second session key is derived based on the second intermediate key and a second security algorithm, the second security algorithm including a second confidentiality protection algorithm and / or a second integrity protection algorithm.

[0398] In one possible implementation, the processing unit 802 is configured to determine a first intermediate key based on the session root key of the first session of the terminal device, including: determining the first intermediate key based on the session root key when it is determined that user plane data of the first session will be split.

[0399] The communication device 800 can be a terminal device-side device in the above embodiments, such as a terminal device or a communication module in a terminal device, or a circuit or chip in a terminal device that is responsible for communication functions.

[0400] For example, in one embodiment, the processing unit 802 is configured to determine a first intermediate key based on the session root key of the first session of the terminal device, and deduce a first session key based on the first intermediate key, wherein the first session key is used to protect the user plane data of the first session between the terminal device and the first user plane anchor point; determine a second intermediate key based on the session root key, and deduce a second session key based on the second intermediate key, wherein the second session key is used to protect the user plane data of the first session between the terminal device and the second user plane anchor point; wherein the user plane data of the first session between the terminal device and the first user plane anchor point and the user plane data of the first session between the terminal device and the second user plane anchor point are both routed by the routing node of the first session.

[0401] In one possible implementation, the communication unit 803 is configured to receive a first identifier, which is an identifier of the first intermediate key or an identifier of the first session key; send first data of the first session, the first data carrying the first identifier, the first identifier being used to route the first data to the first user plane anchor point, the first data being securely protected according to the first session key; receive a second identifier, the second identifier being an identifier of the second intermediate key or an identifier of the second session key; and send second data of the first session, the second data carrying the second identifier, the second identifier being used to route the second data to the second user plane anchor point, the second data being securely protected according to the second session key.

[0402] In one possible implementation, the processing unit 802 is further configured to perform security processing on the user plane data of the first session based on the first session key, and send the security-processed user plane data of the first session through the communication unit 803, wherein the header of the security-processed user plane data of the first session carries information of the first user plane anchor point; the processing unit 802 is further configured to perform security processing on the user plane data of the first session based on the second session key, and send the security-processed user plane data of the first session through the communication unit 803, wherein the header of the security-processed user plane data of the first session carries information of the second user plane anchor point.

[0403] In one possible implementation, processing unit 802 is configured to determine a first intermediate key based on the session root key of a first session of the terminal device, including: determining the first intermediate key based on the session root key, a first value of a first counter, and / or the identifier of the first user plane anchor point, wherein the first counter is used to record the number of times the intermediate key is derived for the first session; processing unit 802 is configured to determine a second intermediate key based on the session root key, including: determining the second intermediate key based on the session root key, a second value of the first counter, and / or the identifier of the second user plane anchor point.

[0404] In one possible implementation, processing unit 802 is configured to determine a first intermediate key based on the session root key of a first session of the terminal device, including: determining the first intermediate key based on the session root key, a first counter, and / or the identifier of the first user plane anchor, wherein the first counter is used to record the number of times the intermediate key is derived for the primary user plane anchor of the first session, and the first user plane anchor is the primary user plane anchor; processing unit 802 is configured to determine a second intermediate key based on the session root key, including: determining the second intermediate key based on the session root key, a second counter, and / or the identifier of the second user plane anchor, wherein the second counter is used to record the number of times the intermediate key is derived for the secondary user plane anchor of the first session, and the second user plane anchor is the secondary user plane anchor.

[0405] In one possible implementation, the identifier of the second user plane anchor point is a preset value.

[0406] In one possible implementation, the processing unit 802 is further configured to determine, before determining the first intermediate key based on the session root key of the first session of the terminal device, that the terminal device uses the BP method to split the service flow, wherein the splitting node is a BP.

[0407] In one possible implementation, the communication unit 803 is further configured to send indication information, which instructs the terminal device to use the BP method to split the service flow, wherein the splitting node is a BP.

[0408] In one possible design, when the communication device 800 is a terminal device or a communication module within a terminal device, the function of the processing unit 802 can be implemented by one or more processors. Specifically, the processor may include a modem chip, or a system-on-a-chip (SoC) chip or a SIP chip containing a modem core. The function of the communication unit 803 can be implemented by transceiver circuitry.

[0409] In one possible design, when the communication device 800 is a circuit or chip responsible for communication functions in a terminal device, such as a modem chip or a system-on-a-chip (SoC) or SIP chip containing a modem core, the function of the processing unit 802 can be implemented by a circuit system in the aforementioned chip that includes one or more processors or processor cores. The function of the communication unit 803 can be implemented by an interface circuit or data transceiver circuit on the aforementioned chip.

[0410] It is understood that the division of units in the above-described device is merely a logical functional division. One function can correspond to one functional unit, or two or more functions can be integrated into one functional unit. In actual implementation, all or some units can be integrated onto a single physical entity, or distributed across different physical entities. Furthermore, the aforementioned functional units can be implemented in hardware, software, or a combination of both. Whether a function is executed in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for specific applications, but such implementations should not be considered beyond the scope of this application.

[0411] In one example, the functional unit in any of the above devices may be one or more integrated circuits configured to implement the above methods, such as: one or more application-specific integrated circuits (ASICs), or one or more central processing units (CPUs), one or more microcontroller units (MCUs), one or more digital signal processors (DSPs), or one or more field-programmable gate arrays (FPGAs), or a combination of at least two of these integrated circuit forms.

[0412] In one example, storage unit 801 may include random access memory, flash memory, read-only memory, programmable read-only memory or electrically erasable programmable memory and / or registers, etc.

[0413] Figure 9 is a schematic diagram of the structure of a terminal device 900 provided in an embodiment of this application. This terminal device 900 corresponds to the terminal devices shown in Figures 1 and 2 and is used to implement the operation of the terminal devices in the above embodiments. As shown in Figure 9, the terminal device includes: one or more antennas 910, a radio frequency processing system 920, and a processor system 930.

[0414] In the downlink or sidelink direction, the RF processing system 920 receives RF signals through the antenna 910 and sends the RF-processed signals to the processor system 930 for further processing. In the uplink or sidelink direction, the processor system 930 processes the information from the terminal device side and sends it to the RF processing system 920, which then processes the signal and transmits it through the antenna 910.

[0415] In one example, the radio frequency (RF) processing system 920 serves as the communication interface for external communication of the terminal device and may include a radio frequency frontend (RFFE) 921 and an RF transceiver 922. The RFFE 921 is primarily used for one or more processing operations, such as shaping, passband selection, or gain adjustment, on the RF signals received by the antenna or those to be transmitted through the antenna. It may include one or more components such as RF switches, duplexers, filters, power amplifiers, antenna tuners, and low-noise amplifiers. The RFFE 921 can be a circuit system composed of multiple discrete components or integrated into one or more chips. The RF transceiver 922 processes the RF signals received by the RFFE into baseband / IF signals for further processing by the processor system 930, and processes the baseband / IF signals provided by the processor system 930 into RF signals for transmission to the RFFE 921. The baseband / IF signals transmitted between the RF transceiver 922 and the processor system 930 can be digital or analog signals. The RF transceiver 922 can be implemented by one or more chips, which are commonly referred to as RF ICs.

[0416] In one example, the processor system 930 may include one or more processors for processing signals and executing one or more communication protocols. Optionally, the processor system 930 may also include a memory 936. In one example, the one or more processors include at least one baseband processor 931 (also known as a modem processor). The memory 936 is used to store data and / or computer program instructions. Optionally, the processor system 930 may also include one or more application processors 932 for implementing processing of the terminal device's operating system and application layer. Optionally, the processor system 930 may also include one or more of a voice subsystem 933, a multimedia subsystem 934, or an interface circuit 935. The voice subsystem 933 is used to process voice signals, the multimedia subsystem 934 is used to handle multimedia-related operations, such as video encoding / decoding, image processing, etc., and the interface circuit 935 is used to enable communication with other terminal device components, such as a display 940, an input device 950, a memory 960, etc. The above-mentioned components in the processor system 930 can communicate with each other via a bus or communication interface circuit.

[0417] In one example, the processor system 930 can be packaged as a single processor chip, such as a SoC chip or a SIP chip. In another example, the processor system 930 can be a system composed of multiple chips; for example, the baseband processor 931 can be packaged as a single chip, or packaged with part or all of the circuitry of the radio frequency processing system into a single chip.

[0418] In one example, memory 936 can be on-chip memory, i.e., located on the system-on-a-chip (SoC) 930. In another example, memory 960 can be off-chip memory, i.e., located outside the SoC 930.

[0419] In one example, the baseband processor 931 may include one or more processor cores 9311 and interface circuitry 9314. The one or more processor cores 9311 are used to process signals and execute one or more communication protocols. Optionally, the baseband processor 931 may also include a memory 9312 for storing at least a portion of the corresponding computer program instructions and / or data. In one example, the one or more processor cores 9311 execute the computer program instructions stored in the memory 9312 to implement the relevant operations in the above method embodiments. In this disclosure, the memory 9312 storing the corresponding computer program instructions and / or data may mean that the memory 9312 stores all the corresponding computer program instructions and / or data for the processor core 9311 to execute; or it may mean that the memory 9312 stores a portion of the corresponding computer program instructions and / or data, which includes the computer program instructions and / or data currently required to be executed by the processor core 9311. The memory 9312 can store different portions of computer program instructions and / or data multiple times for the processor core 9311 to execute in order to implement the relevant operations in the above method embodiments. Interface circuit 9314 serves as a communication interface for communication with other components, such as transmitting signals with RF processing system 920, communicating with other subsystems and related components of processor system 930 via bus, such as transmitting data control signals with application processor 932, and transmitting data or computer program instructions with memory 936 or memory 960. Optionally, to reduce the load on the processor core, baseband signal processing circuit 9313 can also be provided to perform at least some baseband signal processing, including one or more of signal demodulation, modulation, encoding, or decoding.

[0420] In one example, the communication device provided in this application may be a terminal device 900, including a communication module comprising a processor system 930 and a radio frequency system 920, or a baseband processor 931.

[0421] The processor, processor system, application processor, baseband processor, processor circuit, or processor core mentioned above can be collectively referred to as a processor. The processor may include one or more of the following: central processing unit (CPU), digital signal processor (DSP), microprocessor unit (MPU), microcontroller unit (MCU), graphics processing unit (GPU), field programmable gate array (FPGA), artificial intelligence processor (AI processor), or neural processing unit (NPU).

[0422] The aforementioned memory may include one or more of the following storage media: random access memory (RAM), static random access memory (SRAM), dynamic random access memory (DRAM), phase-change memory (PCM), resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), cache, register, read-only memory (ROM), flash memory, erasable programmable read-only memory (EPROM), hard disk, etc. In one example, computer program instructions for executing the above embodiments may be stored on non-volatile memory, such as at least a portion of the aforementioned memory 960 (e.g., one or more of ROM, flash memory, EPROM, or hard disk). When the terminal device is running, the corresponding computer program instructions may be partially or wholly loaded onto a memory with a faster transfer speed than the processor, such as at least a portion of the memory 936 and / or memory 9312 (e.g., one or more of RAM, SRAM, DRAM, PCM, RERAM, MRAM, FRAM, cache, or register), for the processor to execute in order to implement the steps in the above method embodiments.

[0423] In one example, the RF transceiver 922 and the RF front-end 921 can also be packaged in a single chip. In another example, the RF transceiver 922, the RF front-end 921, and the baseband processor 931 can also be packaged in a single chip.

[0424] The terms "system" and "network" in this application embodiment are used interchangeably. "At least one" refers to one or more, and "multiple" refers to two or more. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, or B alone, where A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. "At least one of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, "at least one of A, B, or C" includes A, B, C, AB, AC, BC, or ABC; "at least one of A, B, and C" can also be understood as including A, B, C, AB, AC, BC, or ABC. Furthermore, unless otherwise specified, the ordinal numbers such as "first" and "second" mentioned in this application embodiment are used to distinguish multiple objects and are not used to limit the order, sequence, priority, or importance of multiple objects.

[0425] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, optical storage, etc.) containing computer-usable program code.

[0426] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to this application. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in one or more blocks of the flowchart illustrations and / or one or more blocks of the block diagrams.

[0427] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means that implement the functions specified in one or more flowcharts and / or one or more block diagrams.

[0428] These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process, such that the instructions, which execute on the computer or other programmable apparatus, provide steps for implementing the functions specified in one or more flowcharts and / or one or more block diagrams.

[0429] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A communication method characterized by comprising: Comprising: determining a first intermediate key according to a session root key of a first session of a terminal device, the first intermediate key being used to derive a first session key, the first session key being used to protect user plane data of the first session between the terminal device and a first user plane anchor point; sending the first intermediate key or the first session key to the first user plane anchor point; determining a second intermediate key according to the session root key, the second intermediate key being used to derive a second session key, the second session key being used to protect user plane data of the first session between the terminal device and a second user plane anchor point; sending the second intermediate key or the second session key to the second user plane anchor point; wherein the user plane data of the first session between the terminal device and the first user plane anchor point and the user plane data of the first session between the terminal device and the second user plane anchor point are both routed by a split node of the first session.

2. The method of claim 1, wherein, Further comprising: sending a first identity to the terminal device, the first identity being an identity of the first intermediate key or an identity of the first session key, the first identity being used to route the user plane data of the first session to the first user plane anchor point; sending a second identity to the terminal device, the second identity being an identity of the second intermediate key or an identity of the second session key, the second identity being used to route the user plane data of the first session to the second user plane anchor point.

3. The method of claim 2, wherein, Further comprising: sending a split rule to the split node; wherein the split rule is used to indicate that the user plane data of the first session carrying the first identity from the terminal device is sent to the first user plane anchor point, and the user plane data of the first session carrying the second identity from the terminal device is sent to the second user plane anchor point; and / or, the split rule is used to indicate that the user plane data of the first session carrying the first identity from the first user plane anchor point is sent to the terminal device, and the user plane data of the first session carrying the second identity from the second user plane anchor point is sent to the terminal device.

4. The method of any one of claims 1 to 3, wherein, The determining a first intermediate key according to a session root key of a first session of a terminal device comprises: determining the first intermediate key according to the session root key, and a first value of a first counter and / or an identity of the first user plane anchor point, the first counter being used to record a number of times of deriving intermediate keys for the first session; The determining a second intermediate key according to the session root key comprises: determining the second intermediate key according to the session root key, and a second value of the first counter and / or an identity of the second user plane anchor point.

5. The method of any one of claims 1 to 3, wherein, The determining a first intermediate key according to a session root key of a first session of a terminal device comprises: determining the first intermediate key according to the session root key, a first counter and / or an identity of the first user plane anchor point, the first counter being used to record a number of times of deriving an intermediate key as a primary user plane anchor point for the first session, and the first user plane anchor point being the primary user plane anchor point; determining the second intermediate key according to the session root key comprises: determining the second intermediate key according to the session root key, a second counter and / or an identity of the second user plane anchor point, the second counter being used to record a number of times of deriving an intermediate key as a secondary user plane anchor point for the first session, and the second user plane anchor point being the secondary user plane anchor point.

6. The method of claim 4 or 5, wherein, The identity of the second user plane anchor point is a preset value.

7. The method of any one of claims 1 to 6, wherein, Before determining the first intermediate key according to the session root key of the first session of the terminal device, the method further comprises: determining that the terminal device uses a branch point (BP) mode to split traffic, and the split node is the BP.

8. The method of claim 7, wherein, The determining that the terminal device uses the BP mode to split traffic comprises: receiving indication information from the terminal device, the indication information being used to indicate that the terminal device uses the BP mode to split traffic.

9. The method of any one of claims 1 to 8, wherein, The first session key is derived according to the first intermediate key and a first security algorithm, and the first security algorithm comprises a first confidentiality protection algorithm and / or a first integrity protection algorithm. The second session key is derived according to the second intermediate key and a second security algorithm, and the second security algorithm comprises a second confidentiality protection algorithm and / or a second integrity protection algorithm.

10. The method of any one of claims 1 to 9, wherein, The determining the first intermediate key according to the session root key of the first session of the terminal device comprises: in a case where it is determined to split user plane data of the first session, determining the first intermediate key according to the session root key.

11. A communication method, comprising: The method comprises: determining a first intermediate key according to a session root key of a first session of a terminal device, and deriving a first session key according to the first intermediate key, the first session key being used to protect user plane data of the first session between the terminal device and a first user plane anchor point; determining a second intermediate key according to the session root key, and deriving a second session key according to the second intermediate key, the second session key being used to protect user plane data of the first session between the terminal device and a second user plane anchor point; wherein the user plane data of the first session between the terminal device and the first user plane anchor point and the user plane data of the first session between the terminal device and the second user plane anchor point are both routed by a split node of the first session.

12. The method of claim 11, wherein, The method further comprises: receiving a first identity, the first identity being an identity of the first intermediate key or an identity of the first session key; sending first data of the first session, the first data carrying the first identity, the first identity being used to route the first data to the first user plane anchor point, and the first data being securely protected according to the first session key; receiving a second identity, the second identity being an identity of the second intermediate key or an identity of the second session key; sending second data of the first session, the second data carrying the second identity, the second identity being used to route the second data to the second user plane anchor point, the second data being secured according to the second session key.

13. The method of claim 11, wherein, Further comprising: performing security processing on user plane data of the first session based on the first session key, and sending the security-processed user plane data of the first session, a packet header of the security-processed user plane data of the first session carrying information of the first user plane anchor point; performing security processing on user plane data of the first session based on the second session key, and sending the security-processed user plane data of the first session, a packet header of the security-processed user plane data of the first session carrying information of the second user plane anchor point.

14. The method of any one of claims 11 to 13, wherein, The determining the first intermediate key according to the session root key of the first session of the terminal device comprises: determining the first intermediate key according to the session root key, a first value of a first counter and / or an identity of the first user plane anchor point, the first counter being used to record a number of times of deriving intermediate keys for the first session; The determining the second intermediate key according to the session root key comprises: determining the second intermediate key according to the session root key, a second value of the first counter and / or an identity of the second user plane anchor point.

15. The method of any one of claims 11 to 13, wherein, The determining the first intermediate key according to the session root key of the first session of the terminal device comprises: determining the first intermediate key according to the session root key, a first counter and / or an identity of the first user plane anchor point, the first counter being used to record a number of times of deriving intermediate keys for a primary user plane anchor point of the first session, the first user plane anchor point being the primary user plane anchor point; The determining the second intermediate key according to the session root key comprises: determining the second intermediate key according to the session root key, a second counter and / or an identity of the second user plane anchor point, the second counter being used to record a number of times of deriving intermediate keys for a secondary user plane anchor point of the first session, the second user plane anchor point being the secondary user plane anchor point.

16. The method of claim 14 or 15, wherein, The identity of the second user plane anchor point is a preset value.

17. The method of any one of claims 11 to 16, wherein, Before the determining the first intermediate key according to the session root key of the first session of the terminal device, further comprising: determining that the terminal device uses a branch point (BP) to split traffic, the split node being the BP.

18. The method of any one of claims 11 to 17, wherein, Further comprising: sending indication information, the indication information being used to indicate that the terminal device uses the BP to split traffic, the split node being the BP.

19. A communications device, characterized by A module for performing the method of any one of claims 1 to 10, or the method of any one of claims 11 to 18.

20. A communications device, characterized by A processor and an interface circuit, the processor being used to communicate with other devices through the interface circuit to implement the method of any one of claims 1 to 10, or to implement the method of any one of claims 11 to 18.

21. A computer program product, characterised in that, The computer program product comprises computer programs or instructions, which, when executed, implement the method of any one of claims 1-10, or implement the method of any one of claims 11-18.

22. A computer-readable storage medium, characterized in that, The storage medium stores computer programs or instructions, which, when executed, implement the method of any one of claims 1-10, or implement the method of any one of claims 11-18.

23. A communication system, characterized by Comprise: a session management network element, configured to implement the method of any one of claims 1-10 a first user plane anchor, configured to receive a first intermediate key or a first session key from the session management network element; a second user plane anchor, configured to receive a second intermediate key or a second session key from the session management network element.

24. The system of claim 23, wherein, Further comprise: the first user plane anchor is further configured to, in the case of receiving the first intermediate key, derive the first session key according to the first intermediate key and a first security algorithm; the second user plane anchor is further configured to, in the case of receiving the second intermediate key, derive the second session key according to the second intermediate key and a second security algorithm.

25. The system of claim 23 or 24, wherein, Further comprise: the first user plane anchor is further configured to send or receive user plane data of a first session between a terminal device and the first user plane anchor according to the first session key; the second user plane anchor is further configured to send or receive user plane data of the first session between the terminal device and the second user plane anchor according to the second session key.

26. The system of any one of claims 23 to 25, wherein, The system further comprises a split node, configured to route user plane data of a first session between a terminal device and the first user plane anchor and user plane data of the first session between the terminal device and the second user plane anchor.

27. The system of any one of claims 23 to 26, wherein, The system further comprises a terminal device, configured to implement the method of any one of claims 11-18.

Images