Information verification method and related apparatus

Abstract

The present application provides an information verification method and a related apparatus. In the information verification method provided in the present application, when a terminal device or a network device enters a mode having security protection, the terminal device or the network device performs integrity protection verification on a system message received by the terminal device. The method can support the absence of digital signature information in the system message, making it convenient for the network device to conserve downlink resources when broadcasting the system message, improving the communication quality of the terminal device, and improving the service experience of users.

Description

Information verification method and related apparatus

[0001] The present application claims priority to the Chinese patent application No. 202411257267.9, filed on September 6, 2024, and entitled "Information verification method and related apparatus", the content of which is incorporated herein by reference in its entirety. TECHNICAL FIELD

[0002] Embodiments of the present application relate to the field of communication, in particular to an information verification method and related apparatus. BACKGROUND

[0003] In a mobile communication system, a network device periodically broadcasts system messages, thereby providing necessary network access parameters and public information for user equipment (UE). The system messages are broadcast in plaintext, lacking security protection.

[0004] A security verification method is that a network device uses a private key to digitally sign a system message, and broadcasts the system message with the digital signature, and a UE decrypts the received system message according to a public key of the network device, and when the decrypted digital signature is consistent with the digest of the system message, the security verification passes, and the UE can further use the information provided by the system message.

[0005] However, the security verification by the above method can cause the communication quality of the UE to decline. SUMMARY

[0006] Embodiments of the present application provide an information verification method and related apparatus to improve the communication quality of a terminal device accessing a network.

[0007] In a first aspect, embodiments of the present application provide a multi-carrier communication method, applied to a terminal side, such as a terminal device or a communication module in a terminal device, or a circuit or chip responsible for communication functions in a terminal device. Taking the case that the method is applied to a terminal device, the method comprises: receiving at least one first system message; and in the case of entering a mode with security protection, verifying the at least one first system message.

[0008] In the case of entering a mode with security protection, the at least one first system message is verified, so that embodiments of the present application can support not carrying digital signature information in the first system message, which is beneficial to saving the bandwidth resources of the network device broadcast, thereby improving the communication quality of the terminal device.

[0009] In some implementations, the method further comprises:

[0010] Recording first information, the first information being used to indicate the at least one first system message.

[0011] The terminal device can store the information indicating the at least one first system message locally by recording the first information, for subsequent verification.

[0012] In some implementations, the security-protected mode includes entering the security mode from an RRC connected state.

[0013] In the security-protected mode, the verification of the at least one first system message includes: receiving second information indicating at least one second system message in the security mode; and verifying the at least one first system message according to the first information and the second information.

[0014] In the security-protected mode, the terminal device in the RRC connected state can safely receive the second information indicating the at least one second system message, thereby facilitating the verification of the at least one first system message according to the first information and the second information.

[0015] In some implementations, the first information includes the at least one first system message, and the second information includes the at least one second system message or digital signature information of the at least one second system message; or the first information includes verification information of the at least one first system message, and the second information includes verification information of the at least one second system message or digital signature information of the verification information of the at least one second system message.

[0016] In the case where the type of information included in the second information is consistent with the type of information included in the first information, the efficiency of the terminal device in verifying information is improved, and in the case where the type of information included in the second information is a digital signature of the type of information included in the first information, the security of the terminal device in verifying information is improved.

[0017] In some implementations, the security-protected mode includes entering the security mode from an RRC connected state.

[0018] In the security-protected mode, the verification of the at least one first system message includes: sending third information indicating the at least one first system message in the security mode.

[0019] In the security-protected mode, the terminal device in the RRC connected state can safely send, to the network device, the third information indicating the at least one first system message.

[0020] In some implementations, the first information includes the at least one first system message, and the third information includes the at least one first system message or digital signature information of the at least one first system message; or the first information includes check information of the at least one first system message, and the third information includes the check information of the at least one first system message or digital signature information of the check information of the at least one first system message.

[0021] In some implementations, the security-protected mode includes a process of implementing random access in the RRC inactive state.

[0022] In the case of entering the security-protected mode, checking the at least one first system message includes: in the process of implementing random access in the RRC inactive state, receiving message 4, the message 4 being used to indicate the at least one second system message; and checking the at least one first system message according to the first information and the message 4.

[0023] In the process of implementing random access in the RRC inactive state, the at least one second system message is indicated through the message 4, the at least one first system message can be checked in advance in the case of security protection and without starting the security mode, and the efficiency of information checking can be improved, which is beneficial to improving user experience.

[0024] In some implementations, the first information includes the at least one first system message, and the message 4 includes the at least one second system message or digital signature information of the at least one second system message; or the first information includes check information of the at least one first system message, and the message 4 includes check information of the at least one second system message or digital signature information of the check information of the at least one second system message.

[0025] In the case that the type of information included in the message 4 is consistent with the type of information included in the first information, the efficiency of information checking of the terminal device can be improved, and in the case that the type of information included in the message 4 is the digital signature of the type of information included in the first information, the security of information checking of the terminal device can be improved.

[0026] In some implementations, the security-protected mode includes a process of implementing random access in the RRC inactive state.

[0027] In the case of entering the security-protected mode, checking the at least one first system message includes: in the process of implementing random access in the RRC inactive state, sending message 5, the message 5 being used to indicate the at least one first system message.

[0028] In the process of implementing random access in the RRC inactive state, information used to indicate the at least one first system message can be safely sent to the network device through the message 5.

[0029] In some implementations, the first information comprises at least one first system message, the message 5 comprises the at least one first system message or digital signature information of the at least one first system message; or the first information comprises check information of the at least one first system message, the message 5 comprises the check information of the at least one first system message or digital signature information of the check information of the at least one first system message.

[0030] In some implementations, the method further comprises:

[0031] receiving fourth information, the fourth information being used to indicate recording of the at least one first system message.

[0032] According to the fourth information, the terminal device can record the at least one first system message from the received system messages, which helps to avoid recording the remaining system messages, thereby saving storage resources.

[0033] In some implementations, the fourth information is carried in any one of the following information: a system message, a non-access stratum (NAS) message or an RRC release message.

[0034] By carrying the fourth information in the above information, it is possible to support avoiding sending the fourth information independently, which is beneficial to saving downlink overhead.

[0035] In a second aspect, an embodiment of the present application provides an information check method, applied to a network side, for example, a network device or a component (such as a chip, a chip system, etc.) in the network device, or can also be a logic module or software capable of realizing all or part of the network device functions, taking the case that the method is applied to the network device as an example, the method comprises: obtaining at least one second system message; and in the case of entering a mode with security protection, checking the at least one second system message.

[0036] In some implementations, the method further comprises:

[0037] recording fifth information, the fifth information being used to indicate the at least one second system message.

[0038] By recording the fifth information, the network device can locally store the information indicating the at least one second system message for subsequent check.

[0039] In some implementations, the mode with security protection comprises entering a security mode from an RRC connected state.

[0040] In the case of entering the mode with security protection, checking the at least one second system message comprises: in the case of being in the security mode, sending second information, the second information being used to indicate the at least one second system message.

[0041] In some implementations, the fifth information includes at least one second system message, and the second information includes at least one second system message or digital signature information of at least one second system message; or, the fifth information includes verification information of at least one fifth system message, and the second information includes verification information of at least one second system message or digital signature information of verification information of at least one second system message.

[0042] In some implementations, there are security protection modes, including entering a secure mode from the RRC connection state;

[0043] Specifically, when entering a security-protected mode, verifying at least one second system message includes: receiving third information in the security mode, the third information being used to indicate at least one first system message; and verifying at least one second system message based on the third information and the fifth information.

[0044] In some implementations, the fifth information includes at least one second system message, and the third information includes at least one first system message or digital signature information of at least one first system message; or, the fifth information includes verification information of at least one second system message, and the third information includes verification information of at least one first system message or digital signature information of verification information of at least one first system message.

[0045] In some implementations, security protection modes include random access procedures implemented by RRC inactive states.

[0046] Specifically, when entering a mode with security protection, at least one second system message is verified, including: during the random access process implemented by the RRC inactive state, message 4 is sent, which is used to indicate at least one second system message.

[0047] In some implementations, the fifth information includes at least one second system message, and message 4 includes at least one second system message or digital signature information of at least one second system message; or, the fifth information includes verification information of at least one second system message, and message 4 includes verification information of at least one second system message or digital signature information of verification information of at least one second system message.

[0048] In some implementations, security protection modes include the process of random access being implemented in an inactive RRC state;

[0049] Specifically, when entering a mode with security protection, at least one first system message is verified, including: during the random access process implemented by the RRC inactive state, message 5 is received, which is used to indicate at least one first system message.

[0050] In some implementations, the fifth information includes at least one second system message, the message 5 includes at least one first system message or digital signature information of the at least one first system message; or, the fifth information includes check information of the at least one second system message, the message 5 includes check information of the at least one first system message or digital signature information of the check information of the at least one first system message.

[0051] In some implementations, the method further includes:

[0052] sending sixth information, the sixth information being used to indicate recording of the at least one first system message.

[0053] In some implementations, the sixth information is carried in a system message or an RRC release message.

[0054] In a third aspect, an embodiment of the present application provides an information verification apparatus, which includes a module or unit for implementing the method in the first aspect and any possible implementation manner of the first aspect, or includes a module for implementing the method in the second aspect and any possible implementation manner of the second aspect. Each module or unit can implement the corresponding function by executing a computer program.

[0055] Exemplarily, the information verification apparatus in the third aspect is a terminal device, or a component configured in the terminal device, such as a chip, a chip system, a processor, etc., or the information verification apparatus in the third aspect is a network device, or a component configured in the network device, such as a chip, a chip system, a processor, etc.

[0056] In a fourth aspect, an embodiment of the present application provides an information verification apparatus, which includes a processor, the processor being used to execute the information verification method in the first aspect and any possible implementation manner of the first aspect, or being used to execute the communication method in the second aspect and any possible implementation manner of the second aspect.

[0057] Optionally, the information verification apparatus includes a memory, which is used to store instructions and data. The memory is coupled with the processor, and the processor can implement the method described in each aspect above when executing the instructions stored in the memory.

[0058] Optionally, the information verification apparatus includes a communication interface, the communication interface being used for the apparatus to communicate with other communication apparatuses. Exemplarily, the communication interface can be a transceiver, a circuit, a bus, a module, a pin or other types of communication interfaces.

[0059] Exemplarily, the information verification apparatus provided in the fourth aspect is a chip or a chip system, and can also correspond to a terminal device or a network device.

[0060] In a fifth aspect, an embodiment of the present application provides a computer readable storage medium, including a computer program, which, when executed on a computer, causes the computer to implement the method in the first or second aspect and any possible implementation manner of the first or second aspect.

[0061] In a sixth aspect, an embodiment of the present application provides a computer program product, which includes a computer program (also referred to as code or instructions), which, when executed on a computer, causes the computer to execute the method in the first or second aspect and any possible implementation manner of the first or second aspect.

[0062] In a seventh aspect, an embodiment of the present application provides an information verification system, including the terminal device and the network device, the terminal device being configured to implement the method in the first aspect and any possible implementation manner of the first aspect, and the network device being configured to implement the method in the second aspect and any possible implementation manner of the second aspect.

[0063] The third aspect to the seventh aspect of the present application correspond to the technical solutions of the first aspect or the second aspect of the present application, and the beneficial effects achieved by each aspect and the corresponding possible implementation manners are similar, which will not be described herein again. BRIEF DESCRIPTION OF DRAWINGS

[0064] FIG. 1 is a schematic diagram of an architecture of a communication system to which an embodiment of the present application is applied;

[0065] FIG. 2 is a schematic diagram of an access network device to which an embodiment of the present application is applied;

[0066] FIG. 3 is a schematic diagram of a certificate-based signature mechanism;

[0067] FIG. 4 is a schematic diagram of a flow of an information verification method provided by an embodiment of the present application;

[0068] FIG. 5 is a schematic diagram of a flow of an information verification method provided by another embodiment of the present application;

[0069] FIG. 6 is a schematic diagram of a flow of an information verification method provided by another embodiment of the present application;

[0070] FIG. 7 is a schematic diagram of a flow of an information verification method provided by yet another embodiment of the present application;

[0071] FIG. 8 is a schematic diagram of a flow of an information verification method provided by yet another embodiment of the present application;

[0072] FIG. 9 is a schematic diagram of a flow of an information verification method provided by an embodiment of the present application;

[0073] FIG. 10 is a schematic diagram of a flow of an information verification method provided by an embodiment of the present application;

[0074] FIG. 11 is a flow diagram of an information verification method according to another embodiment of the present application;

[0075] FIG. 12 is a flow diagram of an information verification method according to another embodiment of the present application;

[0076] FIG. 13 is a structural diagram of an information verification apparatus according to an embodiment of the present application;

[0077] FIG. 14 is a structural diagram of an information verification apparatus according to another embodiment of the present application. DETAILED DESCRIPTION

[0078] The following detailed description is presented in terms of examples that represent the best mode for practicing the application. Descriptions of the examples in terms of an implementation described below do not represent all implementations consistent with the present application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of the present application as detailed in the appended claims.

[0079] It should be understood that, in the present application, "at least one" means one or more, and "multiple" means two or more. The "and / or" describes the association relationship of the associated objects, which means that there can be three relationships, for example, A and / or B, which means that A exists alone, A and B exist together, B exists alone, and A, B can be singular or plural. The character " / " generally represents an "or" relationship between the associated objects before and after it, but does not rule out the case that the associated objects before and after it represent an "and" relationship, and the meaning represented can be understood in combination with the context. "At least one of the following" or similar expressions means any combination of these items, including any combination of single item or multiple items. For example, at least one of a, b, or c, can mean a, b, c; a and b; a and c; b and c; or a and b and c. Where a, b, c can be single or multiple.

[0080] In the present application, the use of prefixes such as "first", "second", etc. is only for the convenience of distinguishing different things belonging to the same name category for description, and does not constrain the order, size or quantity of the things. For example, "first parameter" and "second parameter" are only different parameters, and there is no time sequence or size relationship between them.

[0081] The present application will present various aspects, embodiments or features around a system that can include multiple devices, components, modules, etc. It should be understood and appreciated that each system can include additional devices, components, modules, etc., and / or can not include all of the devices, components, modules, etc. discussed in conjunction with the figures. Furthermore, combinations of these schemes can also be used.

[0082] In addition, in the embodiments of the present application, the words "exemplary", "for example", and the like are used solely to indicate examples, instances, or illustrations, and not preference or advantageousness over another embodiment or design. In fact, the word "exemplary" is used to present concepts in a concrete manner. In the embodiments of the present application, "of", "corresponding" and "corresponding" are sometimes mixed. It should be pointed out that when the difference is not emphasized, the meanings expressed are consistent.

[0083] FIG. 1 is a schematic diagram of an architecture of a communication system to which embodiments of the present application are applied. FIG. 1 shows a schematic diagram of a possible, non-limiting system architecture. As shown in FIG. 1, the communication system includes a radio access network (RAN) 100 and a core network (CN) 200. The RAN 100 includes at least one RAN node (such as 110a and 110b in FIG. 1, collectively referred to as 110) and at least one terminal device (such as 120a-120j in FIG. 1, collectively referred to as 120). Other RAN nodes, such as wireless relay devices and / or wireless backhaul devices (not shown in FIG. 1), etc., can also be included in the RAN 100. The terminal devices 120 are connected to the RAN nodes 110 in a wireless manner. The RAN nodes 110 are connected to the core network 200 in a wireless or wired manner. The core network devices in the core network 200 and the RAN nodes 110 in the RAN 100 can be different physical devices, respectively, or can be the same physical device integrated with the logical functions of the core network and the logical functions of the radio access network.

[0084] The RAN 100 can be a 3rd generation partnership project (3GPP) related cellular system, such as a 4G, 5G mobile communication system, or a future-oriented evolution system (such as a 6G mobile communication system). The RAN 100 can also be an open radio access network (O-RAN or ORAN), a cloud radio access network (CRAN), or a virtualized RAN (vRAN). The RAN 100 can also be a communication system that combines two or more of the above systems.

[0085] The RAN node 110, which can also be referred to as an access network device, a RAN entity, or an access node, etc., is a part of the communication system to help terminal devices to access the wireless communication. The RAN nodes 110 in the communication system 1000 can be of the same type or of different types. In some scenarios, the roles of the RAN node 110 and the terminal device 120 are opposite, for example, the network element 120i in Figure 1 can be a helicopter or a drone, which can be configured as a mobile base station, for those terminal devices 120j accessing the RAN 100 through the network element 120i, the network element 120i is a base station; but for the base station 110a, the network element 120i is a terminal device. The RAN node 110 and the terminal device 120 are sometimes referred to as communication apparatuses, for example, the network elements 110a and 110b in Figure 1 can be understood as communication apparatuses with base station functions, and the network elements 120a-120j can be understood as communication apparatuses with terminal functions.

[0086] In a possible scenario, the RAN node can be a base station, an evolved Node B (eNodeB), an access point (AP), a transmission reception point (TRP), a next generation Node B (gNB), or a base station in a future mobile communication system, etc. The RAN node can be a macro base station (such as 110a in Figure 1), a micro base station or an indoor station (such as 110b in Figure 1), a relay node or a donor node, or a wireless controller in a CRAN scenario. Optionally, the RAN node can also be a server, a wearable device, a vehicle or a vehicle-mounted device, etc. For example, the access network device in the vehicle to everything (V2X) technology can be a road side unit (RSU).

[0087] In another possible scenario, multiple RAN nodes cooperate to assist a terminal to implement wireless access, and different RAN nodes respectively implement part of functions of a base station. For example, a RAN node can be a central unit (CU), a distributed unit (DU), a CU control plane (CU-CP), a CU user plane (CU-UP), or a radio unit (RU), etc. The CU and the DU can be separately arranged, or can also be included in the same network element, for example, in a baseband unit (BBU). The RU can be included in a radio frequency device or a radio frequency unit, for example, included in a remote radio unit (RRU), an active antenna processing unit (AAU), or a remote radio head (RRH).

[0088] In different systems, the CU (or CU-CP and CU-UP), DU or RU can also have different names, but those skilled in the art can understand their meanings. For example, in an ORAN system, the CU can also be referred to as an open-CU (O-CU), the DU can also be referred to as an open-DU (O-DU), the CU-CP can also be referred to as an open-CU-CP (O-CU-CP), the CU-UP can also be referred to as an open-CU-UP (O-CU-UP), and the RU can also be referred to as an open-RU (O-RU). For the convenience of description, the CU, CU-CP, CU-UP, DU and RU are taken as examples for description in this application. Any one of the CU (or CU-CP, CU-UP), DU and RU in this application can be implemented by a software module, a hardware module, or a combination of a software module and a hardware module.

[0089] The terminal device can also be referred to as a terminal, a user equipment (UE), a mobile station, a mobile terminal, etc. The terminal device can be widely applied to various scenarios, such as device-to-device (D2D), vehicle to everything (V2X) communication, machine-type communication (MTC), internet of things (IOT), virtual reality, augmented reality, industrial control, automatic driving, remote medical treatment, smart power grid, smart furniture, smart office, smart wear, smart transportation, smart city, etc. The terminal can be a mobile phone, a tablet computer, a computer with wireless transceiver function, a wearable device, a vehicle, a drone, a helicopter, an airplane, a ship, a robot, a mechanical arm, a smart home device, etc.

[0090] The base station and the terminal can be fixed in position or movable. The base station and the terminal can be deployed on land, including indoors or outdoors, handheld or vehicle-mounted; can also be deployed on water surface; can also be deployed on an airplane, a balloon and a man-made satellite. Embodiments of the present application do not limit the application scenarios of the base station and the terminal.

[0091] The roles of the base station and the terminal can be relative, for example, the helicopter or the drone 120i in FIG. 1 can be configured as a mobile base station, and for those terminals 120j accessing the wireless access network 100 through 120i, the terminal 120i is a base station; but for the base station 110a, 120i is a terminal, that is, 110a and 120i communicate with each other through a wireless air interface protocol. Of course, 110a and 120i can also communicate with each other through a base station-to-base station interface protocol, in which case, relative to 110a, 120i is also a base station. Therefore, the base station and the terminal can be collectively referred to as a communication apparatus, 110a and 110b in FIG. 1 can be referred to as a communication apparatus with base station function, and 120a-120j in FIG. 1 can be referred to as a communication apparatus with terminal function.

[0092] The base station and the terminal, the base station and the base station, and the terminal and the terminal can communicate through a licensed frequency spectrum, can also communicate through an unlicensed frequency spectrum, and can also communicate through both the licensed frequency spectrum and the unlicensed frequency spectrum; can communicate through a frequency spectrum below 6 gigahertz (GHz), can also communicate through a frequency spectrum above 6 GHz, and can also communicate through both the frequency spectrum below 6 GHz and the frequency spectrum above 6 GHz. Embodiments of the present application do not limit the frequency spectrum resources used for wireless communication.

[0093] In the embodiments of the present application, the functions of the base station can also be performed by a module (such as a chip) in the base station, or by a control subsystem including the functions of the base station. The control subsystem including the functions of the base station herein can be a control center in the above-mentioned application scenarios such as smart grid, industrial control, intelligent transportation, and smart city. The functions of the terminal can also be performed by a module (such as a chip or a modem) in the terminal, or by a device including the functions of the terminal.

[0094] FIG. 2 is a schematic diagram of an access network device to which the embodiments of the present application are applied. As shown in FIG. 2, the access network device includes one or more CUs, one or more DUs, and one or more RUs. For the sake of clarity, only one CU, one DU, and one RU are shown in FIG. 2. The CU is configured to be connected to a core network and one or more DUs. Optionally, the CU can have part of the functions of the core network. The CU can include a CU-CP and a CU-UP.

[0095] The CU and the DU can be configured according to the protocol layer functions of the wireless network they implement. For example, the CU is configured to implement the functions of the packet data convergence protocol (PDCP) layer and the protocol layers above the PDCP layer (such as the radio resource control (RRC) layer and / or the service data adaptation protocol (SDAP) layer, etc.). The DU is configured to implement the functions of the protocol layers below the PDCP layer (such as the radio link control (RLC) layer, the medium access control (MAC) layer, and / or the physical (PHY) layer, etc.). For another example, the CU is configured to implement the functions of the protocol layers above the PDCP layer (such as the RRC layer and / or the SDAP layer), and the DU is configured to implement the functions of the protocol layers at and below the PDCP layer (such as the RLC layer, the MAC layer, and / or the PHY layer, etc.).

[0096] When the CU includes a CU-CP and a CU-UP, the CU-CP is configured to implement the control plane functions of the CU, and the CU-UP is configured to implement the user plane functions of the CU. For example, when the CU is configured to implement the functions of the PDCP layer, the RRC layer, and the SDAP layer, the CU-CP is configured to implement the RRC layer functions and the control plane functions of the PDCP layer, and the CU-UP is configured to implement the SDAP layer functions and the user plane functions of the PDCP layer.

[0097] The CU-CP can interact with a network element in the core network for implementing control plane functions. The network element in the core network for implementing control plane functions can be an access and mobility function network element, for example, an access and mobility management function (AMF) network element in a 5G system. The AMF network element is used to be responsible for mobility management in a mobile network, such as location updating of a terminal device, registration network of the terminal device, handover of the terminal device, and the like.

[0098] The CU-UP can interact with a network element in the core network for implementing user plane functions. The network element in the core network for implementing user plane functions, for example, a user plane function (UPF) network element in a 5G system, is used to be responsible for forwarding and receiving data in a terminal device.

[0099] The above configurations of the CU and the DU are only examples, and the functions of the CU and the DU can be configured as needed. For example, the CU or the DU can be configured to have more protocol layer functions, or the CU or the DU can be configured to have partial processing functions of the protocol layers. For example, partial functions of the RLC layer and functions of protocol layers above the RLC layer are arranged in the CU, and the remaining functions of the RLC layer and functions of protocol layers below the RLC layer are arranged in the DU. For another example, the functions of the CU or the DU can be divided according to service types or other system requirements. For example, functions that require to meet a shorter delay requirement in processing time are arranged in the DU, and functions that do not require to meet the delay requirement are arranged in the CU.

[0100] The DU and the RU can cooperate to jointly implement functions of the PHY layer. One DU can be connected with one or more RUs. The functions of the DU and the RU can be configured in multiple ways according to design. For example, the DU is configured to implement baseband functions, and the RU is configured to implement intermediate radio frequency functions. For another example, the DU is configured to implement high-layer functions in the PHY layer, and the RU is configured to implement low-layer functions in the PHY layer or to implement the low-layer functions and radio frequency functions. The high-layer functions in the PHY layer can include a part of functions of the PHY layer that are closer to the MAC layer, and the low-layer functions in the PHY layer can include another part of functions of the PHY layer that are closer to the intermediate radio frequency side.

[0101] In order to better understand the embodiments of the present application, the technologies and terms involved in the present application are briefly explained as follows.

[0102] I. Private key and public key

[0103] In asymmetric encryption (also known as public-key encryption), a private key and a public key can be used for encryption. The private key and the public key can together form a key pair, which is used to achieve secure data transmission and identity verification.

[0104] wherein the private key is a key used for decrypting data or creating a digital signature in an asymmetric encryption algorithm. The private key is confidential and is usually known only to the holder of the private key, and needs to be properly secured to prevent unauthorized access. The public key is a key paired with the private key, used for encrypting data or verifying a digital signature. The public key is public and can be safely distributed to any entity that needs to communicate with it.

[0105] II. Digital Signature

[0106] A digital signature is a technology based on the principles of cryptography, used to verify the integrity and authenticity of digital documents or data information. When applying digital signature technology, the sender can use his own private key to encrypt the data or the hash value of the data, obtain the digital signature, and send the signature together with the original data to the receiver. After receiving the data, the receiver can use the sender's public key to decrypt the digital signature and obtain the hash value, and then perform a hash operation on the original text to obtain another hash value. Comparing the two hash values, if they are the same, it means that the data has not been tampered with during transmission, thereby verifying the integrity and authenticity of the data.

[0107] III. System Message

[0108] In a wireless communication network, system messages are key information broadcast by network devices to all terminal devices. These messages contain the basic configuration, operating parameters and other necessary information of the network, which are needed by terminal devices to correctly access and operate the network. Exemplarily, in the 5G new radio (NR) system, system messages are subdivided into three categories: minimum system information (MSI), remaining minimum system information (RMSI) and other system information (OSI). Among them, MSI is the most basic set of information required by terminal devices to access the network, mainly including master information block (MIB) and system information block (SIB) 1. RMSI mainly includes SIB1, RMSI is used to provide relatively static system-level parameters to maintain network connection and assist in network switching and reselection operations, etc. OSI covers more system information from SIB2 to SIB9, which is responsible for transmitting more detailed parameters related to network functions and services.

[0109] In the communication system shown in FIG. 1, before accessing the network, the terminal device needs to receive the system message from the network device to obtain the initial access information. Among them, the network device broadcasts the system message in plaintext on the downlink periodically, that is, the system message has no security protection, so the important information in the system message may face the problem of tampering or forgery. For example, SIB19 in the system message includes auxiliary information for non-terrestrial network (NTN) access, and an attacker can tamper with the ephemeris information, service time and other information in SIB19, causing the idle state terminal device to be unable to access the NTN network, and the transmission quality of the terminal device in the connected state in the NTN network to be reduced.

[0110] FIG. 3 is a schematic diagram of a certificate-based signature mechanism. As shown in FIG. 3, after verification at the certificate authority (CA), the network device can obtain a digital certificate, which includes the public key of the network device. In order to protect the security of the system message, the network device performs an abstract operation on the system message to obtain a hash value of the system message, and uses its own private key to encrypt the hash value of the system message to obtain the digital signature information of the hash value of the system message.

[0111] When broadcasting the system message, the network device broadcasts the digital certificate of the network device and the digital signature information of the hash value of the system message together. After receiving the system message and the digital signature information of the hash value of the system message, the terminal device decrypts the digital signature based on the public key of the network device to obtain a hash value. The terminal device performs an abstract operation on the received system message to obtain another hash value, and the terminal device compares the hash value obtained by decryption with the hash value obtained by abstract operation. When the above two hash values are the same, it means that the system message has not been tampered with in the transmission process, and the security verification is passed. After the security verification is passed, the terminal device can obtain the initial access information according to the system message to realize subsequent access.

[0112] However, in the above security verification method, the network device sends the digital signature information together with the system message. It should be understood that the network device needs to occupy additional bandwidth resources when broadcasting the digital signature information. Considering that the downlink resources of the network device are limited, synchronously broadcasting the digital signature information will cause the downlink coverage of the network device to be reduced, making it difficult for terminal devices at the edge of the coverage range to receive the system message, resulting in a decline in the communication quality of the terminal device.

[0113] To solve the above technical problems, the embodiments of the present application provide an information verification method and related device to improve the communication quality of the terminal device.

[0114] Embodiments of the present application can enable a terminal device or a network device to perform integrity check on system messages received by the terminal device in a mode with security protection, save downlink resources when the network device broadcasts system messages, improve communication quality of the terminal device, and improve service experience of users.

[0115] In the following embodiments, interactions between a terminal device and a network device are taken as examples for illustration. It should be understood that the terminal device described above can be replaced by a component (such as a chip, a chip system, a processor, etc.) configured in the terminal device, or a logic module or software capable of implementing all or part of the functions of the terminal device; the network device described above can also be replaced by a component (such as a chip, a chip system, a processor, etc.) configured in the network device, or a logic module or software capable of implementing all or part of the functions of the network device.

[0116] FIG. 4 is a flowchart of an information checking method according to an embodiment of the present application. As shown in FIG. 4, the information checking method can include S401-S403.

[0117] S401, the network device sends at least one second system message to the terminal device.

[0118] As an example, the network device can send system messages in a broadcast manner, wherein the system messages broadcast by the network device include at least one second system message, for example, MIB, SIB1, etc. In some implementations, the network device can also send system messages in a side channel manner, and the present application does not limit the manner of sending system messages by the network device.

[0119] It can be understood that the network device sends at least one second system message to the terminal device, which means that the network device is pre-configured with at least one second system message internally, and the network device can obtain the at least one second system message from the pre-configured system messages internally. In the case where the network device broadcasts multiple second system messages, the multiple second system messages can be understood as a set of second system messages.

[0120] In some implementations, the network device can record information for indicating the at least one second system message at the same time of sending the at least one second system message, for subsequent use. In the present application, the meaning of "recording" is that the device stores or caches the relevant information locally.

[0121] S402, the terminal device receives at least one first system message.

[0122] In this step, the terminal device receives a system message broadcast by the network device. Considering that the system message may be tampered or forged during transmission, the terminal device can obtain at least one first system message. In the case where the terminal device obtains multiple first system messages, the multiple first system messages can be understood as a first system message set.

[0123] In some implementations, the terminal device can record information indicating the above at least one first system message for subsequent use.

[0124] S403, in the case of entering the mode with security protection, the terminal device verifies the at least one first system message, or the network device verifies the at least one second system message.

[0125] It should be noted that in the system architecture shown in FIG. 1, the RRC state can be used to describe the connection state between the terminal device and the network device. Among them, the RRC idle state (RRC_IDLE) is a dormant state of the terminal device. In the case where the terminal device and the network device are in the RRC idle state, the terminal device is located in the coverage of the network device, at this time the terminal device does not maintain RRC connection with the network device, but the terminal device continuously detects the paging message of the core network in order to receive downlink data or signaling.

[0126] The RRC connected state (RRC_CONNECTED) is the state after the terminal device and the network device establish RRC connection. In the case where the terminal device and the network device are in the RRC connected state, the terminal device can perform data transmission and receive network service.

[0127] The RRC inactive state (RRC_INACTIVE) is a state between the RRC idle state and the RRC connected state. In the case where the terminal device and the network device are in the RRC inactive state, the terminal device retains part of the connection information with the network device, and at the same time retains the connection between the core network.

[0128] In this step, when the initial connection state between the terminal device and the network device is different, the terminal device enters the mode with security protection in the process of accessing the network at different times.

[0129] In one example, in the case that the initial connection state between the terminal device and the network device is the RRC idle state, the terminal device needs to establish a connection with the network device through random access, and enter the RRC connected state from the RRC idle state. In the case that the terminal device and the network device are in the RRC connected state, the network device can send a security mode start instruction to the terminal device, and in the case that the security mode is started, the communication between the terminal device and the network device will use a security key to perform operations including data encryption and air interface integrity protection, and the security processing between the terminal device and the network device is performed at the PDCP layer. Therefore, after the terminal device and the network device enter the RRC connected state from the RRC idle state and the security mode is started, it is equivalent to the terminal device and the network device entering a mode in which security protection exists, that is, the mode in which security protection exists includes entering the security mode from the RRC connected state.

[0130] In another example, in the case that the initial connection state between the terminal device and the network device is the RRC inactive state, the terminal device establishes a connection with the network device through random access and enters the RRC connected state from the RRC idle state. According to the foregoing introduction of the RRC inactive state, it can be known that the terminal device in the RRC inactive state retains a connection with the core network, and its context information (such as a security key, an identity, etc.) is retained in the network device and the core network. When the terminal device in the RRC inactive state initiates random access, the retained security context can be activated to improve the security of subsequent communication. Therefore, after the terminal device in the RRC inactive state initiates random access, it is equivalent to the terminal device and the network device entering a mode in which security protection exists, that is, the mode in which security protection exists includes the process of implementing random access from the RRC inactive state.

[0131] It can be understood that the terminal device acquires initial access information through the received at least one first system message, so as to correctly access and operate the network. In this step, whether the at least one first system message is verified by the terminal device or the at least one second system message is verified by the network device, the essence is to verify whether the at least one first system message and the at least one second system message are the same system message, so as to reduce the possibility of problems such as tampering or forgery of the system message broadcast by the network device.

[0132] Exemplarily, when the terminal device verifies the at least one first system message, the terminal device can send information for indicating the at least one first system message to the network device, and the network device verifies whether the at least one first system message received by the terminal device and the at least one second system message sent by the network device are the same according to the recorded information for indicating the at least one second system message and the information for indicating the at least one first system message.

[0133] Alternatively, the network device sends information indicating the at least one second system message to the terminal device, and the terminal device checks whether the at least one first system message and the at least one second system message are the same according to the recorded information indicating the at least one first system message and the information indicating the at least one second system message.

[0134] Similarly, when checking the at least one second system message, the network device can send information indicating the at least one second system message to the terminal device, and the terminal device checks whether the at least one first system message received by the terminal device and the at least one second system message sent by the network device are the same according to the recorded information indicating the at least one first system message and the information indicating the at least one second system message. Alternatively, the terminal device sends information indicating the at least one first system message to the network device, and the network device checks whether the at least one first system message and the at least one second system message are the same according to the recorded information indicating the at least one second system message and the information indicating the at least one first system message.

[0135] It can be understood that, when the at least one first system message and the at least one second system message are the same, the check passes, indicating that the system message broadcast by the network device is not tampered with or forged. Otherwise, the system message broadcast by the network device may be tampered with or forged, and the terminal device may be affected in accessing the network based on the system message, which may affect network security, and the network device releases the connection with the terminal device.

[0136] In this embodiment, by checking whether the at least one second system message sent by the network device and the at least one first system message sent by the terminal device are the same when entering the mode with security protection, the security check can be implemented while saving the bandwidth resources of the network device, which is beneficial to improving the communication quality of the terminal device and improving the user experience.

[0137] According to the embodiment shown in FIG. 4, the initial connection state between the terminal device and the network device is different, and the terminal device enters the mode with security protection at different times in the process of accessing the network. The information check method provided in this embodiment is further described below in combination with specific RRC states.

[0138] FIG. 5 is a flowchart of an information check method provided in another embodiment of the present application. As an example, the initial connection state between the terminal device and the network device in FIG. 5 is the RRC idle state, and as shown in FIG. 5, the information check method can include S501-S503.

[0139] S501, the network device sends at least one second system message to the terminal device.

[0140] This step is consistent with step S401 in the embodiment shown in FIG. 4.

[0141] It can be understood that the network device sending the at least one second system message to the terminal device means that the network device is internally pre-configured with the at least one second system message, and the network device can obtain the at least one second system message. In some implementations, as shown in optional step S501-1, the network device can record fifth information while sending the at least one second system message, the fifth information being used to indicate the at least one second system message.

[0142] As a possible implementation, the fifth information can include the at least one second system message or check information of the at least one second system message. For example, the check information of the at least one second system message can be a hash value of the at least one second system message or a cyclic redundancy check (CRC) value of the at least one second system message.

[0143] For example, the network device takes the at least one second system message as an input parameter of a hash function, and can convert the at least one second system message into a fixed-length output through a hash algorithm, and the output is the hash value of the at least one second system message.

[0144] It should be noted that in the case where the network device sends multiple second system messages, the fifth information can include check information of the multiple second system messages, and in the case where the check information is a hash value, the hash values of the multiple second system messages can be understood as the hash values of each of the multiple second system messages, and the multiple hash values can form a hash value sequence in a certain order.

[0145] S502, the terminal device receives the at least one first system message.

[0146] This step is consistent with step S402 in the embodiment shown in FIG. 4.

[0147] In some implementations, as shown in optional step S502-1, the terminal device can record first information, the first information being used to indicate the at least one first system message. As a possible implementation, the first information can include the at least one first system message or check information of the at least one first system message.

[0148] For example, the check information of the at least one first system message can be a hash value of the at least one first system message or a CRC value. The terminal device takes the at least one first system message as an input parameter of a hash function, and can convert it into a hash value of the at least one first system message through a hash algorithm.

[0149] According to the above, in the case that the terminal device receives a plurality of first system messages, the first information can include check information of the plurality of first system messages, and in the case that the check information is a hash value, the hash values of the plurality of first system messages can be understood as the hash values of each of the plurality of first system messages. The plurality of hash values can be arranged in a certain order to form a hash value sequence.

[0150] It should be understood that when the terminal device needs to record at least one first system message, the terminal device can be agreed by a protocol to record information for indicating the at least one first system message. As a possible implementation, as shown in optional step S500, the terminal device can receive fourth information, the fourth information being used for indicating recording of the at least one first system message. The step S500 can be before the step S501 or before the step S502. After receiving the fourth information, the terminal device starts to record the at least one first system message, and the present embodiment does not limit this.

[0151] The fourth information can be an independent indication information, and the network device sends the fourth information to the terminal device. In some implementations, the fourth information can also be carried in a system message. For example, when the network device broadcasts a system message, the fourth information can be carried in the system message, and the system message indicates recording of the at least one first system message.

[0152] As another possible implementation, when the fourth information is carried in a non-access stratum (NAS) message, the NAS message can be sent to the terminal device by an access and mobility management function (AMF) network element in a core network, and the NAS message indicates recording of the at least one first system message.

[0153] It should be noted that, compared with the real-time check method of the synchronous broadcast system message and the digital signature information, the information check method proposed in the present embodiment is a kind of post-check method, which checks the at least one first system message when entering the mode with security protection. The premise of checking the system message received by the terminal device in the form of post-check is that the terminal device supports the post-check form, and the network device or the core network learns that the terminal device supports the post-check method in this step.

[0154] In some implementations, the terminal device can also send capability information to the AMF network element, the capability information being used for indicating that the terminal device supports the post-check method, and the AMF network element indicates the terminal device to record the at least one first system message through the above NAS message when learning that the terminal device supports the post-check method.

[0155] S503, in the case of entering the security-protected mode, the terminal device checks the at least one first system message, or the network device checks the at least one second system message.

[0156] According to the foregoing introduction, in the case of the initial connection state between the terminal device and the network device being the RRC idle state, the terminal device establishes the connection with the network device through random access, and enters the RRC connected state from the RRC idle state. After the network device starts the security mode, it is equivalent to the case of the terminal device and the network device entering the security-protected mode.

[0157] In some implementations, as shown in optional step S503-1, in the case of the security mode, the network device sends second information to the terminal device, and the second information is used to indicate the at least one second system message. Correspondingly, the terminal device receives the second information from the network device.

[0158] It should be noted that the network device can record fifth information used to indicate the at least one second system message. In some implementations, the fifth information includes the at least one second system message, and the second information includes the at least one second system message or the digital signature information of the at least one second system message. Alternatively, the fifth information includes the check information of the at least one second system message, and the second information includes the check information of the at least one second system message or the digital signature information of the check information of the at least one second system message.

[0159] It can be understood that in the case of the network device recording the fifth information, the network device obtains the second information based on the local fifth information, and therefore the content included in the second information can be the same as the content included in the fifth information, or the content included in the second information can be the digital signature information obtained after the content included in the fifth information is encrypted. Exemplarily, in the case of the security mode, the second information can be carried in the RRC reconfiguration (RRCReconfiguration) message.

[0160] In the case of performing step S503-1, as shown in optional step S503-2, the terminal device checks the at least one first system message according to the first information and the second information. The first information is used to indicate the at least one first system message, and the second information is used to indicate the at least one second system message. The terminal device checks the at least one first system message according to the above two information, which is essentially checking whether the at least one first system message is the same as the at least one second system message according to the content indicated by the above two information.

[0161] In some implementations, the first information includes at least one first system message, and the second information includes at least one second system message or digital signature information of the at least one second system message. Alternatively, the first information includes check information of the at least one first system message, and the second information includes check information of the at least one second system message or digital signature information of the check information of the at least one second system message.

[0162] When the content included in the first information matches the content included in the second information, the terminal device can perform check based on the content included in the first information and the content included in the second information. For example, when the first information includes at least one first system message, and the second information includes at least one second system message, the system message is included in both of the above information, and the terminal device can directly compare whether the at least one first system message and the at least one second system message are the same. Alternatively, the second information includes digital signature information of the at least one second system message, and the terminal device can decrypt the at least one system message, compare the decrypted at least one system message with the at least one first system message, and if they are the same, it can be determined that the at least one first system message and the at least one second system message are the same.

[0163] Similarly, when the first information includes a hash value of at least one first system message, and the second information includes a hash value of at least one second system message, the hash value is included in both of the above information, and the terminal device can directly compare whether the hash values in the first information and the second information are the same, and if they are the same, the terminal device can determine that the at least one first system message and the at least one second system message are the same. Alternatively, the second information includes digital signature information of the hash value of the at least one second system message, and the terminal device compares the decrypted at least one hash value with the hash value of the at least one first system message, and if they are the same, it is determined that the at least one first system message and the at least one second system message are the same.

[0164] It should be noted that when the second information includes digital signature information of at least one second system message or digital signature information of check information of at least one second system message, the number of the above digital signature information can be one or more, for example, one or more digital signature information can correspond to at least one second system message. When the number of digital signature information is more than one, it does not affect the terminal device to check whether the at least one first system message and the at least one second system message are the same, and the number of digital signature information is not limited in the embodiments of the present application.

[0165] It can be understood that, when the terminal device checks the at least one first system message, the at least one first system message is the same as the at least one second system message, which is equivalent to passing the check, and the network device and the terminal device maintain the existing connection state. In some implementations, when the at least one first system message is different from the at least one second system message, that is, the check fails, the terminal device can send request information to the network device, as shown in optional step S504-1, the request information being used to request to release the RRC connection. Correspondingly, the network device receives the request information from the terminal device.

[0166] In the case of performing step S504-1, the network device sends an RRC release (RRCRelease) message to the terminal device, as shown in optional step S504-2. Correspondingly, the terminal device receives the RRC release message from the network device, and releases the RRC connection with the network device. As a possible implementation, the RRC release message can further include a "cause" field, which is used to indicate the reason for releasing the RRC connection.

[0167] In some implementations, the terminal device can further perform re-establishment of the connection when determining that the check fails and releasing the RRC connection, which will not be described in the embodiments of the present application.

[0168] It can be understood that, when the optional steps S503-1 and S503-2 are performed, it is equivalent to checking whether the at least one first system message and the at least one second system message are the same at the terminal device side in the case of the security mode. In this step, the at least one first system message and the at least one second system message can also be checked at the network device side.

[0169] As a possible implementation, as shown in optional step S503-3 in FIG. 6, in the case of the security mode, the terminal device sends third information to the network device, the third information being used to indicate the at least one first system message. Correspondingly, the network device receives the third information from the terminal device.

[0170] In some implementations, the first information includes the at least one first system message, and the third information includes the at least one first system message or digital signature information of the at least one first system message. Alternatively, the first information includes check information of the at least one first system message, and the third information includes the check information of the at least one first system message or digital signature information of the check information of the at least one first system message.

[0171] With reference to the aforementioned association between the fifth information and the second information, in the case that the terminal device records the first information, the network device obtains the third information based on the local first information, and thus the content included in the third information can be the same as the content included in the first information, or the content included in the third information can be digital signature information obtained after the content included in the first information is encrypted. Exemplarily, in the case of being in the security mode, the third information can be carried in an RRC Reconfiguration Complete message.

[0172] In the case of performing step S503-3, as shown in optional step S503-4 in FIG. 6, the network device checks the at least one second system message according to the third information and the fifth information. The third information is used to indicate the at least one first system message, and the fifth information is used to indicate the at least one second system message. The network device checks the at least one second system message according to the above two information, which is essentially checking whether the at least one first system message and the at least one second system message are the same according to the content indicated by the above two information.

[0173] In some implementations, the fifth information includes the at least one second system message, and the third information includes the at least one first system message or the digital signature information of the at least one first system message. Alternatively, the fifth information includes checking information of the at least one second system message, and the third information includes checking information of the at least one first system message or the digital signature information of the checking information of the at least one first system message.

[0174] With reference to the aforementioned checking of the at least one first system message by the terminal device, when the content included in the third information matches the content included in the fifth information, the network device can check based on the content included in the third information and the content included in the fifth information. For example, in the case that the third information includes the at least one first system message, and the fifth information includes the at least one second system message, the above two information both include system messages, and the terminal device can directly compare whether the at least one first system message and the at least one second system message are the same. Alternatively, the third information includes the digital signature information of the at least one first system message, and the terminal device can decrypt the at least one system message, compare the decrypted at least one system message with the at least one first system message, and if they are the same, it can be determined that the at least one first system message and the at least one second system message are the same.

[0175] Similarly, the network device can directly compare the hash values included in the third information and the fifth information, or compare the decrypted hash value in the fifth information with the hash value included in the third information, to check whether the above at least one first system message and the at least one second system message are the same, which will not be described herein again.

[0176] With reference to the aforementioned checking of the at least one first system message by the terminal device, in a case where the third information includes digital signature information of the at least one first system message or digital signature information of the checking information of the at least one first system message, the number of the digital signature information can be one or more, and the embodiments of the present application do not limit the number of the digital signature information.

[0177] In some implementations, in a case where the checking fails, the network device can directly send an RRC release message to the terminal device, as shown in optional step S504-2 in FIG. 6. Accordingly, the terminal device receives the RRC release message from the network device, and releases the RRC connection with the network device. The RRC release message can further include a “cause” field, which is used to indicate the reason for releasing the RRC connection.

[0178] FIG. 7 is a flowchart of an information checking method according to another embodiment of the present application. As an example, the initial connection state between the terminal device and the network device in FIG. 7 is the RRC inactive state, and as shown in FIG. 7, the information checking method can include S701-S703.

[0179] S701, the network device sends at least one second system message to the terminal device.

[0180] This step is consistent with step S501 in the embodiment shown in FIG. 5.

[0181] In some implementations, as shown in optional step S701-1, the network device records fifth information while sending the at least one second system message, the fifth information being used to indicate the at least one second system message. As an example, with reference to the aforementioned embodiments, the fifth information can include the at least one second system message or the checking information of the at least one second system message, which will not be repeated here.

[0182] S702, the terminal device receives the at least one first system message.

[0183] This step is consistent with step S502 in the embodiment shown in FIG. 5.

[0184] In some implementations, as shown in optional step S702-1, the terminal device can record first information, the first information being used to indicate the at least one first system message. As an example, the content included in the first information can refer to the aforementioned embodiments, which will not be repeated here.

[0185] When the terminal device needs to record the at least one first system message, the terminal device can record information for indicating the at least one first system message through protocol agreement. In a possible implementation, as shown in optional step S700, the network device can send sixth information to the terminal device, the sixth information being used for indicating recording of the at least one first system message. The step S700 can be before the step S701 or before the step S702, and after receiving the sixth information, the terminal device starts to record the at least one first system message, which is not limited in the embodiments of the present application.

[0186] It can be understood that the sixth information can be sent to the terminal device by the network device as an independent indication information. In some implementations, the sixth information can also be carried in a system message or an RRC release message. As an example, in the case that the connection state between the terminal device and the network device is the RRC inactive state, the network device can carry the above sixth information in the RRC release message. Exemplarily, the network device can also indicate through the RRC release message that the information checking method provided in the embodiments of the present application is supported in the RNA-based notification area (RAN-based notification area, RNA) or the cell range supported by the RNA.

[0187] As a possible implementation, the terminal device can also receive a NAS message from an AMF network element, the NAS message carrying fourth information, the fourth information being used for indicating recording of the at least one first system message.

[0188] S703, in the case of entering the mode with security protection, the terminal device checks the at least one first system message, or the network device checks the at least one second system message.

[0189] According to the foregoing introduction, in the case that the initial connection state between the terminal device and the network device is the RRC inactive state, the terminal device establishes the connection with the network device through random access, and the process of random access implemented by the RRC inactive state is equivalent to the case of entering the mode with security protection.

[0190] In some implementations, as shown in optional step S703-1, in the process of random access implemented by the RRC inactive state, the network device can send message 4 (message 4, Msg4) to the terminal device, the message 4 being used for indicating the at least one second system message. Correspondingly, the terminal device receives the message 4 from the terminal device.

[0191] It can be understood that, corresponding to the fourth step in the four steps of the random access process, the network device sends the message 4 to the terminal device, that is, sends the RRC connection establishment success message.

[0192] In the case that the network device records the fifth information, the network device sends the message 4 based on the content included in the local fifth information, thus the content included in the message 4 can be the same as the content included in the fifth information, or the content included in the message 4 can be the digital signature information obtained by encrypting the content included in the fifth information.

[0193] In some implementations, the fifth information includes at least one second system message, and the message 4 includes the at least one second system message or the digital signature information of the at least one second system message; or the fifth information includes the check information of the at least one second system message, and the message 4 includes the check information of the at least one second system message or the digital signature information of the check information of the at least one second system message.

[0194] In the case that the step S703-1 is performed, as shown in the optional step S703-2, the terminal device checks the at least one first system message according to the first information and the above message 4. Wherein, the first information is used to indicate the at least one first system message, and the message 4 is used to indicate the at least one second system message, and the terminal device checks the at least one first system message according to the above first information and the message 4, which is essentially checking whether the at least one first system message is the same as the at least one second system message according to the content indicated by the first information and the message 4.

[0195] In some implementations, the first information includes at least one first system message, and the message 4 includes the at least one second system message or the digital signature information of the at least one second system message; or the first information includes the check information of the at least one first system message, and the message 4 includes the check information of the at least one second system message or the digital signature information of the check information of the at least one second system message.

[0196] Referring to the embodiment shown in FIG. 5, when the content included in the first information matches the content included in the message 4, the terminal device can check based on the content included in the first information and the content included in the message 4. For example, in the case that the first information includes at least one first system message, the message 4 includes at least one second system message, the terminal device can directly compare whether the above at least one first system message and the at least one second system message are the same. Or, the message 4 includes the digital signature information of the at least one second system message, the terminal device can decrypt it, compare the decrypted at least one system message with the at least one first system message, and if they are the same, it can be determined that the at least one first system message is the same as the at least one second system message.

[0197] Similarly, in the case that the first information comprises the hash value of the at least one first system message, the terminal device can perform the verification based on the hash value of the at least one second system message or the digital signature information of the hash value included in the message 4, which will not be described herein again.

[0198] In the case that the message 4 comprises the digital signature information of the at least one second system message or the digital signature information of the verification information of the at least one second system message, the number of the digital signature information herein can be one or more, and the number of the digital signature information is not limited in the embodiments of the present application.

[0199] In some implementations, in the case that the at least one first system message is different from the at least one second system message, that is, the verification fails, the terminal device can send a request information to the network device, as shown in the optional step S704-1, the request information being used to request to release the RRC connection. Correspondingly, the network device receives the request information from the terminal device.

[0200] In the case that the step S704-1 is performed, the network device sends an RRC release message to the terminal device, as shown in the optional step S704-2. Correspondingly, the terminal device receives the RRC release message from the network device, and releases the RRC connection with the network device. As a possible implementation, the RRC release message can further comprise a “cause” field, the “cause” field being used to indicate the reason for releasing the RRC connection.

[0201] In some implementations, in the case that the terminal device determines that the verification fails and releases the RRC connection, the terminal device can further perform the re-establishment of the connection, which will not be described herein again.

[0202] Referring to the embodiment shown in FIG. 5, when the optional steps S703-1 and S703-2 are performed, it is equivalent to that, in the process of implementing the random access in the RRC inactive state, the terminal device side verifies whether the at least one first system message and the at least one second system message are the same. In this step, the network device side can also verify whether the at least one first system message and the at least one second system message are the same.

[0203] As a possible implementation, as shown in the optional step S703-3 in FIG. 8, in the process of implementing the random access in the RRC inactive state, the terminal device sends a message 5 (message 5, Msg5) to the network device, the message 5 being used to indicate the at least one first system message. Correspondingly, the network device receives the message 5 from the terminal device.

[0204] It can be understood that, corresponding to the network device sending the message 4 to the terminal device in the random access procedure, the terminal device sends the message 5 to the network device, that is, sends the RRC connection setup complete (RRCConnectionSetupComplete) message.

[0205] With reference to the foregoing relationship between the second information and the message 4, in the case where the terminal device records the first information, the terminal device sends the message 5 based on the content included in the local first information, and therefore the content included in the message 5 can be the same as the content included in the first information, or the content included in the message 5 can be the digital signature information obtained by encrypting the content included in the first information.

[0206] Exemplarily, the first information includes at least one first system message, and the message 5 includes the at least one first system message or the digital signature information of the at least one first system message. Alternatively, the first information includes the check information of the at least one first system message, and the message 5 includes the check information of the at least one first system message or the digital signature information of the check information of the at least one first system message.

[0207] In the case where the step S703-3 is performed, as shown in the optional step S703-4 in FIG. 8, the network device checks the at least one second system message according to the fifth information and the message 5. The message 5 is used to indicate the at least one first system message, and the fifth information is used to indicate the at least one second system message. The network device checks the at least one second system message according to the above message 5 and the fifth information, which is essentially to check whether the at least one first system message and the at least one second system message are the same according to the content indicated thereby.

[0208] In some implementations, the fifth information includes the at least one second system message, and the message 5 includes the at least one first system message or the digital signature information of the at least one first system message. Alternatively, the fifth information includes the check information of the at least one second system message, and the message 5 includes the check information of the at least one first system message or the digital signature information of the check information of the at least one first system message.

[0209] With reference to the foregoing embodiments, when the content included in the message 5 matches the content included in the fifth information, the network device can perform verification based on the content included in the message 5 and the content included in the fifth information. For example, in the case where the message 5 includes at least one first system message, the fifth information includes at least one second system message, the terminal device can directly compare whether the at least one first system message and the at least one second system message are the same. Alternatively, the message 5 includes digital signature information of the at least one first system message, and the terminal device can decrypt the at least one first system message, compare the decrypted at least one first system message with the at least one first system message, and if they are the same, it can be determined that the at least one first system message and the at least one second system message are the same.

[0210] Similarly, in the case where the fifth information includes a hash value of the at least one second system message, the terminal device can perform verification based on a hash value of the at least one first system message included in the message 5 or digital signature information of the hash value, which will not be described herein again.

[0211] In the case where the message 5 includes digital signature information of the at least one first system message or digital signature information of the verification information of the at least one first system message, the number of the above digital signature information can be one or more, and the number of the digital signature information is not limited in the embodiments of the present application.

[0212] In some implementations, in the case where the verification fails, the network device can directly send an RRC release message to the terminal device, as shown in optional step S704-2 in FIG. 8. Correspondingly, the terminal device receives the RRC release message from the network device and releases the RRC connection with the network device. The RRC release message can further include a “cause” field, which is used to indicate the reason for releasing the RRC connection.

[0213] In the embodiments shown in FIGS. 5 to 8, a single RAN node is described as the network device, and the information verification method provided by the embodiments of the present application is further described below with the ORAN as the network device.

[0214] FIG. 9 is a flowchart of an information verification method provided by an embodiment of the present application. Exemplarily, the initial connection state between the terminal device and the network device in FIG. 9 is the RRC idle state, and as shown in FIG. 9, the information verification method can include S901-S903.

[0215] S901, the O-DU sends at least one second system message to the terminal device.

[0216] In the foregoing embodiment, the network device sends the at least one second system message to the terminal device, and as an example, the network device is an O-DU in an ORAN, and the O-DU sends the at least one second system message to the terminal device.

[0217] In some implementations, as shown in optional step S901-1, the O-DU can record fifth information while sending the at least one second system message, the fifth information being used to indicate the at least one second system message. With reference to the foregoing embodiment, the fifth information can include the at least one second system message or check information of the at least one second system message, and the check information of the at least one second system message can be a hash value or a CRC value of the at least one second system message, which will not be repeated here.

[0218] Correspondingly, as shown in optional step S901-2, the O-DU sends the fifth information to the O-CU, and the O-CU receives the fifth information from the O-DU. As an example, the O-CU-CP in the O-CU can receive the fifth information, and for the ORAN, the O-CU can obtain the at least one second system message through the fifth information.

[0219] S902, the terminal device receives the at least one first system message.

[0220] This step is consistent with step S502 in the embodiment shown in FIG. 5.

[0221] With reference to the foregoing embodiment, in some implementations, as shown in optional step S902-1, the terminal device can record first information, the first information being used to indicate the at least one first system message. With reference to the foregoing embodiment, the first information can include the at least one first system message or check information of the at least one first system message, and the check information of the at least one first system message can be a hash value or a CRC value of the at least one first system message, which will not be repeated here.

[0222] When the terminal device needs to record the at least one first system message, the terminal device can be agreed through a protocol to record information used to indicate the at least one first system message. In a possible implementation, as shown in optional step S900, the terminal device can receive fourth information, the fourth information being used to indicate recording the at least one first system message. The step S900 can be before step S901 or before step S902, and after receiving the fourth information, the terminal device starts to record the at least one first system message, which is not limited in the embodiments of the present application.

[0223] The fourth information can be sent to the terminal device by the O-CU as an independent indication information. Alternatively, the O-CU sends the fourth information to the O-DU, and the O-DU forwards the fourth information to the terminal device after receiving the fourth information.

[0224] In some implementations, the fourth information can also be sent to the terminal device by the O-DU. For example, the fourth information can be carried in a system message, and the O-DU sends the fourth information to the terminal device through the system message.

[0225] As another possible implementation, when the fourth information is carried in a NAS message, the NAS message can be sent to the terminal device by an AMF network element in the core network, and the NAS message is used to indicate the recording of the at least one first system message.

[0226] S903, in the case of entering the security-protected mode, the terminal device checks the at least one first system message, or the ORAN checks the at least one second system message.

[0227] In the embodiment shown in FIG. 9, after the ORAN starts the security mode, it is equivalent to the case where the terminal device and the ORAN enter the security-protected mode.

[0228] In some implementations, as shown in optional step S903-1, in the case of being in the security mode, the O-CU in the ORAN sends the second information to the terminal device, and the second information is used to indicate the at least one second system message. Correspondingly, the terminal device receives the second information from the O-CU.

[0229] As an example, referring to the foregoing embodiments, the fifth information includes the at least one second system message, and the second information includes the at least one second system message or the digital signature information of the at least one second system message. Alternatively, the fifth information includes the hash value of the at least one second system message, and the second information includes the hash value of the at least one second system message or the digital signature information of the hash value of the at least one second system message.

[0230] In the case of performing step S903-1, as shown in optional step S903-2, the terminal device checks the at least one first system message according to the first information and the second information. The specific checking method can refer to the embodiment shown in FIG. 5, which will not be described here. In the case of failing to pass the check, as shown in optional step S904-1, the terminal device can send a request information to the O-DU in the ORAN, and the request information is used to request to release the RRC connection. Correspondingly, the O-DU receives the request information from the terminal device.

[0231] In case of performing step S904-1, as shown in optional step S904-2, the O-DU sends an RRC release message to the terminal device. Correspondingly, the terminal device receives the RRC release message from the O-DU, and releases the RRC connection with the ORAN. As a possible implementation, the above RRC release message can further include a “cause” field, which is used to indicate the reason for releasing the RRC connection.

[0232] In some implementations, in case of determining that the check fails and releasing the RRC connection, the terminal device can further perform re-establishment of the connection, which will not be described in the embodiments of the present application.

[0233] When the optional steps S903-1 and S903-2 are performed, it is equivalent to the case of being in the security mode, and the terminal device checks whether the at least one first system message and the at least one second system message are the same. In this step, the at least one first system message and the at least one second system message can also be checked on the side of the ORAN.

[0234] In some implementations, as shown in optional step S903-3 in FIG. 10, in case of being in the security mode, the terminal device sends third information to the ORAN, and the third information is used to indicate the at least one first system message. Correspondingly, the ORAN receives the third information from the terminal device, and exemplarily, the O-CU in the ORAN receives the third information from the terminal device.

[0235] According to the foregoing embodiments, the first information can include the at least one first system message, and the third information can include the at least one first system message or the digital signature information of the at least one first system message. Alternatively, the first information can include the check information of the at least one first system message, and the third information can include the check information of the at least one first system message or the digital signature information of the check information of the at least one first system message.

[0236] In case of performing step S903-3, as shown in optional step S903-4 in FIG. 9, the O-CU checks the at least one second system message according to the third information and the fifth information, and the specific checking method can refer to the embodiments shown in FIG. 6, which will not be described herein.

[0237] In the case of a failed check, the ORAN can directly send an RRC release message to the terminal device. As shown in optional step S904-2, the O-CU sends an RRC release message to the O-DU, and the O-DU forwards the RRC release message to the terminal device. Accordingly, the terminal device receives the RRC release message from the ORAN and releases the RRC connection with the ORAN. The RRC release message can further include a “cause” field, which indicates the reason for releasing the RRC connection.

[0238] FIG. 11 is a flow diagram of an information checking method according to another embodiment of the present application. As an example, the initial connection state between the terminal device and the network device in FIG. 11 is the RRC inactive state. As shown in FIG. 11, the information checking method can include S1101-S1103.

[0239] S1101, the O-DU sends at least one second system message to the terminal device.

[0240] This step is consistent with step S901 in the embodiment shown in FIG. 9.

[0241] In some implementations, with reference to the embodiment shown in FIG. 9, in some implementations, as shown in optional step S1101-1, the O-DU can record fifth information while sending the at least one second system message, the fifth information being used to indicate the at least one second system message. Accordingly, as shown in optional step S1101-2, the O-DU sends the fifth information to the O-CU, and the O-CU receives the fifth information from the O-DU.

[0242] S1102, the terminal device receives at least one first system message.

[0243] This step is consistent with step S902 in the embodiment shown in FIG. 9.

[0244] With reference to the foregoing embodiments, in some implementations, as shown in optional step S1102-1, the terminal device can record first information, the first information being used to indicate the at least one first system message.

[0245] When the terminal device needs to record the at least one first system message, the terminal device can be instructed to record information indicating the at least one first system message through a protocol. In one possible implementation, as shown in optional step S1100, the O-CU can send sixth information to the terminal device, the sixth information being used to indicate recording the at least one first system message. Step S1100 can be performed before step S1101 or before step S1102. After receiving the sixth information, the terminal device starts recording the at least one first system message, and the present embodiment does not limit this.

[0246] The sixth information can be sent by the O-CU to the terminal device as an independent indication information. Alternatively, the O-CU sends the sixth information to the O-DU, and the O-DU forwards the sixth information to the terminal device after receiving the sixth information.

[0247] In some implementations, the sixth information can also be carried in a system message or an RRC release message. As an example, in the case that the connection state between the terminal device and the ORAN is in the RRC inactive state, the O-DU in the ORAN can carry the sixth information in the RRC release message. Exemplarily, the ORAN can also indicate in the RRC release message that the information checking method provided in the present application is supported in the RNA-based notification area (RNA) or the cell range supported by the RNA.

[0248] As a possible implementation, the terminal device can also receive a NAS message from the AMF network element, and the fourth information is carried in the NAS message, and the fourth information is used to indicate that the at least one first system message is recorded.

[0249] S1103, in the case of entering the mode with security protection, the terminal device checks the at least one first system message, or the network device checks the at least one second system message.

[0250] In the embodiment shown in FIG. 11, in the case that the initial connection state between the terminal device and the ORAN is in the RRC inactive state, the terminal device establishes the connection with the ORAN through random access, and the process of random access implemented by the RRC inactive state is equivalent to the case of entering the mode with security protection.

[0251] In some implementations, as shown in optional step S1103-1, in the process of random access implemented by the RRC inactive state, the O-CU in the ORAN can send message 4 to the terminal device, and the message 4 is used to indicate the at least one second system message. Correspondingly, the terminal device receives the message 4 from the terminal device.

[0252] In the case of performing step S1103-1, as shown in optional step S703-2, the terminal device checks the at least one first system message according to the first information and the above message 4, and the specific checking method can refer to the embodiment shown in FIG. 7, which will not be described here.

[0253] In some implementations, in the case that the check fails, the terminal device can send, to the O-DU in the ORAN, request information for requesting release of the RRC connection, as shown in optional step S1104-1. Correspondingly, the O-DU receives the request information from the terminal device.

[0254] In the case that step S1104-1 is performed, the O-DU sends, to the terminal device, an RRC release message, as shown in optional step S1104-2. Correspondingly, the terminal device receives the RRC release message from the O-DU, and releases the RRC connection with the ORAN. As one possible implementation, the RRC release message can further include a “cause” field, which is used to indicate the reason for releasing the RRC connection.

[0255] In some implementations, in the case that the terminal device determines that the check fails and releases the RRC connection, the terminal device can further perform re-establishment of the connection, which will not be described in the embodiments of the present application.

[0256] When the optional steps S1103-1 and S1103-2 are performed, it is equivalent to that, in the process of implementing random access in the RRC inactive state, the terminal device side checks whether the at least one first system message and the at least one second system message are the same. In this step, the at least one first system message and the at least one second system message can also be checked on the ORAN side.

[0257] In some implementations, in the process of implementing random access in the RRC inactive state, the terminal device sends, to the O-CU in the ORAN, message 5 for indicating the at least one first system message, as shown in optional step S1103-3 in FIG. 12. Correspondingly, the O-CU receives the message 5 from the terminal device.

[0258] In the case that step S1103-3 is performed, the O-CU checks the at least one second system message according to the fifth information and the message 5, as shown in optional step S1103-4 in FIG. 12. The specific checking method can refer to the embodiment shown in FIG. 8, which will not be described here.

[0259] In some implementations, in the case that the check fails, the ORAN can directly send, to the terminal device, an RRC release message. As shown in optional step S1104-2, the O-CU sends, to the O-DU, the RRC release message, and the O-DU forwards the RRC release message to the terminal device. Correspondingly, the terminal device receives the RRC release message from the ORAN, and releases the RRC connection with the ORAN. The RRC release message can further include a “cause” field, which is used to indicate the reason for releasing the RRC connection.

[0260] It should be noted that the information verification method provided by the embodiments of the present application is equivalent to a post-check method, and this post-check method is beneficial to the safe verification of system messages with low latency requirements, such as the case where the first system message or the second system message includes system messages other than the MIB, SIB1 to SIB5. In this case, the information verification method provided by the embodiments of the present application is applicable.

[0261] FIG. 13 and FIG. 14 are structural schematic diagrams of possible information verification apparatuses provided by the embodiments of the present application. These information verification apparatuses can be used to implement the functions of the terminal device or the network device in the above-mentioned method embodiments, and thus can also achieve the beneficial effects possessed by the above-mentioned method embodiments. In the embodiments of the present application, the information verification apparatus can be the terminal device or the network device in the method embodiments shown in FIG. 4 to FIG. 12, or can be a component (such as a chip, a chip system, a processor, etc.) configured in the terminal device or the network device, or can be a logic module or software capable of implementing part or all of the functions of the terminal device or the network device.

[0262] FIG. 13 is a structural schematic diagram of an information verification apparatus provided by an embodiment of the present application. As shown in FIG. 13, the information verification apparatus 1300 includes a processing module 1310 and a transceiver module 1320.

[0263] The transceiver module 1320 can implement corresponding communication functions, and the transceiver module 1320 can also be referred to as an input / output interface or a communication unit. The processing module 1310 can be used to perform processing operations. It should be understood that if the apparatus 1300 is a component (such as a chip) configured in a network device or a terminal device, the transceiver module 1320 can be an input / output interface.

[0264] Optionally, the transceiver module 1320 can include a sending module and a receiving module. The sending module is used to perform the sending operations of the network device or the terminal device in the above-mentioned FIG. 4 to FIG. 12, and the receiving module is used to perform the receiving operations of the network device or the terminal device in the above-mentioned FIG. 4 to FIG. 12.

[0265] It should be understood that when the apparatus 1300 is a component (such as a chip) configured in a network device or a terminal device, the sending module can be an output interface, and the sending operations involved in the embodiments of the present application can be performed by the output interface; the receiving module can be an input interface, and the receiving operations involved in the embodiments of the present application can be performed by the input interface.

[0266] Optionally, the apparatus 1300 can further include a storage module, which can be used to store instructions and / or data. The processing module 1310 can read the instructions and / or data in the storage module, so that the apparatus implements the method embodiments shown in the preceding FIG. 4 to FIG. 12.

[0267] In one possible design, the apparatus 1300 can be used to implement the functions of the terminal device in the method embodiments described above with respect to FIG. 4 to FIG. 12, or the apparatus 1300 can include a unit for implementing any function or operation of the terminal device in the method embodiments described above with respect to FIG. 4 to FIG. 12, and the unit can be implemented by software, hardware, firmware, or any combination thereof, entirely or partially.

[0268] When the apparatus 1300 is used to implement the functions of the terminal device in the method embodiments described above with respect to FIG. 4 to FIG. 12, the transceiver module 1320 (which can be specifically a receiving module) can be used to perform step S501 in FIG. 5, receiving at least one system information, and can also be used to perform step S503-1 in FIG. 5, receiving second information from the network device, the second information being used to indicate at least one second system message; the processing module 1310 can be used to perform step S503-2 in FIG. 5, verifying the at least one first system message according to the first information and the second information; and the transceiver module 1320 (which can be specifically a transmitting module) can be used to perform step S503-3 in FIG. 6, sending third information to the network device, the third information being used to indicate the at least one first system message.

[0269] In another possible design, the apparatus 1300 can be used to implement the functions of the network device in the method embodiments described above with respect to FIG. 4 to FIG. 12, or the apparatus 1300 can include a unit for implementing any function or operation of the network device in the method embodiments described above with respect to FIG. 4 to FIG. 12, and the unit can be implemented by software, hardware, firmware, or any combination thereof, entirely or partially.

[0270] When the apparatus 1300 is used to implement the functions of the network device in the method embodiments described above with respect to FIG. 4 to FIG. 12, the transceiver module 1320 (which can be specifically a transmitting module) can be used to perform step S501 in FIG. 5, sending at least one second system information; the processing module 1310 can be used to perform step S503-4 in FIG. 6, verifying the at least one second system message according to the third information and the fifth information; and the transceiver module 1320 (which can be specifically a receiving module) can be used to perform step S503-3 in FIG. 6, receiving third information from the terminal device, the third information being used to indicate the at least one first system message.

[0271] More detailed descriptions of the processing module 1310 and the transceiver module 1320 can be directly obtained by referring to the related descriptions in the method embodiments described above with respect to FIG. 4 to FIG. 12, and thus are not repeated here.

[0272] It should be noted that the transceiver module can also be referred to as a transceiver unit, a transceiver, a transceiver device, or the like. The processing module can also be referred to as a processor, a processing board, a processing unit, or a processing device, or the like. Alternatively, the transceiver module is configured to perform the transmitting operation and the receiving operation of the terminal device or the network device in the above method, the device in the communication module for implementing the receiving function can be regarded as a receiving module, and the device in the communication module for implementing the transmitting function can be regarded as a transmitting module, that is, the transceiver module includes the receiving module and the transmitting module.

[0273] In addition, in a possible design, the foregoing transceiver module and / or the processing module can be implemented by a virtual module, for example, the processing module can be implemented by a software function module or a virtual device, and the transceiver module can be implemented by a software function module or a virtual device. In another possible design, the processing module or the transceiver module can also be implemented by an entity device, for example, if the device is implemented by a chip / chip circuit, the transceiver module can be an input / output circuit and / or a communication interface, and is configured to perform an input operation (corresponding to the foregoing receiving operation) and an output operation (corresponding to the foregoing transmitting operation); and the processing module is an integrated processor or a microprocessor or an integrated circuit.

[0274] It should be understood that the division of the modules in the embodiments of the present application is illustrative, and is merely a logical function division. In actual implementation, another division manner can be used. In addition, each function module in each embodiment of the present application can be integrated in one processor, or can be physically separated, or two or more modules can be integrated in one module. The integrated module can be implemented in the form of hardware or in the form of a software function module.

[0275] FIG. 14 is a structural schematic diagram of an information verification device provided by another embodiment of the present application. The device 1400 shown in FIG. 14 can be configured to perform the method performed by the information verification device in any of the foregoing methods.

[0276] As shown in FIG. 14, the device 1400 of the embodiment includes a memory 1401, a processor 1402, a communication interface 1403, and a bus 1404. The memory 1401, the processor 1402, and the communication interface 1403 are in communication connection with each other through the bus 1404.

[0277] The memory 1401 can be a read only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 1401 can store a program, and when the program stored in the memory 1401 is executed by the processor 1402, the processor 1402 is configured to perform any of the foregoing methods.

[0278] The processor 1402 can be a general purpose central processing unit (CPU), a microprocessor, an application specific integrated circuit, or one or more integrated circuits used to execute program instructions.

[0279] The processor 1402 can also be an integrated circuit chip having a processing capability for signals. In the implementation process, each related step in the embodiment of the present application can be completed by the integrated logic circuit of hardware in the processor 1402 or the instruction in the form of software.

[0280] The processor 1402 described above can also be a general purpose processor, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component. The disclosed methods, steps and logic block diagrams in the embodiments of the present application can be implemented or executed. The general purpose processor can be a microprocessor or the processor can also be any conventional processor.

[0281] The steps of the method disclosed in the embodiments of the present application can be directly embodied as hardware code processing for execution, or executed by a combination of hardware and software modules in the code processing. The software module can be located in a random access memory, a flash memory, a read only memory, a programmable read only memory or an electrically erasable programmable memory, a register, or other mature storage medium in the art. The storage medium is located in the storage 1401, and the processor 1402 reads the information in the storage 1401, and combines the hardware to complete the functions required by the units included in the device of the present application.

[0282] The communication interface 1403 can use, but not limited to, a transceiver type transceiver to realize the communication between the device 1400 and other devices or devices.

[0283] The bus 1404 can include a path for transmitting information between various components (for example, the storage 1401, the processor 1402, the communication interface 1403) of the device 1400.

[0284] The embodiment of the present application also provides a computer readable storage medium, and the computer readable storage medium stores computer instructions, when the processor executes the computer instructions, each step in the method in the above embodiment is realized.

[0285] The embodiment of the present application also provides a computer program product, including computer instructions, which are executed by the processor to realize each step in the method in the above embodiment.

[0286] The embodiment of the present application further provides an information verification system, which comprises the terminal device and the network device.

[0287] It should be noted that the modules or components shown in the above embodiments can be one or more integrated circuits configured to implement the above methods, for example, one or more application specific integrated circuits, or one or more microprocessors, or one or more field programmable gate arrays, etc. For another example, when a certain module above is implemented in the form of a processing element invoking program codes, the processing element can be a general purpose processor, for example, a central processing unit or other processor capable of invoking program codes, such as a controller. For another example, these modules can be integrated together to implement in the form of a SoC.

[0288] In the above embodiments, all or part of the embodiments can be implemented by software, hardware, firmware, software modules or any combination thereof. When implemented by software, all or part of the embodiments can be implemented in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions according to the embodiments of the present application are generated. The computer can be a general purpose computer, a special purpose computer, a computer network or other programmable device. The computer instructions can be stored in a computer readable storage medium or transmitted from one computer readable storage medium to another computer readable storage medium, for example, the computer instructions can be transmitted from one website, computer, server or data center to another website, computer, server or data center through wired (for example, coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (for example, infrared, wireless, microwave, etc.) mode. The computer readable storage medium can be any available medium accessible by a computer or a data storage device such as a server, data center, etc. containing one or more available media. The available media can be magnetic media (for example, floppy disk, hard disk, magnetic tape), optical media (for example, DVD) or semiconductor media (for example, solid state disk (SSD)) and the like.

[0289] Other embodiments of the present application will be apparent to those skilled in the art from consideration of the specification and practice of the application disclosed herein. The specification and examples given are considered exemplary only, and the true scope and spirit of the application is indicated by the following claims.

[0290] It is to be understood that the application is not limited to the precise construction already described above and shown in the drawings, and that various modifications and changes can be made by those skilled in the art without departing from the scope of the application. The scope of the application should only be limited by the claims appended hereto.

Claims

1. An information checking method, characterized by, The method comprises: receiving at least one first system message; verifying the at least one first system message in a case of entering a mode with security protection.

2. The method of claim 1, wherein, The method further comprises: recording first information, the first information being used to indicate the at least one first system message.

3. The method of claim 2, wherein, The mode with security protection comprises entering a security mode from a radio resource control (RRC) connected state; wherein the verifying the at least one first system message in the case of entering the mode with security protection comprises: receiving second information in the case of being in the security mode, the second information being used to indicate at least one second system message; verifying the at least one first system message according to the first information and the second information.

4. The method of claim 3, wherein, The first information comprises the at least one first system message, and the second information comprises the at least one second system message or digital signature information of the at least one second system message; or The first information comprises verification information of the at least one first system message, and the second information comprises verification information of the at least one second system message or digital signature information of the verification information of the at least one second system message.

5. The method of claim 2, wherein, The mode with security protection comprises entering a security mode from an RRC connected state; wherein the verifying the at least one first system message in the case of entering the mode with security protection comprises: sending third information in the case of being in the security mode, the third information being used to indicate the at least one first system message.

6. The method of claim 5, wherein, The first information comprises the at least one first system message, and the third information comprises the at least one first system message or digital signature information of the at least one first system message; or The first information comprises verification information of the at least one first system message, and the third information comprises verification information of the at least one first system message or digital signature information of the verification information of the at least one first system message.

7. The method of claim 2, wherein, The mode with security protection comprises a process of implementing random access from an RRC inactive state; wherein the verifying the at least one first system message in the case of entering the mode with security protection comprises: receiving message 4 in the process of implementing random access from the RRC inactive state, the message 4 being used to indicate at least one second system message; verifying the at least one first system message according to the first information and the message 4.

8. The method of claim 7, wherein, The first information comprises the at least one first system message, and the message 4 comprises the at least one second system message or digital signature information of the at least one second system message; or The first information comprises verification information of the at least one first system message, and the message 4 comprises verification information of the at least one second system message or digital signature information of the verification information of the at least one second system message.

9. The method of claim 2, wherein, The mode with security protection comprises a process of implementing random access from an RRC inactive state; The checking the at least one first system message in the case of entering the mode with security protection comprises: The message 5 is used for indicating the at least one first system message.

10. The method of claim 9, wherein, The first information comprises the at least one first system message, and the message 5 comprises the at least one first system message or digital signature information of the at least one first system message; or The first information comprises checking information of the at least one first system message, and the message 5 comprises the checking information of the at least one first system message or digital signature information of the checking information of the at least one first system message.

11. The method according to any one of claims 1 to 10, characterized in that, The method further comprises: Receiving fourth information used for indicating the at least one first system message.

12. The method of claim 11, wherein, The fourth information is carried in any one of the following information: a system message, a non-access stratum (NAS) message or an RRC release message.

13. An information checking method characterized by, The method comprises: Obtaining at least one second system message; The checking the at least one second system message in the case of entering the mode with security protection comprises:

14. The method of claim 13, wherein, The method further comprises: Recording fifth information used for indicating the at least one second system message.

15. The method of claim 14, wherein, The mode with security protection comprises entering a security mode from an RRC connected state; The checking the at least one second system message in the case of entering the mode with security protection comprises: In the case of being in the security mode, sending second information used for indicating the at least one second system message.

16. The method of claim 15, wherein, The fifth information comprises the at least one second system message, and the second information comprises the at least one second system message or digital signature information of the at least one second system message; or The fifth information comprises checking information of the at least one second system message, and the second information comprises the checking information of the at least one second system message or digital signature information of the checking information of the at least one second system message.

17. The method of claim 14, wherein, The mode with security protection comprises entering a security mode from an RRC connected state; The checking the at least one second system message in the case of entering the mode with security protection comprises: In the case of being in the security mode, receiving third information used for indicating the at least one first system message; According to the third information and the fifth information, checking the at least one second system message.

18. The method of claim 17, wherein, The fifth information comprises the at least one second system message, and the third information comprises the at least one first system message or digital signature information of the at least one first system message; or The fifth information comprises checking information of the at least one second system message, and the third information comprises the checking information of the at least one first system message or digital signature information of the checking information of the at least one first system message.

19. The method of claim 14, wherein, The mode with security protection comprises a process of implementing random access from an RRC inactive state; The checking the at least one second system message in the case of entering the mode with security protection comprises: The message 4 is used for indicating the at least one second system message in the process of implementing random access by the RRC inactive state.

20. The method of claim 19, wherein, The fifth information comprises the at least one second system message, and the message 4 comprises the at least one second system message or digital signature information of the at least one second system message; or The fifth information comprises checking information of the at least one second system message, and the message 4 comprises checking information of the at least one second system message or digital signature information of the checking information of the at least one second system message.

21. The method of claim 14, wherein, The mode with security protection comprises the process of implementing random access by the RRC inactive state. The checking the at least one second system message in the case of entering the mode with security protection comprises: The message 5 is used for indicating at least one first system message in the process of implementing random access by the RRC inactive state.

22. The method of claim 21, wherein, The fifth information comprises the at least one second system message, and the message 5 comprises the at least one first system message or digital signature information of the at least one first system message; or The fifth information comprises checking information of the at least one second system message, and the message 5 comprises checking information of the at least one first system message or digital signature information of the checking information of the at least one first system message.

23. The method of any one of claims 13-22, wherein, The method further comprises: The sixth information is used for indicating recording at least one first system message.

24. The method of claim 23, wherein, The sixth information is carried in a system message or an RRC release message.

25. An information checking device, characterized by The information checking device comprises a module for implementing the information checking method in any one of claims 1 to 12 or a module for implementing the information checking method in any one of claims 13 to 24.

26. An information checking device, characterized by comprises: a processor and a memory; the memory stores computer execution instructions; the processor executes the computer execution instructions stored in the memory, so that the information checking device executes the information checking method in any one of claims 1 to 12 or 13 to 24.

27. A computer-readable storage medium, characterized in that, The computer readable storage medium stores computer execution instructions, and the computer execution instructions are executed by the processor to implement the information checking method in any one of claims 1 to 12 or 13 to 24.

28. A computer program product, characterised in that, The computer program is executed by the processor to implement the information checking method in any one of claims 1 to 12 or 13 to 24.

Images