Communication method, communication device, communication system, storage medium and program product

Abstract

The present disclosure relates to a communication method, a communication device, a communication system, a storage medium and a program product. The method comprises: determining a second key on the basis of a first key, wherein the first key is used for an access network device, the second key is used for a second node, and the second node being a DU in the access network device. By means of the solution of the present disclosure, security protection between a terminal and an access network device can be realized.

Description

Communication methods, communication equipment, communication systems, storage media and software products Technical Field

[0001] This disclosure relates to the field of wireless communication, and more particularly to a communication method, communication device, communication system, storage medium, and program product. Background Technology

[0002] Security protection for signaling and data transmission in communication systems is essential. In some scenarios, signaling and data transmission between terminals and the network side is often achieved through the air interface. This makes the security of communication between the terminal and the network side particularly important. Summary of the Invention

[0003] In communication systems, the security of communication between terminals and access network equipment is often subject to significant challenges.

[0004] This disclosure provides a communication method, communication device, communication system, storage medium, and program product.

[0005] According to a first aspect of the present disclosure, a communication method is provided. The method is executed by a first node. The method includes: determining a second key based on a first key, wherein the first key is used for an access network device, and the second key is used for a second node; wherein the second node is a distributed unit (DU) in the access network device.

[0006] According to a second aspect of the present disclosure, a communication method is provided. The method is performed by a second node. The method includes: receiving a second key sent by a first node, wherein the second key is determined based on a first key, the first key being used in an access network device, and the second key being used in the second node; wherein the first node is a central unit (CU) in the access network device, and the second node is a unit (DU) in the access network device.

[0007] According to a third aspect of the present disclosure, a communication device is provided. This communication device is used to perform the communication method as described in the first or second aspect.

[0008] According to a fourth aspect of this disclosure, a communication system is provided. The communication system includes a first node and a second node. The first node is configured to perform the communication method as described in the first aspect. The second node is configured to perform the communication method as described in the second aspect.

[0009] According to a fifth aspect of the present disclosure, a storage medium is provided. The storage medium stores instructions. When executed on a communication device, the instructions cause the communication device to perform a communication method as described in the first or second aspect.

[0010] According to a sixth aspect of the present disclosure, a program product is provided. The program product includes at least one of a program and instructions. When executed by a communication device, the program or instructions implement the steps of the communication method as described in the first or second aspect.

[0011] According to a seventh aspect of the present disclosure, a computer program is provided. When the computer program is run on a computer, it causes the computer to perform the communication method as described in the first or second aspect.

[0012] According to an eighth aspect of this disclosure, a chip or chip system is provided. The chip or chip system includes processing circuitry. The processing circuitry is configured to perform the communication method as described in the first or second aspect.

[0013] According to embodiments of this disclosure, security protection between the terminal and the access network device can be achieved.

[0014] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and do not constitute a limitation on the embodiments of this disclosure. Attached Figure Description

[0015] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments of the invention and, together with the description, serve to explain the principles of the embodiments of the invention.

[0016] Figure 1 is an exemplary schematic diagram of the architecture of a communication system provided according to an embodiment of the present disclosure.

[0017] Figure 2A is an exemplary schematic diagram of the NG-RAN architecture.

[0018] Figure 2B is an exemplary schematic diagram of a scenario employing a CU-DU separation architecture.

[0019] Figure 2C is an exemplary schematic diagram of the CU-DU separation architecture.

[0020] Figure 3A is an exemplary schematic diagram of key hierarchy generation in a 5G system.

[0021] Figure 3B is an exemplary schematic diagram of the MAC security key derivation hierarchy.

[0022] Figure 3C is an exemplary schematic diagram of a MAC security key derivation hierarchy based on the QKD mechanism.

[0023] Figure 4 is an exemplary interaction diagram of the communication method provided according to an embodiment of the present disclosure.

[0024] Figure 5 is an exemplary schematic diagram generated according to the key hierarchy structure provided in the embodiments of this disclosure.

[0025] Figure 6 is an exemplary interaction diagram of the communication method provided according to an embodiment of the present disclosure.

[0026] Figure 7 is an exemplary schematic diagram of a communication device provided according to an embodiment of the present disclosure.

[0027] Figure 8A is an exemplary structural diagram of a communication device provided according to an embodiment of the present disclosure.

[0028] Figure 8B is an exemplary structural diagram of a chip provided according to an embodiment of the present disclosure. Detailed Implementation

[0029] This disclosure provides a communication method, communication device, communication system, storage medium, and program product.

[0030] In a first aspect, embodiments of this disclosure provide a communication method. The method is executed by a first node. The method includes: determining a second key based on a first key, wherein the first key is used by an access network device, and the second key is used by a second node; wherein the second node is a DU (Dedicated Unit) within the access network device.

[0031] In the above embodiments, the first node can generate a second key for the second node based on a first key for the access network device. In this case, the second key can provide security protection for one or more protocol layers located on the second node. This enables secure communication between the second node and the terminal at these one or more protocol layers. In particular, if the second node is a DU, communication at the protocol layers located on the DU can be protected by the second key.

[0032] In conjunction with some embodiments of the first aspect, in some embodiments, the first key can be used for communication security between the access network device and the terminal, and the second key can be used for communication security between the second node and the terminal.

[0033] In the above embodiments, the security of communication between the access network device and the terminal can be supported by a first key, and the security of communication between the second node and the terminal can be supported by a second key. Thus, secure communication between different protocol layers between the CU-DU separated access network device and the terminal can be achieved.

[0034] In conjunction with some embodiments of the first aspect, in some embodiments, the operation of determining a second key based on a first key may include: determining a second key based on a first parameter according to the first key.

[0035] In conjunction with some embodiments of the first aspect, in some embodiments, the first parameter may include at least one of the following: first identification information for uniquely identifying the terminal in the access network device; first length, which is the length of the first identification information; first count value, which is the count value of the terminal moving across DUs in the access network device; second length, which is the length of the first count value; second identification information for identifying the cell to which the terminal is attached; and third length, which is the length of the second identification information.

[0036] In the above embodiments, the second key can be determined based on the first key, and at least one of the first identification information, the first count value, and the second identification information can be used as the input parameter for key derivation. Thus, the second key can be flexibly generated using different input parameters.

[0037] In conjunction with some embodiments of the first aspect, in some embodiments, the first identification information may be the cell radio network temporary identifier (C-RNTI) of the terminal in the cell to which the terminal is attached.

[0038] In conjunction with some embodiments of the first aspect, in some embodiments, the first count value may belong to a first count range; wherein the first count range is configured for one of: a CU in the access network device, or each DU in the access network device.

[0039] In conjunction with some embodiments of the first aspect, in some embodiments, the above method may further include: performing security key derivation for communication between the second node and the first node based on the second key, wherein the first node may be a terminal.

[0040] In the above embodiments, the second key can be used to implement secure key derivation for communication between the second node and the terminal. Thus, the second key can support the security of communication between the second node and the terminal.

[0041] In conjunction with some embodiments of the first aspect, in some embodiments, security key derivation may include media access control (MAC) layer security key derivation.

[0042] In the above embodiments, the second key can be used to implement MAC security key derivation. Thus, communication between the second node and the terminal at the MAC layer can be protected.

[0043] In conjunction with some embodiments of the first aspect, in some embodiments, the operation of performing security key derivation for communication between the second node and the first node based on the second key may include: determining the second key as the connectivity association key (CAK) in the MAC security key derivation.

[0044] In conjunction with some embodiments of the first aspect, in some embodiments, the connectivity key name (CKN) in the MAC security key derivation can be the terminal's C-RNTI.

[0045] In conjunction with some embodiments of the first aspect, in some embodiments, the operation of performing security key derivation for communication between the second node and the first node based on the second key may include: determining the second key as the master session key (MSK) in a quantum key distribution (QKD) mechanism; and determining CAK and CKN in MAC security key derivation based on the MSK.

[0046] In conjunction with some embodiments of the first aspect, in some embodiments, the above method may further include: sending a second key to a second node, wherein the first node is a CU in an access network device.

[0047] In a second aspect, embodiments of this disclosure provide a communication method. This method is executed by a second node. The method includes: receiving a second key sent by a first node, wherein the second key is determined based on a first key, the first key being used by an access network device, and the second key being used by the second node; wherein the first node is a CU (User Unit) in the access network device, and the second node is a DU (User Unit) in the access network device.

[0048] In the above embodiments, the first node can generate a second key for the second node based on a first key for the access network device. The second key can then be provided to the second node. In this case, the second key can provide security protection for one or more protocol layers located on the second node. This enables secure communication between the second node and the terminal at these one or more protocol layers. In particular, if the second node is a DU, communication at the protocol layers located on the DU can be protected by the second key.

[0049] In conjunction with some embodiments of the second aspect, in some embodiments, the first key can be used for communication security between the access network device and the terminal, and the second key can be used for communication security between the second node and the terminal.

[0050] In conjunction with some embodiments of the second aspect, in some embodiments, the second key may be determined based on the first key and according to the first parameter.

[0051] In conjunction with some embodiments of the second aspect, in some embodiments, the first parameter may include at least one of the following: first identification information for uniquely identifying the terminal in the access network device; first length, which is the length of the first identification information; first count value, which is the count value of the terminal moving across DUs in the access network device; second length, which is the length of the first count value; second identification information for identifying the cell to which the terminal is attached; and third length, which is the length of the second identification information.

[0052] In conjunction with some embodiments of the second aspect, in some embodiments, the first identification information may be the C-RNTI of the terminal in the cell to which the terminal is attached.

[0053] In conjunction with some embodiments of the second aspect, in some embodiments, the first count value may belong to a first count range; wherein the first count range is configured for one of: a CU in the access network device, or each DU in the access network device.

[0054] In conjunction with some embodiments of the second aspect, in some embodiments, the above method may further include: performing security key derivation for communication between the second node and the terminal based on the second key.

[0055] In conjunction with some embodiments of the second aspect, in some embodiments, security key derivation may include MAC security key derivation.

[0056] In conjunction with some embodiments of the second aspect, in some embodiments, the operation of performing security key derivation for communication between the second node and the terminal based on the second key may include: determining the second key as CAK in the MAC security key derivation.

[0057] In conjunction with some embodiments of the second aspect, in some embodiments, the CKN in the MAC security key derivation can be the terminal's C-RNTI.

[0058] In conjunction with some embodiments of the second aspect, in some embodiments, the operation of performing security key derivation for communication between the second node and the terminal based on the second key may include: determining the second key as MSK in the QKD mechanism; and determining CAK and CKN in the MAC security key derivation based on MSK.

[0059] In a third aspect, embodiments of this disclosure provide a communication device. The communication device is a first node. The communication device includes a processing module. The processing module is configured to: determine a second key based on a first key, wherein the first key is used for an access network device, and the second key is used for a second node; wherein the second node is a DU in the access network device.

[0060] In conjunction with some embodiments of the third aspect, in some embodiments, the first key can be used for communication security between the access network device and the terminal, and the second key can be used for communication security between the second node and the terminal.

[0061] In conjunction with some embodiments of the third aspect, in some embodiments, the processing module can be configured to: determine a second key based on a first key and a first parameter.

[0062] In conjunction with some embodiments of the third aspect, in some embodiments, the first parameter may include at least one of the following: first identification information for uniquely identifying the terminal in the access network device; first length, which is the length of the first identification information; first count value, which is the count value of the terminal moving across DUs in the access network device; second length, which is the length of the first count value; second identification information for identifying the cell to which the terminal is attached; and third length, which is the length of the second identification information.

[0063] In conjunction with some embodiments of the third aspect, in some embodiments, the first identification information may be the C-RNTI of the terminal in the cell to which the terminal is attached.

[0064] In conjunction with some embodiments of the third aspect, in some embodiments, the first count value may belong to a first count range; wherein the first count range is configured for one of: a CU in the access network device, or each DU in the access network device.

[0065] In conjunction with some embodiments of the third aspect, in some embodiments, the processing module may also be configured to: perform security key derivation for communication between the second node and the first node based on the second key, wherein the first node is a terminal.

[0066] In conjunction with some embodiments of the third aspect, in some embodiments, security key derivation includes MAC security key derivation.

[0067] In conjunction with some embodiments of the third aspect, in some embodiments, based on the second key, the processing module can be configured to: determine the second key as CAK in the MAC security key derivation.

[0068] In conjunction with some embodiments of the third aspect, in some embodiments, the CKN in the MAC security key derivation can be the terminal's C-RNTI.

[0069] In conjunction with some embodiments of the third aspect, in some embodiments, the processing module may be configured to: determine the second key as MSK in the QKD mechanism; and based on MSK, determine CAK and CKN in the MAC security key derivation.

[0070] In conjunction with some embodiments of the third aspect, in some embodiments, the above-described device may further include a transceiver module configured to send a second key to a second node, wherein the first node is a CU in the access network device.

[0071] In a fourth aspect, embodiments of this disclosure provide a communication device. The communication device is a second node. The communication device includes a transceiver module. The transceiver module is configured to receive a second key sent by a first node, wherein the second key is determined based on a first key, the first key being used in an access network device, and the second key being used in the second node; wherein the first node is a CU in the access network device, and the second node is a DU in the access network device.

[0072] In conjunction with some embodiments of the fourth aspect, in some embodiments, the first key can be used for communication security between the access network device and the terminal, and the second key can be used for communication security between the second node and the terminal.

[0073] In conjunction with some embodiments of the fourth aspect, in some embodiments, the second key may be determined based on the first key and according to the first parameter.

[0074] In conjunction with some embodiments of the fourth aspect, in some embodiments, the first parameter may include at least one of the following: first identification information for uniquely identifying the terminal in the access network device; first length, which is the length of the first identification information; first count value, which is the count value of the terminal moving across DUs in the access network device; second length, which is the length of the first count value; second identification information for identifying the cell to which the terminal is attached; and third length, which is the length of the second identification information.

[0075] In conjunction with some embodiments of the fourth aspect, in some embodiments, the first identification information may be the C-RNTI of the terminal in the cell to which the terminal is attached.

[0076] In conjunction with some embodiments of the fourth aspect, in some embodiments, the first count value may belong to a first count range; wherein the first count range is configured for one of: a CU in the access network device, or each DU in the access network device.

[0077] In conjunction with some embodiments of the fourth aspect, in some embodiments, the above-described device may further include a processing module configured to: perform security key derivation for communication between the second node and the terminal based on the second key.

[0078] In conjunction with some embodiments of the fourth aspect, in some embodiments, security key derivation may include MAC security key derivation.

[0079] In conjunction with some embodiments of the fourth aspect, in some embodiments, the processing module may be configured to: determine the second key as CAK in the MAC security key derivation.

[0080] In conjunction with some embodiments of the fourth aspect, in some embodiments, the CKN in the MAC security key derivation can be the terminal's C-RNTI.

[0081] In conjunction with some embodiments of the fourth aspect, in some embodiments, the processing module may be configured to: determine the second key as MSK in the QKD mechanism; and based on MSK, determine CAK and CKN in the MAC security key derivation.

[0082] In a fifth aspect, embodiments of this disclosure provide a communication device. This communication device is used to perform the communication methods described in any of the first, second, and possible embodiments thereof.

[0083] In a sixth aspect, embodiments of this disclosure provide a communication system. The communication system includes a first node and a second node. The first node is configured to perform the communication method as described in any of the first aspect and its possible embodiments. The second node is configured to perform the communication method as described in any of the second aspect and its possible embodiments.

[0084] In a seventh aspect, embodiments of this disclosure provide a storage medium storing instructions. When executed on a communication device, the instructions cause the communication device to perform the communication method as described in any of the first, second, and possible embodiments thereof.

[0085] In an eighth aspect, embodiments of this disclosure provide a program product. The program product includes at least one of a program and instructions. When executed by a communication device, the program or instructions implement the steps of the communication method as described in any of the first, second, and possible embodiments thereof.

[0086] In a ninth aspect, embodiments of this disclosure provide a computer program. When this computer program is run on a computer, it causes the computer to perform the communication methods described in any of the first, second, and possible implementations thereof.

[0087] In a tenth aspect, embodiments of this disclosure provide a chip or chip system. The chip or chip system includes processing circuitry. The processing circuitry is configured to perform the communication methods described in any of the first, second, and possible embodiments thereof.

[0088] It is understood that the aforementioned communication devices, communication systems, storage media, program products, computer programs, chips, and chip systems are all used to execute the methods provided in the embodiments of this disclosure. Therefore, the beneficial effects they can achieve can be referred to the beneficial effects in the corresponding methods, and will not be repeated here.

[0089] This disclosure provides a communication method, a communication device, a communication system, a storage medium, and a program product. In some embodiments, terms such as communication method, information processing method, and information transmission method can be used interchangeably; terms such as communication device, communication equipment, node, terminal, network device, network function, and network entity can be used interchangeably; and terms such as communication system and information processing system can be used interchangeably.

[0090] This disclosure is not exhaustive, but merely illustrative of some embodiments, and is not intended to limit the scope of protection of this disclosure. Unless otherwise specified, each step in a particular embodiment can be implemented as an independent embodiment, and the steps can be arbitrarily combined. For example, a solution after removing some steps in a particular embodiment can also be implemented as an independent embodiment, and the order of the steps in a particular embodiment can be arbitrarily interchanged. Furthermore, the optional implementation methods in a particular embodiment can be arbitrarily combined; moreover, the embodiments can be arbitrarily combined, for example, some or all steps of different embodiments can be arbitrarily combined, and a particular embodiment can be arbitrarily combined with the optional implementation methods of other embodiments.

[0091] In the embodiments disclosed herein, unless otherwise specified or in case of logical conflict, the terminology and / or descriptions of the various embodiments are consistent and can be referenced by each other. Technical features in different embodiments can be combined to form new embodiments based on their inherent logical relationships.

[0092] The terminology used in the embodiments of this disclosure is for the purpose of describing particular embodiments only and is not intended to limit the scope of this disclosure.

[0093] In the embodiments of this disclosure, unless otherwise stated, elements expressed in the singular form, such as “a,” “one,” “a kind,” “the,” “the,” “the,” “the,” “the,” “the,” “the,” “the,” “this,” etc., can mean “one and only one,” or “one or more,” “at least one,” etc. For example, when articles such as “a,” “an,” and “the” are used in translation, the noun following the article can be understood as either a singular or a plural expression.

[0094] In the embodiments of this disclosure, "a plurality of" means two or more.

[0095] In some embodiments, terms such as “at least one (at least one, at least one item, at least one)” and “one or more” may be used interchangeably.

[0096] In some embodiments, the notation "at least one of A and B", "A and / or B", "A in one case, B in another", "in response to one case A, in response to another case B", etc., may include the following technical solutions depending on the situation: in some embodiments, A (execute A regardless of B); in some embodiments, B (execute B regardless of A); in some embodiments, execution is selected from A and B (A and B are selectively executed); in some embodiments, A and B (both A and B are executed). The same applies when there are more branches such as A, B, C, etc.

[0097] In some embodiments, the notation "A or B" may include the following technical solutions, depending on the situation: in some embodiments, A (execution of A regardless of B); in some embodiments, B (execution of B regardless of A); in some embodiments, execution is selected from A and B (A and B are selectively executed). The same applies when there are more branches such as A, B, C, etc.

[0098] The prefixes "first," "second," etc., used in the embodiments of this disclosure are merely for distinguishing different descriptive objects and do not impose restrictions on the position, order, priority, quantity, or content of the descriptive objects. The description of the descriptive objects is found in the claims or the context of the embodiments, and the use of prefixes should not constitute unnecessary restrictions. For example, if the descriptive object is a "field," the ordinal numbers preceding "field" in "first field" and "second field" do not restrict the position or order of the "fields." "First" and "second" do not restrict whether the "fields" they modify are in the same message, nor do they restrict the order of "first field" and "second field." Similarly, if the descriptive object is a "level," the ordinal numbers preceding "level" in "first level" and "second level" do not restrict the priority between "levels." Furthermore, the number of descriptive objects is not limited by ordinal numbers and can be one or more. For example, in "first device," the number of "devices" can be one or more. Furthermore, the objects modified by different prefixes can be the same or different. For example, if the object being described is "device", then "first device" and "second device" can be the same device or different devices, and their types can be the same or different. As another example, if the object being described is "information", then "second information" and "first information" can be the same information or different information, and their content can be the same or different.

[0099] In some embodiments, “including A,” “containing A,” “for indicating A,” and “carrying A” can be interpreted as directly carrying A or indirectly indicating A.

[0100] In some embodiments, the terms “in response to…”, “in response to determining…”, “in the case of…”, “when…”, “if…”, “if…”, etc., can be used interchangeably.

[0101] In some embodiments, the terms "greater than", "more than", "higher than", and "exceeding" can be used interchangeably. In some embodiments, the terms "greater than or equal to", "not less than", "more than or equal to", "not less than", "higher than or equal to", "not lower than", and "above" can be used interchangeably. In some embodiments, the terms "less than", "less than", and "lower than" can be used interchangeably. In some embodiments, the terms "less than or equal to", "not greater than", "less than or equal to", "not more than", "lower than or equal to", "not higher than", and "below" can be used interchangeably.

[0102] In some embodiments, devices, etc., can be interpreted as physical or virtual, and their names are not limited to the names recorded in the embodiments. Terms such as “device”, “equipment”, “circuit”, “network element”, “node”, “function”, “unit”, “section”, “system”, “network”, “chip”, “chip system”, “entity”, and “subject” can be used interchangeably.

[0103] In some embodiments, "network" can be interpreted as devices included in a network (e.g., access network devices, core network devices, etc.).

[0104] In some embodiments, the terms "access network device (AN device)," "radio access network device (RAN device)," "base station (BS)," "radio base station," "fixed station," "node," "access point," "transmission point (TP)," "reception point (RP)," "transmission / reception point (TRP)," "panel," "antenna panel," "antenna array," "cell," "macro cell," "small cell," "femto cell," "pico cell," "sector," "cell group," "serving cell," "carrier," "component carrier," and "bandwidth part (BWP)" can be used interchangeably.

[0105] In some embodiments, the terms "terminal", "terminal device", "user equipment (UE)", "user terminal", "mobile station (MS)", "mobile terminal (MT)", "subscriber station", "mobile unit", "subscriber unit", "wireless unit", "remote unit", "mobile device", "wireless device", "wireless communication device", "remote device", "mobile subscriber station", "access terminal", "mobile terminal", "wireless terminal", "remote terminal", "handset", "user agent", "mobile client", and "client" can be used interchangeably.

[0106] In some embodiments, access network devices, core network devices, or network devices can be replaced by terminals. For example, embodiments of this disclosure can also be applied to structures where communication between access network devices, core network devices, or network devices and terminals is replaced by communication between multiple terminals (e.g., device-to-device (D2D), vehicle-to-everything (V2X), etc.). In this case, the structure can also be configured such that the terminal has all or part of the functions of the access network device. Furthermore, terms such as "uplink" and "downlink" can be replaced with terms corresponding to communication between terminals (e.g., "sidelink"). For example, uplink channel, downlink channel, etc., can be replaced with sidelink channel, and uplink link, downlink, etc., can be replaced with sidelink link.

[0107] In some embodiments, the terminal may be replaced by an access network device, a core network device, or a network device. In this case, the access network device, core network device, or network device may also be configured to have all or some of the functions of the terminal.

[0108] In some embodiments, the acquisition of data, information, etc., may comply with the laws and regulations of the country where the location is situated.

[0109] In some embodiments, data, information, etc., may be obtained with the user's consent.

[0110] Furthermore, each element, each row, or each column in the table of this disclosure can be implemented as an independent embodiment, and any combination of any element, any row, or any column can also be implemented as an independent embodiment.

[0111] Figure 1 is an exemplary schematic diagram of the architecture of a communication system provided according to an embodiment of the present disclosure. As shown in Figure 1, the communication system 100 includes a terminal 101 and an access network device 102.

[0112] In some embodiments, terminal 101 includes, but is not limited to, at least one of the following: mobile phone, wearable device, Internet of Things device, car with communication function, smart car, tablet computer, computer with wireless transceiver function, virtual reality (VR) terminal device, augmented reality (AR) terminal device, wireless terminal device in industrial control, wireless terminal device in self-driving, wireless terminal device in remote medical surgery, wireless terminal device in smart grid, wireless terminal device in transportation safety, wireless terminal device in smart city, and wireless terminal device in smart home.

[0113] In some embodiments, the access network device 102 is, for example, a node or device that connects the terminal 101 to a wireless network. In some embodiments, the access network device may include, but is not limited to, at least one of the following in a 5G communication system: evolved Node B (eNB), next-generation evolved Node B (ng-eNB), next-generation Node B (gNB), node B (NB), home node B (HNB), home evolved node B (HeNB), radio backhaul device, radio network controller (RNC), base station controller (BSC), base transceiver station (BTS), base band unit (BBU), mobile switching center, base station in a 6G communication system, open RAN, cloud RAN, base station in other communication systems, and access node in a Wi-Fi system.

[0114] In some embodiments, the technical solutions of this disclosure can be applied to Open Radio Access Network (Open RAN) architectures. In this case, the interfaces between or within access network devices involved in the embodiments of this disclosure can be transformed into internal interfaces of Open RAN. The processes and information interactions between these internal interfaces can be implemented by software or programs.

[0115] In some embodiments, the access network device 102 may include a first network element 1021 and a second network element 1022. In some embodiments, the first network element 1021 may be a central unit (CU) 1021. In some embodiments, the second network element 1022 may be a distributed unit (DU) 1022. In some embodiments, the CU may also be called a control unit. By adopting a CU-DU structure, the protocol layer of the access network device can be separated, with some protocol layer functions centrally controlled by the CU, and the remaining part or all of the protocol layer functions distributed in the DU, which is centrally controlled by the CU, but this is not limited to this.

[0116] It is understood that the communication system described in this disclosure is for the purpose of more clearly illustrating the technical solutions of this disclosure, and does not constitute a limitation on the technical solutions proposed in this disclosure. As those skilled in the art will know, with the evolution of system architecture and the emergence of new business scenarios, the technical solutions proposed in this disclosure are also applicable to similar technical problems.

[0117] The following embodiments of this disclosure can be applied to the communication system 100 shown in FIG1, or to some of the main bodies, but are not limited thereto. The main bodies shown in FIG1 are illustrative. The communication system may include all or some of the main bodies in FIG1, or may include other main bodies outside of FIG1. ​​The number and form of each main body are arbitrary. Each main body may be physical or virtual. The connection relationship between the main bodies is illustrative. The main bodies may not be connected or may be connected. The connection can be in any way, it can be a direct connection or an indirect connection, it can be a wired connection or a wireless connection.

[0118] The embodiments disclosed herein can be applied to Long Term Evolution (LTE), LTE-Advanced (LTE-A), LTE-Beyond (LTE-B), SUPER 3G, IMT-Advanced, 4th generation mobile communication system (4G), 5th generation mobile communication system (5G), 5G New Radio (NR), Future Radio Access (FRA), New-Radio Access Technology (RAT), New Radio (NR), New Radio access (NX), Future generation radio access (FX), Global System for Mobile communications (GSM), CDMA2000, Ultra Mobile Broadband (UMB), IEEE 802.11 (Wi-Fi), IEEE 802.16 (WiMAX), and IEEE 802.20, Ultra-Wideband (UWB), Bluetooth (a registered trademark), Public Land Mobile Network (PLMN) networks, Device-to-Device (D2D) systems, Machine-to-Machine (M2M) systems, Internet of Things (IoT) systems, Vehicle-to-Everything (V2X) systems, systems utilizing other communication methods, and next-generation systems built upon them, etc. Furthermore, multiple systems can be combined (e.g., a combination of LTE or LTE-A with 5G).

[0119] With the rapid development of communication technologies, in order to overcome the explosive increase in traffic usage, communication systems such as 5G are using higher frequency bands than previous communication systems (e.g., LTE). Due to the inverse relationship between frequency and cell coverage, coverage becomes a challenge. Typically, for mobile users, smaller coverage cells lead to more frequent handovers, which can negatively impact experience quality without proper management. If the number of cells managed by each individual base station (e.g., gNB) can be increased, more handovers can be handled through intra-gNB mobility. Intra-gNB mobility has a significantly smaller impact compared to inter-gNB mobility because the anchor points of the equipment are the same. By separating this function from the DU and centralizing it in the CU, the number of cells managed by each CU can be increased, thus maximizing the ratio between intra-gNB and inter-gNB handovers.

[0120] Meanwhile, higher frequency bands also allow for the use of carriers with greater bandwidth, and gNBs therefore require significantly more traffic processing capacity than eNBs in LTE. When dual connectivity is widely used in 5G networks, devices can connect to two different gNBs, but only one of the two gNBs (the anchor DU) is responsible for processing the separated data streams (via the packet data convergence protocol, PDCP). Therefore, the PDCP load is concentrated on the PDCP anchor DU, leading to load imbalance and inefficient resource utilization between the PDCP anchor DU (overused) and non-anchor DUs (underused). To improve this load imbalance, PDCP aggregation needs to be off-loaded to CUs in a more centralized location, where pooling or resource sharing can efficiently handle the tasks.

[0121] In some embodiments, in the deployment of communication systems such as 5G, gNBs with an internal structure divided into CU and DU parts can provide better service. The CU and DU can be connected via a new interface called F1.

[0122] Figure 2A is an exemplary schematic diagram of the NG-RAN architecture. As shown in Figure 2A, in a 5G network, the 5G core network (5GC) can connect to the NG-RAN via the NG interface. The NG-RAN can include a series of gNBs. These gNBs are connected to the 5GC via the NG interface. In the NG-RAN, gNBs can be connected to each other via the Xn interface. In some embodiments, a gNB can include a gNB-CU (i.e., CU) and one or more gNB-DUs (i.e., DU). The gNB-CU and gNB-DU can be connected to each other via the F1 interface. In some embodiments, a gNB-DU can only be connected to one gNB-CU.

[0123] Figure 2B is an exemplary schematic diagram of a scenario employing a CU-DU separation architecture. As shown in Figure 2B, the AMF and UPF can be located in the core network, and the gNB can be located in the access network. The AMF and gNB can communicate in the control plane via the NG interface (e.g., NG-C). The UPF and gNB can communicate in the user plane via the NG interface (e.g., NG-U). The gNB can be divided into gNB-CU and gNB-DU. The gNB-CU can connect to multiple gNB-DUs via the F1 interface.

[0124] In some embodiments, the functionality of the gNB is separated into gNB-CU and gNB-DU. Some functions of the gNB can be implemented by gNB-CU, and some functions of the gNB can be implemented by gNB-DU. It is understood that there may or may not be overlap between the functions of gNB-CU and gNB-DU.

[0125] In some embodiments, the protocol stack defined in the RAN may include multiple layers. In some embodiments, the protocol stack may include, from top to bottom, the following layers: radio resource control (RRC) layer, PDCP layer, radio link control (RLC) layer, MAC layer, physical (PHY) layer, and radio frequency (RF) layer.

[0126] In some embodiments, the functional split between the CU and DU can take several forms. In one example, the RRC can be located in the CU, while the PDCP, RLC, MAC, physical layer, and RF can be located in the DU. This approach is similar to the 1A architecture in dual-connectivity and can therefore be called 1A-type split. In another example, the RRC and PDCP can be located in the CU, while the RLC, MAC, physical layer, and RF can be located in the DU. This approach is similar to the 3C architecture in dual-connectivity and can therefore be called 3C-type split. In another example, the low RLC (i.e., part of the RLC functionality), MAC, physical layer, and RF can be located in the DU, while the PDCP and high RLC (i.e., the remaining RLC functionality) can be located in the CU. This approach can be called RLC-MAC split. In another example, the MAC, physical layer, and RF can be located in the DU, while the PDCP and RLC can be located in the CU. This approach can be called MAC-MAC split. In yet another example, the RF, physical layer, and a portion of the MAC layer (e.g., HARQ) can be located in the DU, while the remaining portions of the PDCP, RLC, and MAC layer can be located in the CU. This approach can be called MAC-internal split. In one example, the physical layer and RF can be located in the DU, while PDCP, RLC, and MAC can be located in the CU. This approach can be called MAC-PHY separation. In another example, a portion of the physical layer functionality and RF can be located in the DU, while PDCP, RLC, MAC, and other parts of the physical layer functionality can be located in the CU. This approach can be called intra-PHY separation. In yet another example, the RF functionality is located in the DU, while PDCP, RLC, MAC, and the physical layer can be located in the CU. This approach can be called PHY-RF separation.

[0127] Figure 2C is an exemplary schematic diagram of a CU-DU separation architecture. As shown in Figure 2C, the gNB-CU and gNB-DU can be separated in a 3C-type manner. In this case, RRC and PDCP can be located in the gNB-CU, while RLC, MAC, physical layer, and RF can be located in the gNB-DU.

[0128] In some embodiments, within the RAN security architecture, access stratum (AS) security terminates at and is handled by the PDCP layer of the gNB. In most decoupled configurations, since only the CU portion of the gNB supports the PDCP layer, AS security can only terminate at the CU portion, making the DU portion transparent to security protection. That is, protocol layers supported by the DU portion, such as RLC, MAC, and physical layer, are irrelevant to security-related processing.

[0129] In some embodiments, for layer 1 / layer 2 triggered mobility (LTM), media access control control element (MAC CE) messages can be used to carry security-related parameters. MAC CE messages carry radio-related information but are not protected. The protection of MAC CE messages, especially when carrying security-related information, is an important and unavoidable issue.

[0130] In some embodiments, one function of the DU portion of the gNB is to support lower layers in the protocol stack. It is understood that lower and higher layers (or lower and upper layers) can be relative. In some embodiments, one or more layers implemented in the DU portion of the protocol stack can be referred to as lower layers, and one or more layers implemented in the CU portion can be referred to as higher layers. For example, in a Class 1A separation approach, higher layers may include RRC, and lower layers may include PDCP, RLC, MAC, physical layer, and RF. For example, in a Class 3C separation approach, higher layers may include RRC and PDCP, and lower layers may include RLC, MAC, physical layer, and RF. For example, in an RLC-MAC separation approach, higher layers may include RRC, PDCP, and RLC, and lower layers may include MAC, physical layer, and RF.

[0131] In some embodiments, when a gNB supports higher-level security in the CU and lower-level security in the DU, the correlation between higher-level and lower-level security within a single gNB needs to be considered. For example, when a gNB supports PDCP layer security in the CU and MAC layer security in the DU, the correlation between PDCP layer security and MAC layer security within a single gNB needs to be considered.

[0132] Therefore, how to achieve low-level security in DU is an urgent problem to be solved.

[0133] Here, important concepts and terms involved in the embodiments of this disclosure are explained.

[0134] 1. Key hierarchy

[0135] The key hierarchy in a 5G system consists of multiple keys. These keys can be used for authentication, encryption, and integrity protection.

[0136] Figure 3A is an exemplary schematic diagram of key hierarchy generation in a 5G system. As shown in Figure 3A, the key hierarchy may include multiple keys, such as K AUSF K SEAF KAMF K N3IWF K NASint K NASenc K gNB K RRCint K RRCenc K UPint and K UPenc These keys are involved in authentication, non-access stratum (NAS) signaling protection, access stratum (AS) signaling protection, and user plane traffic protection. The arrows in the diagram indicate the direction of key generation. For example, based on K... AUSF K can be deduced SEAF For example, based on K SEAF K can be deduced AMF For example, based on K AMF K can be deduced N3IWF K NASint K NASenc K gNB For example, based on K gNB K can be deduced RRCint K RRCenc K UPint K UPenc .

[0137] In some embodiments, K serves as a key for NG-RAN. gNB It is composed of mobile entity (ME) and AMF from K AMF The derived key. In some embodiments, K gNB It can be further derived from ME and source gNB.

[0138] In some embodiments, K serves as a key for user plane traffic. UPenc It is from K by ME and gNB gNB The derived key. In one example, K UPenc It can be used to protect user plane traffic that uses specific encryption algorithms.

[0139] In some embodiments, K serves as a key for user plane traffic. UPint It is from K by ME and gNB gNB The derived key. In one example, K UPint It can be used to protect user plane traffic between ME and gNB using specific integrity algorithms.

[0140] In some embodiments, K serves as the key for RRC signaling. RRCint It is from K by ME and gNB gNB The derived key. In one example, KRRCint It can be used to protect RRC signaling that uses a specific integrity algorithm.

[0141] In some embodiments, K serves as the key for RRC signaling. RRCenc It is from K by ME and gNB gNB The derived key. In one example, K RRCenc It can be used solely for the protection of RRC signaling that uses a specific encryption algorithm.

[0142] K gNB K RRCint K RRCenc K UPint and K UPenc These are parameters for AS security processed at the PDCP layer. K RRCint and K RRCenc It is the key used to protect RRC messages on the control plane. K UPint and K UPenc It is a key used to protect Service Data Adaptation Protocol (SDAP) messages and / or Session Description Protocol (SDP) messages on the user plane. RRC messages and SDAP / SDP messages are both messages that run above the PDCP layer, therefore their security can be handled at the PDCP layer.

[0143] 2. MAC Security (MACsec)

[0144] MAC security is a secure communication method used to ensure the security protection between devices on an Ethernet link. MAC security can be based on IEEE 802.1AE and IEEE 802.1X standards. MAC security provides functions such as data encryption, integrity checks, and replay protection.

[0145] MAC security operates at the data link layer, which is the Ethernet MAC layer, and is used for end-to-end links between the interfaces of two devices, such as the gNB-DU and UE. The gNB-DU and UE can use MAC security keys to encrypt and decrypt data packets. The MACsec key agreement (MKA) provides key negotiation, as well as the establishment and management of secure channels. A long-lived connectivity association key (CAK) along with its corresponding connectivity association key name (CKN) is configured on the device.

[0146] Figure 3B is an exemplary schematic diagram of the MAC security key derivation hierarchy. As shown in Figure 3B, based on CAK and CKN, a secure association key (SAK), a key encryption key (KEK), and an integrity check key (ICK) can be obtained. In some embodiments, CAK can be used to generate a short-lived SAK to protect data transferred between devices. Data encryption is performed based on the SAK. The SAK can be updated regularly based on the number of data packets sent to make communication more secure. MAC security can not only encrypt data but also provide integrity through an integrity check value (ICV). ICV is a cryptographic digest function that depends on the data and the SAK.

[0147] 3. Quantum Key Distribution (QKD)

[0148] Quantum key distribution (QKD) is a secure communication protocol based on the principles of quantum mechanics. QKD allows two users to create and share a secure key over an insecure communication channel. This key can then be used to encrypt and decrypt information to ensure the confidentiality of the communication.

[0149] Figure 3C is an exemplary schematic diagram of a MAC security key derivation hierarchy based on the QKD mechanism. As shown in Figure 3C, user 1 and user 2 can distribute keys through the QKD mechanism. In some embodiments, the QKD between user 1 and user 2 can be implemented using continuous variable (CV) QKD protocol, discrete variable (DV) QKD protocol, satellite QKD, etc. The key distributed to user 1 and user 2 through QKD can serve as the MSK in MAC security. Based on the MSK, other keys can be obtained through key derivation functions (KDF), such as CAK and CKN in MAC security, and further ICK, SAK, KEK, etc.

[0150] In some embodiments, the KDF used for key derivation in Figure 3C may conform to the NIST 800-108 standard, formally known as "Recommendation for Key Derivation Using Pseudorandom Functions," which provides technical specifications for deriving additional key material from a secret key using pseudorandom functions. These KDFs can be used to derive additional keys from an established cryptographic key.

[0151] It is understood that the KDF used in the MAC security key derivation hierarchy can also be other KDFs, and this disclosure does not specifically limit this.

[0152] Figure 4 is an exemplary interactive schematic diagram of the communication method provided according to an embodiment of the present disclosure. The communication method involved in the embodiment of the present disclosure can be applied to the communication system 100. As shown in Figure 4, the communication method of the embodiment of the present disclosure includes steps S401 to S406.

[0153] In some embodiments, the present disclosure may involve a terminal 101, a first network element 1021, and a second network element 1022. The first network element 1021 may be, for example, a CU. The second network element 1022 may be, for example, a DU.

[0154] In step S401, the first network element 1021 determines the second key.

[0155] In some embodiments, the first network element 1021 may determine the second key based on the first key.

[0156] In some embodiments, the first key may be a key for access network device 102. In some embodiments, the first key may support the security of communication between access network device 102 and terminal 101. In some embodiments, the first key may be a key for first network element 1021. In some embodiments, the first key may support the security of communication between first network element 1021 and terminal 101.

[0157] In some embodiments, the first key can be used for the security of upper-layer communication, and the second key can be used for the security of lower-layer communication.

[0158] In some embodiments, the first network element 1021 may include RRC, and the second network element 1022 may include PDCP, RLC, MAC, physical layer, and RF. In one example, the first key may be used for the security of RRC. In one example, the second key may be used for the security of at least one of PDCP, RLC, and MAC.

[0159] In some embodiments, the first network element 1021 may include RRC and PDCP, and the second network element 1022 may include RLC, MAC, physical layer, and RF. In one example, the first key may be used for the security of at least one of RRC and PDCP. In one example, the second key may be used for the security of at least one of RLC and MAC.

[0160] In some embodiments, the first network element 1021 may include PDCP and high RLC, and the second network element 1022 may include low RLC, MAC, physical layer, and RF. In one example, the first key may be used for the security of at least one of PDCP and high RLC. In one example, the second key may be used for the security of at least one of low RLC and MAC.

[0161] In some embodiments, the first network element 1021 may include PDCP and RLC, and the second network element 1022 may include MAC, physical layer, and RF. In one example, the first key may be used for the security of at least one of PDCP and RLC. In one example, the second key may be used for the security of MAC.

[0162] In some embodiments, the access network device 102 may be a gNB, and the first key may be a K gNB In one example, the first key could be a 256-bit K. gNB It is understandable that access network device 102 can be other types of access network devices, such as an eNB. In this case, the first key can be K. eNB .

[0163] In some embodiments, the first key may be obtained by the first network element 1021 from other network elements. For example, the first network element 1021 may receive a first key sent by another network element. In some embodiments, the first network element 1021 may be an access and mobility management function (AMF). For example, the first key may be obtained by the AMF based on K. AMF This can be deduced.

[0164] Figure 5 is an exemplary schematic diagram generated according to the key hierarchy structure provided in the embodiments of this disclosure. As shown in Figure 5, the second key for the second network element 1022 may include K. DU K DU It can be a key for the DU in access network device 102. DU It can be based on K gNB It was deduced.

[0165] In some embodiments, a first key can be input into the KDF. The KDF can derive a second key based on the input first key.

[0166] In some embodiments, step S401 may include: the first network element 1021 determining a second key based on a first key and according to a first parameter. In some embodiments, the second key may be derived from the first key and according to the first parameter.

[0167] In some embodiments, the first parameter can be used as input to the KDF. The KDF can derive the second key based on the input first key and the first parameter.

[0168] In some embodiments, the first parameter may include at least one of the following: first identification information, first length, first count value, second length, second identification information, and third length. It should be noted that the first parameter may also include other information, which is not specifically limited in this embodiment.

[0169] In some embodiments, the first identification information can be used to uniquely identify the terminal 101 in the access network device 102. In some embodiments, the first identification information can be used to identify the terminal 101 in the access network device 102. In some embodiments, the first identification information can be used to identify the terminal 101 in the first network element 1021.

[0170] In some embodiments, the first identification information corresponding to each terminal 101 in the access network device 102 may be unique. In some embodiments, different terminals 101 in the access network device 102 may correspond to different first identification information.

[0171] In some embodiments, the first identification information may include a C-RNTI. The C-RNTI may be an identifier used to uniquely identify terminal 101 within a cell. In some embodiments, the C-RNTI may be valid for terminal 101 in a connected state.

[0172] In some embodiments, the first identification information may be shared between the terminal 101 and the access network device 102.

[0173] In some embodiments, the first identification information may be assigned by the first network element 1021. In some embodiments, the C-RNTI may be assigned to the terminal 101 by the second network element 1022 during the initial access process of the terminal 101.

[0174] In some embodiments, the first identification information may be allocated by the second network element 1022. In some embodiments, the C-RNTI may be allocated to the terminal 101 by the first network element 1021 during the UE context establishment process.

[0175] In some embodiments, the first identification information may be transmitted via an E1 interface or an F1 interface.

[0176] In some embodiments, the first length may be the length of the first identification information.

[0177] In some embodiments, the first length may be the number of bits occupied by the first identification information.

[0178] In some embodiments, the first count value may be the count value of the terminal 101 moving across DUs in the access network device 102.

[0179] In some embodiments, terminal 101 may migrate between DUs in access network device 102. For example, terminal 101 may initially access one DU of access network device 102. For example, terminal 101 may move from one DU of access network device 102 to another DU. Such cross-DU movement causes a change in a first count value. For example, the first count value may change each time a cross-DU movement occurs.

[0180] In some embodiments, the first count value may be a positive integer.

[0181] In some embodiments, the first count value may also be referred to as the DU counter.

[0182] In some embodiments, the first count value may belong to a first count range. In some embodiments, the first count range may be determined based on the configuration of the second network element 1022 in the access network device 102. In some embodiments, the first count range may be determined based on the configuration of the second network element 1022 in the first network element 1021.

[0183] In some embodiments, the first counting range may also be referred to as the counter pool.

[0184] In some embodiments, the first counting range may be configured for the first network element 1021. In some embodiments, all second network elements 1022 under the first network element 1021 may share the first counting range. In one example, the first counting range may be an integer from 1 to N1, where N1 is a positive integer.

[0185] In some embodiments, the first counting range can be configured for the second network element 1022. In some embodiments, each second network element 1022 under the first network element 1021 can adopt an independent first counting range. In some embodiments, under the first network element 1021, different second network elements 1022 can have the same or different first counting ranges. For example, all second network elements 1022 under the first network element 1021 can have the same first counting range. For example, the first counting range of all second network elements 1022 can be an integer from 1 to N2, where N2 is a positive integer. In some embodiments, at least two second network elements 1022 under the first network element 1021 can have different first counting ranges. For example, the first counting range of one second network element 1022 can be an integer from 1 to N2, and the first counting range of another second network element 1022 can be an integer from 1 to N3, where N3 is a positive integer and N3 is not equal to N2.

[0186] In some embodiments, as terminal 101 moves between DUs in access network device 102, the first count value may change sequentially. In one example, the first count value may be incremented by 1 each time terminal 101 moves from one DU to another. In another example, the first count value may be decremented by 1 each time terminal 101 moves from one DU to another.

[0187] In some embodiments, as terminal 101 moves between DUs in access network device 102, the first count value can be determined by random generation. In one example, the first count value can be randomly generated whenever terminal 101 moves from one DU to another.

[0188] In some embodiments, the same first count value is not reused as the terminal 101 moves. In some embodiments, the terminal 101 may leave a DU and return to the DU after one or more moves. In this case, the first count value determined for the DU on two separate occasions is different. In some embodiments, the first count value determined for different DUs is different.

[0189] In some embodiments, the first count value may be determined by the first network element 1021.

[0190] In some embodiments, the second length may be the length of the first count value.

[0191] In some embodiments, the second length may be the number of bits occupied by the first count value.

[0192] In some embodiments, the second identification information may be used to identify the cell to which the terminal 101 is attached.

[0193] In some embodiments, the second identification information may be used to identify the target cell to which the terminal 101 will attach during the handover process.

[0194] In some embodiments, the first network element 1021 can connect to one or more second network elements 1022, and each second network element 1022 can have one or more cells. Each cell can be identified by identification information. In some embodiments, the terminal 101 can reside in a cell. In other words, the terminal 101 can be attached to a cell. The cell to which the terminal 101 is attached can be identified by second identification information.

[0195] In some embodiments, the second identification information may include the cell ID of the cell to which the terminal 101 is attached.

[0196] In some embodiments, the second identification information may include the cell identifier of the target cell to which the terminal 101 will attach during the handover process.

[0197] In some embodiments, the third length may be the length of the second identification information.

[0198] In some embodiments, the third length may be the number of bits occupied by the second identification information.

[0199] In some embodiments, the first parameter may include first identification information. In some embodiments, the first network element 1021 may determine a second key based on the first key and the first identification information. In one example, the first network element 1021 may input the first key and the first identification information into the KDF to deduce the second key.

[0200] In some embodiments, the first parameter may include first identification information and a first length. In some embodiments, the first network element 1021 may determine a second key based on the first key, the first identification information, and the first length. In one example, the first network element 1021 may input the first key, the first identification information, and the first length into the KDF to derive the second key.

[0201] In some embodiments, the first parameter may include a first count value. In some embodiments, the first network element 1021 may determine a second key based on the first key and the first count value. In one example, the first network element 1021 may input the first key and the first count value into the KDF to derive the second key.

[0202] In some embodiments, the first parameter may include a first count value and a second length. In some embodiments, the first network element 1021 may determine a second key based on a first key, the first count value, and the second length. In one example, the first network element 1021 may input the first key, the first count value, and the second length into the KDF to derive the second key.

[0203] In some embodiments, the first parameter may include second identification information. In some embodiments, the first network element 1021 may determine the second key based on the first key and the second identification information. In one example, the first network element 1021 may input the first key and the second identification information into the KDF to derive the second key.

[0204] In some embodiments, the first parameter may include second identification information and a third length. In some embodiments, the first network element 1021 may determine the second key based on the first key, the second identification information, and the third length. In one example, the first network element 1021 may input the first key, the second identification information, and the third length into the KDF to derive the second key.

[0205] In some embodiments, the first parameter may include first identification information and a first count value. In some embodiments, the first network element 1021 may determine a second key based on the first key, the first identification information, and the first count value. In one example, the first network element 1021 may input the first key, the first identification information, and the first count value into the KDF to derive the second key.

[0206] In some embodiments, the first parameter may include first identification information, a first length, a first count value, and a second length. In some embodiments, the first network element 1021 may determine a second key based on the first key, the first identification information, the first length, the first count value, and the second length. In one example, the first network element 1021 may input the first key, the first identification information, the first length, the first count value, and the second length into the KDF to derive the second key.

[0207] In some embodiments, the first parameter may include a first count value and second identification information. In some embodiments, the first network element 1021 may determine a second key based on a first key, the first count value, and the second identification information. In one example, the first network element 1021 may input the first key, the first count value, and the second identification information into the KDF to derive the second key.

[0208] In some embodiments, the first parameter may include a first count value, a second length, second identification information, and a third length. In some embodiments, the first network element 1021 may determine a second key based on a first key, according to the first count value, the second length, the second identification information, and the third length. In one example, the first network element 1021 may input the first key, the first count value, the second length, the second identification information, and the third length into the KDF to derive the second key.

[0209] In some embodiments, the first parameter may include first identification information and second identification information. In some embodiments, the first network element 1021 may determine the second key based on the first key, the first identification information, and the second identification information. In one example, the first network element 1021 may input the first key, the first identification information, and the second identification information into the KDF to derive the second key.

[0210] In some embodiments, the first parameter may include first identification information, a first length, second identification information, and a third length. In some embodiments, the first network element 1021 may determine a second key based on the first key, according to the first identification information, the first length, the second identification information, and the third length. In one example, the first network element 1021 may input the first key, the first identification information, the first length, the second identification information, and the third length into the KDF to derive the second key.

[0211] In some embodiments, when terminal 101 first accesses the network, the first network element 1021 can determine the second key based on the first key. In this case, step S401 can be executed.

[0212] In some embodiments, during each inter-base station handover or intra-base station handover, once the first key is refreshed, the first network element 1021 can determine the second key again based on the first key. In this case, step S401 can be executed.

[0213] In step S402, the first network element 1021 sends the second key to the second network element 1022.

[0214] In some embodiments, the first network element 1021 may send a second key. In some embodiments, the second key may be sent by the first network element 1021, but is not limited thereto, and may also be sent by other entities.

[0215] In some embodiments, the second network element 1022 may receive the second key. In some embodiments, the second key may be received by the second network element 1022, but is not limited thereto, and may also be received by other entities.

[0216] In some embodiments, through step S402, the first network element 1021 can distribute the derived second key to the second network element 1022.

[0217] In some embodiments, each time the first network element 1021 derives the second key, the first network element 1021 can send the obtained second key to the second network element 1022.

[0218] In some embodiments, the second network element 1022 may store a second key.

[0219] In step S403, the second network element 1022 performs security key derivation.

[0220] In some embodiments, the second network element 1022 may perform security key derivation based on the second key.

[0221] In some embodiments, security key derivation can be used to achieve secure communication between the second network element 1022 and the terminal 101. In some embodiments, one or more of PDCP, RLC, MAC, physical layer, and RF can be deployed on the second network element 1022. Security key derivation can be for at least one of PDCP, RLC, and MAC. In one example, a second key can be used for security key derivation for PDCP. In one example, a second key can be used for security key derivation for RLC. In one example, a second key can be used for security key derivation for MAC.

[0222] In some embodiments, PDCP can be deployed on the first network element 1021, and MAC can be deployed on the second network element 1022. In one example, a first key can support the security of PDCP. In one example, a second key can support the security of MAC.

[0223] In some embodiments, the security key derivation for communication between the second network element 1022 and the terminal 101 may include MAC security key derivation.

[0224] In some embodiments, the operation of the second network element 1022 performing MAC security key derivation may include determining the CAK and CKN in the MAC security key derivation. Thus, the determined CAK and CKN can be used to ensure the security of the MAC layer.

[0225] In some embodiments, the second network element 1022 can determine the second key as CAK. In other words, the first key provided by the first network element 1021 to the second network element 1022 can be directly used as CAK in the MAC security key derivation.

[0226] In some embodiments, the second network element 1022 can determine the first identification information as CKN. It is understood that the first identification information can be used as a parameter in the second key derivation process, meaning that the second key and the first identification information can be associated. Therefore, the first identification information can be used as the CKN associated with CAK.

[0227] In some embodiments, the second network element 1022 can identify C-RNTI as CKN.

[0228] In some embodiments, the second network element 1022 can determine the second key as the MSK in the QKD mechanism, and determine the CAK and CKN based on the MSK. In some embodiments, the second network element 1022 can support QKD-based KDF. In this case, the second key can be used as the MSK in the QKD mechanism. Based on the MSK, the second network element 1022 can dynamically generate the CAK and CKN using KDF.

[0229] In some embodiments, the second network element 1022 may use a QKD-supporting KDF during the process of determining CAK and CKN using the QKD mechanism. For example, the KDF used by the second network element 1022 may be a KDF conforming to the NIST 800-108 standard.

[0230] In some embodiments, whenever the second network element 1022 receives a new second key, the second network element 1022 can determine a new key for security key derivation based on the new second key. This ensures that the key in the security key derivation is updated, avoiding conflicts caused by the new second key and the old second key.

[0231] In step S404, the first network element 1021 sends the first information to the terminal 101.

[0232] In some embodiments, the first network element 1021 can send first information. In some embodiments, the first information can be sent by the first network element 1021, but is not limited to this, and can also be sent by other entities.

[0233] In some embodiments, terminal 101 may receive first information. In some embodiments, the first information may be received by terminal 101, but is not limited thereto, and may also be received by other entities.

[0234] In some embodiments, the first information may be used to trigger terminal 101 to perform a derivation of the second key. In some embodiments, the first information may be used to instruct terminal 101 to determine the second key and perform a security key derivation.

[0235] In some embodiments, the first information may include a first count value. In some embodiments, the first information may carry the first count value. Thus, the first network element 1021 can inform the terminal 101 of the first count value.

[0236] In some embodiments, the first information may be carried in a radio resource control (RRC) message.

[0237] In step S405, terminal 101 determines the second key.

[0238] The optional implementation of step S405 can be found in the optional implementation of step S401 in Figure 4, as well as other related parts in the embodiments involved in Figure 4, which will not be repeated here.

[0239] In some embodiments, terminal 101 may determine a second key based on first information. In some embodiments, terminal 101 may determine the second key triggered by the first information.

[0240] It is understandable that the method by which terminal 101 determines the second key can be the same as the method by which the first network element 1021 determines the second key, and will not be elaborated here.

[0241] In step S406, terminal 101 performs security key derivation.

[0242] The optional implementation of step S406 can be found in the optional implementation of step S402 in Figure 4, as well as other related parts in the embodiments involved in Figure 4, which will not be repeated here.

[0243] In some embodiments, terminal 101 may perform security key derivation based on the second key.

[0244] It is understandable that the way terminal 101 performs security key deduction and the way the second network element 1022 performs security key deduction can be the same, and will not be elaborated here.

[0245] The communication method of this embodiment can be implemented through steps S401 to S406.

[0246] In some embodiments, the names of information, etc., are not limited to the names described in the embodiments. Terms such as "information", "message", "signal", "signaling", "report", "configuration", "indication", "instruction", "command", "channel", "parameter", "domain", "field", "symbol", "symbol", "codebook", "codeword", "codepoint", "bit", "data", "program", and "chip" can be used interchangeably.

[0247] In some embodiments, the terms “radio”, “wireless”, “radio access network (RAN)”, “access network (AN)”, and “RAN-based” can be used interchangeably.

[0248] In some embodiments, “get,” “obtain,” “receive,” “transmit,” “bidirectional transmission,” and “send and / or receive” can be used interchangeably and can be interpreted as receiving from other entities, obtaining from protocols, obtaining from higher layers, obtaining through self-processing, or autonomous implementation, among other meanings.

[0249] In some embodiments, terms such as “send,” “transmit,” “report,” “distribute,” “transmit,” “bidirectional transmission,” “send and / or receive” can be used interchangeably.

[0250] In some embodiments, terms such as "certain", "preset", "default", "set", "indicated", "a certain", "any", and "first" can be used interchangeably. "Certain A", "preset A", "default A", "set A", "indicated A", "a certain A", "any A", and "first A" can be interpreted as A pre-defined in a protocol or the like, or as A obtained through setting, configuration, or instruction, or as specific A, a certain A, any A, or first A, but are not limited thereto.

[0251] In some embodiments, if the arrows in the interaction diagram representing the sending of information, signaling, etc., from one subject to another pass through other subjects, it can be interpreted as the information being forwarded from one subject to another via other subjects, or it can be interpreted as the information being sent from one subject to another without passing through other subjects. For example, in step S404, the first information can be sent directly to the terminal 101 by the first network element 1021, or it can be sent to the terminal 101 by the first network element 1021 through the second network element 1022.

[0252] In some embodiments, terms such as “derivation,” “inference,” and “derive” can be used interchangeably.

[0253] The communication method involved in the embodiments of this disclosure may include at least one of steps S401 to S406. For example, step S401 may be implemented as a standalone embodiment. For example, step S402 may be implemented as a standalone embodiment. For example, step S403 may be implemented as a standalone embodiment. For example, step S405 may be implemented as a standalone embodiment. For example, step S406 may be implemented as a standalone embodiment. For example, a combination of steps S401 and S402 may be implemented as a standalone embodiment. For example, a combination of steps S402 and S403 may be implemented as a standalone embodiment. For example, a combination of steps S405 and S406 may be implemented as a standalone embodiment. For example, a combination of steps S401, S402, and S403 may be implemented as a standalone embodiment. It should be noted that the possible standalone embodiments consisting of one or more steps in steps S401 and S406 are not limited thereto.

[0254] In some embodiments, at least two steps in steps S401 to S406 may be executed simultaneously or in a different order. For example, steps S401 and S404 may be executed simultaneously or in a different order. For example, steps S402 and S404 may be executed simultaneously or in a different order. For example, steps S401 and S405 may be executed simultaneously or in a different order. For example, steps S403 and S406 may be executed simultaneously or in a different order.

[0255] In some embodiments, steps S402, S403, S404, S405, and S406 are optional, and one or more of these steps may be omitted or substituted in different embodiments. In some embodiments, steps S401, S402, S404, S405, and S406 are optional, and one or more of these steps may be omitted or substituted in different embodiments. In some embodiments, steps S401, S402, S403, S404, and S406 are optional, and one or more of these steps may be omitted or substituted in different embodiments.

[0256] In some embodiments, the steps and their optional implementations in other embodiments described before or after this embodiment, as well as other related parts in the specification, can be referred to, and will not be repeated here.

[0257] Figure 6 is an exemplary interaction diagram of a communication method provided according to an embodiment of the present disclosure. This disclosure relates to a communication method. As shown in Figure 6, the method includes steps S601 and S602.

[0258] In step S601, the first node determines the second key.

[0259] In some embodiments, the first node may be a first network element 1021. For example, the first node may be a CU in the access network device 102.

[0260] In some embodiments, the first node may be terminal 101.

[0261] In some embodiments, the first node may determine the second key based on the first key.

[0262] In some embodiments, when the first node is terminal 101, the first node can also perform security key derivation based on the second key.

[0263] In step S602, the first node sends the second key to the second node.

[0264] In some embodiments, the second node may be a second network element 1022. For example, the second node may be a DU in the access network device 102.

[0265] In some embodiments, the steps and their optional implementations in other embodiments described before or after this embodiment, as well as other related parts in the specification, can be referred to, and will not be repeated here.

[0266] In the following, the technical solutions of the embodiments of this disclosure will be described by way of specific implementation.

[0267] The main objective of this disclosure is to enable the PDCP layer of the gNB-CU (i.e., the first network element) to support key derivation for the security of the MAC layer in the gNB-DU (i.e., the second network element).

[0268] In some embodiments, the derivation of the root key used for MAC security is explained.

[0269] In some embodiments, the RAN key used for AS security processing at the PDCP layer of the gNB is part of the existing 5GS key hierarchy.

[0270] In some embodiments, for NG-RAN, K gNB It is from K by ME and AMF AMF The derived key. In some embodiments, when performing horizontal or vertical key derivation, K gNB It is further derived from ME and source gNB.

[0271] In some embodiments, for user plane (UP) traffic, K UPenc It is from K by ME and gNB gNB The derived key is used only to protect UP traffic using a specific encryption algorithm; K UPint It is from K by ME and gNB gNB The derived key is used only to protect UP traffic between the ME and gNB using a specific integrity algorithm.

[0272] In some embodiments, for RRC signaling, K RRCint It is from K by ME and gNB gNB The derived key is used only to protect RRC signaling using a specific integrity algorithm; K RRCenc It is from K by ME and gNB gNB The derived key is used only to protect RRC signaling using a specific encryption algorithm.

[0273] In some embodiments, K gNB K UPenc K UPint K RRCint K RRCenc These are parameters for AS security processed at the PDCP layer. K RRCint and K RRCenc It is the key used to protect control plane RRC messages, and K UPenc and K UPint This is a key used to protect user plane SDAP / SDP messages. Both RRC and SDAP / SDP messages are messages above the PDCP layer; therefore, their security can be handled at the PDCP layer. However, PDCP layer security cannot protect lower layers, including the MAC layer. To support MAC layer security, embodiments of this disclosure propose a root key, which is derived from K... gNB Derived from and used by gNB-DU for MAC security (e.g., known as K... DU The key hierarchy is stored in gNB-DU. Therefore, a new key hierarchy can be obtained in gNB and ME.

[0274] In the new hierarchical structure, K gNB K UPencK UPint K RRCint K RRCenc All are generated by gNB-CU and stored in gNB-CU. K DU Generated by gNB-CU, distributed to gNB-DU, and stored in gNB-DU. From K in gNB and ME. gNB Derivation of K DU When the following parameters can be used as input S of KDF:

[0275] -FC = TBD (to be continued, pending);

[0276] -P0 = RAN UE ID (e.g., C-RNTI);

[0277] -L0 = P0 length.

[0278] In some embodiments, P0 can be any RAN UE ID (i.e., first identification information) shared between the UE and gNB, such as a C-RNTI assigned to the UE by the gNB-DU during initial access or by the gNB-CU during UE context establishment, which can be transmitted via the E1 and F1 interfaces. The RAN UE ID is unique within the gNB. Regardless of when the RAN UE ID is refreshed, K... DU Then refresh as well.

[0279] In some embodiments, the input key is a 256-bit K gNB .

[0280] In some embodiments, during each inter-gNB or intra-gNB handover, once K gNB Refreshed, from the refreshed K gNB Similarly, regenerate K. DU This ensures that the key refresh in gNB-DU is synchronized with the key refresh in gNB-CU.

[0281] In some embodiments, the long-term CAK and corresponding CKN based on MAC security (MACsec) need to be pre-configured in both devices or derived from the MSK. However, pre-configuring the CAK and CKN between each specific UE and gNB-DU is virtually impossible for operators. In cases where MAC security is used by both the gNB-DU and UE, embodiments of this disclosure propose that both the gNB-DU and UE will use the CAK and CKN. DU Used as a long-term static CAK. Because C-RNTI is used as K. DU The derived input, which means each K DUIt is associated with C-RNTI. Therefore, C-RNTI can be used as the CKN associated with CAK. In this way, the operator does not need to pre-configure CAK and CKN in each of the UE and gNB-DU.

[0282] In some embodiments, due to K DU Dedicated to each gNB-DU, the UE can use K DU Each specific gNB-DU has its own independent MAC layer security, thus ensuring security isolation between different gNB-DUs at the MAC layer. Once a new K is generated by the gNB-DU... DU And after sending it to the gNB-DU, the MAC security key also needs to be regenerated. This ensures the MAC security key is refreshed to avoid issues caused by compatibility with the old key. DU This conflict leads to MAC security issues.

[0283] In some embodiments, from K in gNB and ME gNB Derivation of K DU At that time, P0 can be a counter (i.e., the first count value). For each K DU Based on this deduction, the counter can be allocated by the gNB-CU and passed to the UE in the RRC message.

[0284] In some embodiments, from K in gNB and ME gNB Derivation of K DU When the following parameters can be used as input S of KDF:

[0285] -FC = TBD;

[0286] -P0 = the value of the DU counter (a non-negative integer);

[0287] -L0 = P0 length.

[0288] In some embodiments, the configuration of the DU counter pool can be based on the configuration of gNB-DUs in gNB-CU. The DU counter pool can be for each gNB-DU (e.g., the counter pool for each gNB-DU is 1 to n), or it can be for each gNB-CU (e.g., the counter pool for all gNB-DUs under the same gNB-CU is 1 to n).

[0289] In some embodiments, when used as K DUDuring the deduced refresh input, the DU counter is used sequentially as the UE moves to each specific gNB-DU. In this mode, if the UE moves back and forth for the same gNB-DU, the DU counter value input will not be reused in the case of a single gNB-DU under the same gNB-CU or across gNB-DUs.

[0290] In some embodiments, to derive the MAC security key, where the gNB-DU and UE support QKD-based KDF, K DU It can also be used as an MSK for gNB-DU and UE to dynamically generate CAK and CKN.

[0291] In some embodiments, from K in gNB and ME gNB Derivation of K DU When the following parameters can be used as input S of KDF:

[0292] -FC = TBD;

[0293] -P1 = Community ID;

[0294] -L1 = length of P1.

[0295] In the embodiments disclosed herein, some or all of the steps and their optional implementations may be arbitrarily combined with some or all of the steps in other embodiments, or may be arbitrarily combined with the optional implementations in other embodiments.

[0296] This disclosure also proposes an apparatus (also referred to as a communication device, etc.) for implementing any of the above methods. For example, this disclosure proposes an apparatus including units or modules for implementing the steps performed by the terminal in any of the above methods. For example, this disclosure proposes another apparatus including units or modules for implementing the steps performed by a network device (e.g., an access network device, a core network functional node, a core network device, etc.) in any of the above methods.

[0297] It should be understood that the division of units or modules in the above device is only a logical functional division. In actual implementation, they can be fully or partially integrated into a single physical entity, or they can be physically separated. Furthermore, the units or modules in the device can be implemented by a processor calling software: for example, the device includes a processor connected to a memory containing instructions. The processor calls the instructions stored in the memory to implement any of the above methods or to implement the functions of the units or modules in the above device. The processor can be, for example, a general-purpose processor, such as a Central Processing Unit (CPU) or a microprocessor, and the memory can be internal or external to the device. Alternatively, the units or modules in the device can be implemented in the form of hardware circuits. The functionality of some or all of the units or modules can be achieved through the design of these hardware circuits, which can be understood as one or more processors. For example, in one implementation, the hardware circuit is an application-specific integrated circuit (ASIC). The functionality of some or all of the units or modules is achieved through the design of the logical relationships between the components within the circuit. In another implementation, the hardware circuit can be implemented using a programmable logic device (PLD). Taking a field-programmable gate array (FPGA) as an example, it can include a large number of logic gates. The connection relationships between the logic gates are configured through configuration files, thereby achieving the functionality of some or all of the units or modules. All units or modules of the above device can be implemented entirely through processor-called software, entirely through hardware circuits, or partially through processor-called software with the remaining parts implemented through hardware circuits.

[0298] In this embodiment, the processor is a circuit with signal processing capabilities. In one implementation, the processor can be a circuit with instruction read and execute capabilities, such as a central processing unit, microprocessor, graphics processing unit (GPU) (which can be understood as a type of microprocessor), or digital signal processor (DSP). In another implementation, the processor can implement certain functions through the logical relationships of hardware circuits. The logical relationships of the aforementioned hardware circuits are fixed or reconfigurable. For example, the processor is a hardware circuit implemented by an application-specific integrated circuit (ASIC) or a programmable logic device, such as an FPGA. In a reconfigurable hardware circuit, the process of the processor loading a configuration document and configuring the hardware circuit can be understood as the process of the processor loading instructions to implement the functions of some or all of the above units or modules. Furthermore, it can also be a hardware circuit designed for artificial intelligence, which can be understood as an ASIC, such as a neural network processing unit (NPU), tensor processing unit (TPU), deep learning processing unit (DPU), etc.

[0299] Figure 7 is an exemplary schematic diagram of a communication device provided according to an embodiment of the present disclosure. As shown in Figure 7, the communication device 700 may include at least one of the following: a transceiver module 701 and a processing module 702.

[0300] In some embodiments, the communication device 700 may be a first node. In some embodiments, the processing module 702 may be configured to: determine a second key based on a first key, wherein the first key is used for the access network device and the second key is used for the second node; wherein the second node is a DU in the access network device. Optionally, the transceiver module 701 may be configured to perform at least one of the communication steps such as sending and / or receiving performed by the first node in any of the above methods (e.g., steps S402, S404, but not limited thereto), which will not be elaborated here. Optionally, the processing module 702 may be configured to perform at least one of the other steps performed by the first node in any of the above methods besides the communication steps such as sending and receiving (e.g., steps S401, S405, S406, but not limited thereto).

[0301] In some embodiments, the communication device 700 may be a second node. In some embodiments, the transceiver module 701 may be configured to: receive a second key sent by a first node, wherein the second key is determined based on a first key, the first key is used for the access network device, and the second key is used for the second node; wherein the first node is a CU in the access network device, and the second node is a DU in the access network device. Optionally, the transceiver module 701 may be configured to perform at least one of the communication steps such as sending and / or receiving performed by the second node in any of the above methods (e.g., step S402, but not limited thereto), which will not be elaborated here. Optionally, the processing module 702 may be configured to perform at least one of the other steps performed by the second node in any of the above methods besides the communication steps such as sending and receiving (e.g., step S703, but not limited thereto).

[0302] In some embodiments, the transceiver module may include a transmitting module and / or a receiving module. The transmitting and receiving modules may be separate or integrated. Optionally, the transceiver module may be interchangeable with a transceiver.

[0303] In some embodiments, the processing module may be a single module or may include multiple sub-modules. Optionally, the multiple sub-modules may each perform all or part of the steps required by the processing module. Optionally, the processing module may be interchangeable with a processor.

[0304] Figure 8A is a schematic diagram of the structure of a communication device provided according to an embodiment of the present disclosure. The communication device 8100 can be a network device (e.g., access network device, core network device, etc.), a terminal (e.g., user equipment, etc.), a chip, chip system, or processor that supports the network device in implementing any of the above methods, or a chip, chip system, or processor that supports the terminal in implementing any of the above methods. The communication device 8100 can be used to implement the methods described in the above method embodiments; for details, please refer to the descriptions in the above method embodiments.

[0305] As shown in Figure 8A, the communication device 8100 includes one or more processors 8101. The processor 8101 can be a general-purpose processor or a dedicated processor, such as a baseband processor or a central processing unit (CPU). The baseband processor can be used to process communication protocols and communication data, while the CPU can be used to control the communication device (e.g., base station, baseband chip, terminal device, terminal device chip, DU or CU, etc.), execute programs, and process program data. Optionally, the communication device 8100 can be used to execute any of the above methods. Optionally, one or more processors 8101 can be used to invoke instructions to cause the communication device 8100 to execute any of the above methods.

[0306] In some embodiments, the communication device 8100 further includes one or more transceivers 8102. When the communication device 8100 includes one or more transceivers 8102, the transceiver 8102 performs at least one of the communication steps such as sending and / or receiving in the above method (e.g., steps S402, S404, but not limited thereto), and the processor 8101 performs at least one of other steps (e.g., steps S401, S403, S405, S406, but not limited thereto). In optional embodiments, the transceiver may include a receiver and / or a transmitter, which may be separate or integrated together. Optionally, the terms transceiver, transceiver unit, transceiver, transceiver circuit, interface circuit, interface, etc., can be used interchangeably; the terms transmitter, transmitting unit, transmitter, transmitting circuit, etc., can be used interchangeably; and the terms receiver, receiving unit, receiver, receiving circuit, etc., can be used interchangeably.

[0307] In some embodiments, the communication device 8100 further includes one or more memories 8103 for storing data. Optionally, all or part of the memories 8103 may be located outside the communication device 8100. In an optional embodiment, the communication device 8100 may include one or more interface circuits 8104. Optionally, the interface circuits 8104 are connected to the memories 8103 and can be used to receive data from the memories 8103 or other devices, and to send data to the memories 8103 or other devices. For example, the interface circuits 8104 can read data stored in the memories 8103 and send that data to the processor 8101.

[0308] The communication device 8100 described in the above embodiments may be a network device or a terminal, but the scope of the communication device 8100 described in this disclosure is not limited thereto, and the structure of the communication device 8100 may not be limited by FIG8A. The communication device may be a standalone device or may be part of a larger device. For example, the communication device may be: (1) a standalone integrated circuit IC, or chip, or chip system or subsystem; (2) a collection of one or more ICs, optionally, the IC collection may also include storage components for storing data and programs; (3) an ASIC, such as a modem; (4) a module that can be embedded in other devices; (5) a receiver, terminal device, smart terminal device, cellular phone, wireless device, handheld device, mobile unit, vehicle device, network device, cloud device, artificial intelligence device, etc.; (6) others, etc.

[0309] Figure 8B is a schematic diagram of the structure of a chip provided according to an embodiment of the present disclosure. For cases where the communication device 8100 can be a chip or a chip system, please refer to the schematic diagram of the chip 8200 shown in Figure 8B, but it is not limited thereto.

[0310] Chip 8200 includes one or more processors 8201. Chip 8200 is used to perform any of the methods described above.

[0311] In some embodiments, chip 8200 further includes one or more interface circuits 8202. Optionally, terms such as interface circuit, interface, and transceiver pin can be used interchangeably. In some embodiments, chip 8200 further includes one or more memories 8203 for storing data. Optionally, all or part of the memories 8203 may be located outside of chip 8200. Optionally, interface circuit 8202 is connected to memory 8203, and interface circuit 8202 can be used to receive data from memory 8203 or other devices, and interface circuit 8202 can be used to send data to memory 8203 or other devices. For example, interface circuit 8202 can read data stored in memory 8203 and send the data to processor 8201.

[0312] In some embodiments, the interface circuit 8202 performs at least one of the communication steps such as sending and / or receiving in the above method (e.g., steps S402, S404, but not limited thereto). For example, the interface circuit 8202 performing the communication steps such as sending and / or receiving in the above method means that the interface circuit 8202 performs data interaction between the processor 8201, the chip 8200, the memory 8203, or the transceiver device. In some embodiments, the processor 8201 performs at least one of other steps (e.g., steps S401, S403, S405, S406, but not limited thereto).

[0313] The modules and / or devices described in the various embodiments, such as virtual devices, physical devices, and chips, can be combined or separated arbitrarily as needed. Optionally, some or all steps can also be performed collaboratively by multiple modules and / or devices, which is not limited here.

[0314] This disclosure also proposes a storage medium storing instructions that, when executed on a communication device 8100, cause the communication device 8100 to perform any of the methods described above. Optionally, the storage medium is an electronic storage medium. Optionally, the storage medium is a computer-readable storage medium, but not limited thereto; it may also be a storage medium readable by other devices. Optionally, the storage medium may be a non-transitory storage medium, but not limited thereto; it may also be a temporary storage medium.

[0315] This disclosure also proposes a storage medium storing instructions that, when executed on a communication device 8100, cause the communication device 8100 to perform any of the methods described above. Optionally, the storage medium is an electronic storage medium. Optionally, the storage medium is a computer-readable storage medium, but not limited thereto; it may also be a storage medium readable by other devices. Optionally, the storage medium may be a non-transitory storage medium, but not limited thereto; it may also be a temporary storage medium.

[0316] This disclosure also proposes a program product that, when executed by a communication device 8100, causes the communication device 8100 to perform any of the above methods. Optionally, the program product is a computer program product.

[0317] This disclosure also proposes a computer program that, when run on a computer, causes the computer to perform any of the above methods.

[0318] Other embodiments of the invention will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This disclosure is intended to cover any variations, uses, or adaptations of the invention that follow the general principles of the invention and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only.

[0319] It should be understood that the present invention is not limited to the precise structure described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of the invention is limited only by the appended claims.

Claims

1. A communication method, executed by a first node, wherein, The method includes: Based on the first key, a second key is determined, wherein the first key is used for the access network device and the second key is used for the second node; The second node is the distribution unit (DU) in the access network device.

2. The method according to claim 1, wherein, The first key is used for communication security between the access network device and the terminal, and the second key is used for communication security between the second node and the terminal.

3. The method according to claim 1 or 2, wherein, The process of determining the second key based on the first key includes: The second key is determined based on the first key and the first parameter.

4. The method according to claim 3, wherein, The first parameter includes at least one of the following: The first identification information is used to uniquely identify the terminal in the access network device; The first length is the length of the first identification information; The first count value is the count value of the terminal moving across DU in the access network equipment; The second length is the length of the first count value; The second identification information is used to identify the cell to which the terminal is attached; The third length is the length of the second identification information.

5. The method according to claim 4, wherein, The first identification information is the cell radio network temporary identifier (C-RNTI) of the terminal within the cell to which the terminal is attached.

6. The method according to claim 4, wherein, The first count value belongs to the first count range; The first counting range is configured for one of the following: the central unit (CU) in the access network device, or each DU in the access network device.

7. The method according to any one of claims 1 to 6, wherein, The method further includes: Based on the second key, a security key derivation is performed for communication between the second node and the first node, wherein the first node is a terminal.

8. The method according to claim 7, wherein, The security key derivation includes Media Access Control (MAC) security key derivation.

9. The method according to claim 8, wherein, The step of performing security key derivation for communication between the second node and the first node based on the second key includes: The second key is determined to be the connectivity association key CAK in the MAC security key derivation.

10. The method according to claim 9, wherein, The connectivity association key name CKN in the MAC security key derivation is the C-RNTI of the terminal.

11. The method according to claim 8, wherein, The step of performing security key derivation for communication between the second node and the first node based on the second key includes: The second key is determined as the master session key MSK in the quantum key distribution (QKD) mechanism; Based on the MSK, determine CAK and CKN in the MAC security key derivation.

12. The method according to any one of claims 1 to 6, wherein, The method further includes: The second key is sent to the second node, wherein the first node is the CU in the access network device.

13. A communication method, executed by a second node, wherein, The method includes: Receive a second key sent by the first node, wherein the second key is determined based on the first key, the first key is used for the access network device, and the second key is used for the second node; Wherein, the first node is the centralized unit (CU) in the access network device, and the second node is the distributed unit (DU) in the access network device.

14. The method according to claim 13, wherein, The first key is used for communication security between the access network device and the terminal, and the second key is used for communication security between the second node and the terminal.

15. The method according to claim 13 or 14, wherein, The second key is determined based on the first key and according to the first parameter.

16. The method according to claim 15, wherein, The first parameter includes at least one of the following: The first identification information is used to uniquely identify the terminal in the access network device; The first length is the length of the first identification information; The first count value is the count value of the terminal moving across DU in the access network equipment; The second length is the length of the first count value; The second identification information is used to identify the cell to which the terminal is attached; The third length is the length of the second identification information.

17. The method according to claim 16, wherein, The first identification information is the cell radio network temporary identifier (C-RNTI) of the terminal within the cell to which the terminal is attached.

18. The method according to claim 16, wherein, The first count value belongs to the first count range; The first counting range is configured for one of the following: the central unit (CU) in the access network device, or each DU in the access network device.

19. The method according to any one of claims 13 to 18, wherein, The method further includes; Based on the second key, security key derivation is performed for communication between the second node and the terminal.

20. The method according to claim 19, wherein, The security key derivation for communication between the second node and the terminal includes the Media Access Control (MAC) security key derivation.

21. The method according to claim 20, wherein, The step of performing security key derivation for communication between the second node and the terminal based on the second key includes: The second key is determined to be the connectivity association key CAK in the MAC security key derivation.

22. The method according to claim 21, wherein, The connectivity association key name CKN in the MAC security key derivation is the C-RNTI of the terminal.

23. The method of claim 20, wherein, The step of performing security key derivation for communication between the second node and the terminal based on the second key includes: The second key is determined as the master session key MSK in the quantum key distribution (QKD) mechanism; Based on the MSK, determine CAK and CKN in the MAC security key derivation.

24. A communication device, characterized in that, The communication device is used to perform the communication method as described in any one of claims 1 to 12, 13 to 23.

25. A communication system, characterized in that, It includes a first node and a second node, wherein the first node is configured to implement the communication method as described in any one of claims 1 to 12, and the second node is configured to implement the communication method as described in any one of claims 13 to 23.

26. A storage medium storing instructions, characterized in that, When the instruction is executed on the communication device, the communication device performs the communication method as described in any one of claims 1 to 12, 13 to 23.

27. A program product comprising at least one of a program and instructions, characterized in that, When at least one of the programs or instructions is executed by the communication device, it implements the steps of the communication method as described in any one of claims 1 to 23.

Images