WO2022252969A1

WO2022252969A1 - Communication method and apparatus

Info

Publication number: WO2022252969A1
Application number: PCT/CN2022/092844
Authority: WO
Inventors: 许斌; 李秉肇
Original assignee: 华为技术有限公司
Priority date: 2021-05-31
Filing date: 2022-05-13
Publication date: 2022-12-08
Also published as: CN115484552A

Abstract

The present application provides a communication method and apparatus. The method comprises: a first access network device receives security information of a multicast and broadcast service (MBS), and generates an MBS key according to the security information; the first access network device performs security processing on data of the MBS on the basis of the generated MBS key and then sends said data to a terminal device, wherein the security processing comprises at least one of encryption and integrity protection. In the embodiments of the present application, an access network device may generate an MBS key on the basis of security information of an MBS from a core network device, and implement security processing on data of the MBS on the basis of the MBS key, thereby improving the security of multicast and broadcast transmission.

Description

A communication method and device

Cross References to Related Applications

This application claims the priority of a Chinese patent application with application number 202110602607.7 and application title "A Communication Method and Device" submitted to the China Patent Office on May 31, 2021, the entire contents of which are incorporated in this application by reference.

technical field

The present application relates to the technical field of communication, and in particular to a communication method and device.

Background technique

Multicast broadcast service/multicast broadcast service (MBS) is a service for multiple terminal devices, such as live broadcast service, public safety service, batch software update service, etc. The MBS comes from the data server. First, the data server sends the MBS data to the core network device, then the core network device sends the MBS data to the access network device, and finally the access network device sends the MBS data to the At least one terminal device receiving the MBS. At present, when an access network device performs multicast transmission, it does not consider the security processing of the multicast data transmission, which leads to low security of the multicast data transmission process and potential safety hazards.

Contents of the invention

The present application provides a communication method and device for improving the security of multicast data during transmission.

In a first aspect, the present application provides a communication method, and the execution body of the method may be a first access network device, or may be a chip or a circuit. Taking the first access network device as an example, the method includes: the first access network device receives security information of the MBS, and generates an MBS key according to the security information. The first access network device performs security processing on the MBS data based on the generated MBS key, and then sends it to the terminal device. The security processing includes at least one of the following processing: encryption and integrity protection. In the embodiment of the present application, the access network device can generate an MBS key based on the security information of the MBS from the core network device, and implement secure processing of the MBS data based on the MBS key, thereby improving the security of multicast broadcast transmission .

In a possible design, when the first access network device generates the MBS key according to the security information, it may specifically generate the MBS key according to the security information and at least one of the following items: the single frequency network (SFN) of the first access network device capabilities, and the SFN status of the first access network device. In the above design, the SFN mechanism of the access network device is considered when generating the MBS key, so that the SFN mechanism of the access network device side may not be affected.

In a possible design, when the first access network device generates the MBS key according to the SFN capability of the first access network device, at least one item of the SFN status of the first access network device, and security information, it may specifically satisfy In the first condition, the MBS key is generated according to the security information and the first information or the MBS key is generated according to the security information, and the first information includes at least one of the following items: the SFN area identifier where the first access network device is located, the tracking area identifier, The paging area identifier of the access network, the first condition includes that the SFN capability is supported and/or the SFN state is enabled. When the second condition is met, the MBS key is generated according to the security information and the second information, and the second information includes at least one of the following items: the identifier of the first access network device, the physical cell identifier of the first access network device, the first For the frequency information of the cell of the access network device, the second condition includes that the SFN capability is not supported and/or the SFN state is off.

If the first access network device does not support the SFN function or the SFN function is not enabled (that is, the SFN status is off), the cell signals under the first access network device do not need to be combined with the cell signals of other access network devices. When the first access network device generates the MBS key, it only needs to update the MBS key of the first access network device when updating the MBS key by using the relevant information of the access network device (that is, the second information). keys, which can improve security and reduce the overhead of key updates.

If the first access network device supports the SFN function or the SFN function is enabled (that is, the SFN status is enabled), the cell signals under the first access network device may need to be combined with the cell signals of other access network devices, so different The data sent by the access network device must be exactly the same, and the MBS key used for security processing must also be the same. In the above design, when the first access network device generates the MBS key, it inputs the relevant information of the SFN (that is, the first Information) can ensure that all access network devices or all cells in the same SFN area use the same MBS key.

In a possible design, the MBS key may include at least one of the following: a first key and a second key. When performing secure processing on the MBS data based on the MBS key, specifically, the above data may be encrypted based on the first key, and the integrity protection of the above data may be performed based on the second key. Security processing such as encryption and integrity protection of MBS data can be realized through the above design.

In a possible design, the security information may include at least one of the following information: MBS group key, Temporary Mobile Group Identity (TMGI), key update parameters, and security algorithm identifier.

In a possible design, the security algorithm may include at least one of the following: a first security algorithm and a second security algorithm, wherein the first security algorithm is used for encryption and decryption, and the second security algorithm is used for integrity protection and integrity verify. In the above design, encryption processing and integrity protection processing adopt different algorithms to improve the security of MBS transmission.

In a possible design, the TMGI is an MBS session identifier, an MBS service identifier or an Internet Protocol (IP) multicast address of the MBS.

In a possible design, the first access network device may also send first indication information and/or second indication information to the terminal device, where the first indication information is used to indicate the SFN capability of the first access network device, and the second indication information is used to indicate the SFN capability of the first access network device, and the second indication information The indication information is used to indicate the SFN state of the first access network device. Through the above design, the terminal device can obtain the SFN mechanism of the first access network device according to the first indication information and the second indication information, so as to generate the MBS key by itself.

In a possible design, the first access network device may also send first indication information and/or second indication information to the terminal device, where the first indication information is used to indicate that the SFN capability of the first access network device is supported, The second indication information is used to indicate that the SFN state of the first access network device is enabled. Through the above design, the terminal device can obtain the SFN mechanism of the first access network device according to the first indication information and the second indication information, so as to generate the MBS key by itself. At this time, it can be understood that when the SFN capability of the first access network device is not supported, the first access network device may not send the indication information, that is, when the first access network device does not send the indication information indicating the SFN capability , the terminal device considers that the SFN capability of the access network device is not supported. Similarly, when the SFN state of the first access network device is not enabled (closed), the first access network device may not send indication information, that is, when the first access network device does not send indication information indicating the SFN state , the terminal device considers that the SFN capability of the access network device is not supported. Signaling overhead can be further saved.

In a possible design, the first access network device may send the MBS key to the terminal device after generating the MBS key. Through the above design, the terminal device receiving the MBS can use the received MBS key to perform secure processing on the data of the MBS.

In a possible design, for a terminal device handed over from the second access network device to the first access network device, the first access network device may send the MBS key to the terminal device through the second access network device. Through the above design, the terminal device switching to the first access network device can obtain the MBS key of the first access network device during the switching process, so that after switching to the first access network device, it can obtain the MBS key according to the MBS key Securely handle MBS data.

In a possible design, if the terminal device stops receiving the MBS, the MBS key can also be updated. Through the above design, the security of MBS transmission can be improved. It can be understood that the access network device can detect whether the terminal device stops receiving the MBS, and update the MBS key according to the detection result.

In a possible design, if the SFN state of the first access network device changes, the MBS key may be updated. Through the above design, the SFN mechanism on the access network device side is not affected, and the key update overhead can also be reduced.

In a second aspect, the present application provides a communication method, and the execution subject of the method may be a terminal device, or may be a chip or a circuit. Taking the terminal device as an example, the method includes: the terminal device obtains the MBS key; the terminal device receives the data of the MBS, and performs security processing on the data based on the obtained MBS key, and the security processing includes at least one of the following processes: decryption, integrity verify. In the embodiment of the present application, the terminal device can acquire the MBS key, and based on the MBS key, securely process the data of the MBS, thereby improving the security of multicast broadcast transmission.

In a possible design, when the terminal device obtains the MBS key, it may specifically receive the security information of the MBS, and generate the MBS key according to the security information. In the above design, the terminal device can generate the MBS key based on the security information of the MBS sent by the core network device.

In a possible design, when the terminal device generates the MBS key according to the security information, it may specifically: obtain the first indication information and/or the second indication information, the first indication information is used to indicate the SFN capability of the first access network device , the second indication information is used to indicate the SFN state of the first access network device; an MBS key is generated according to at least one indication information and security information in the first indication information and the second indication information. In the above design, the terminal device considers the SFN mechanism of the access network device when generating the MBS key, so that the SFN mechanism of the access network device side may not be affected.

In a possible design, when the terminal device generates the MBS key according to the security information, it may also: obtain the first indication information and/or the second indication information, the first indication information is used to indicate the SFN capability of the first access network device To support, the second indication information is used to indicate that the SFN state of the first access network device is enabled. Through the above design, the terminal device can obtain the SFN mechanism of the first access network device according to the first indication information and the second indication information, so as to generate the MBS key by itself. At this time, it can be understood that when the SFN capability of the first access network device is not supported, the first access network device may not send the indication information, that is, when the first access network device does not send the indication information indicating the SFN capability , the terminal device considers that the SFN capability of the access network device is not supported. Similarly, when the SFN state of the first access network device is not enabled (closed), the first access network device may not send indication information, that is, when the first access network device does not send indication information indicating the SFN state , the terminal device considers that the SFN capability of the access network device is not supported. Signaling overhead can be further saved.

In a possible design, when the terminal device generates the MBS key according to at least one of the first indication information and the second indication information and security information, it may specifically: when the first condition is met, according to the security information and the first information Generate an MBS key or generate an MBS key according to security information. The first information includes at least one of the following items: the SFN area identifier where the first access network device is located, the tracking area identifier, and the access network paging area identifier. The first condition is The first indication information indicates that the SFN function of the first access network device is supported and/or the second indication information indicates that the SFN status of the first access network device is enabled; or, when the second condition is met, according to the security information and the second The information generates an MBS key, and the second information includes at least one of the following items: the identifier of the first access network device, the physical cell identifier of the first access network device, the frequency information of the cell of the first access network device, and the second condition The first indication information indicates that the SFN capability of the first access network device is not supported and/or the second indication information indicates that the SFN state of the first access network device is off.

If the first access network device supports the SFN function or the SFN function is enabled (that is, the SFN status is enabled), the cell signals under the first access network device may need to be combined with the cell signals of other access network devices, so different The data sent by the access network device must be identical, and the MBS key used for security processing must also be the same. In the above design, when the terminal device generates the MBS key, it can ensure that All access network devices or all cells in the same SFN area use the same MBS key.

In a possible design, the MBS key may include at least one of the following: a first key and a second key; when performing secure processing on the MBS data based on the MBS key, it may specifically be: based on the first The key encrypts the above data, and the above data is integrity protected based on the second key. Security processing such as encryption and integrity protection of MBS data can be realized through the above design.

In a possible design, the terminal device acquires the MBS key. Specifically, it may: receive the MBS key from the first access network device, and the MBS key is generated based on MBS security information.

In a possible design, the terminal device acquires the MBS key, which may specifically: receive the MBS key forwarded by the first access network device through the second access network device.

In a third aspect, the embodiment of the present application provides a communications apparatus that can implement the method implemented by the first access network device in the first aspect or any possible design thereof. The apparatus comprises corresponding units or components for performing the method described above. The units included in the device may be implemented by software and/or hardware. The apparatus may be, for example, the first access network device, or a component or a baseband chip, a chip system, or a processor that can support the implementation of the above method in the first access network device.

Exemplarily, the communication device may include modular components such as a transceiver unit (or a communication module, a transceiver module) and a processing unit (or a processing module), and these modules may implement the above-mentioned first aspect or any possible design thereof Corresponding functions of the first access network device. When the communication device is the first access network device, the transceiver unit may be a transmitter and a receiver, or a transceiver obtained by integrating a transmitter and a receiver. The transceiver unit may include an antenna and a radio frequency circuit, etc., and the processing unit may be a processor, such as a baseband chip. When the communication device is a component having the function of the first access network device, the transceiver unit may be a radio frequency unit, and the processing unit may be a processor. When the communication device is a system-on-a-chip, the transceiver unit may be an input-output interface of the system-on-a-chip, and the processing unit may be a processor of the system-on-a-chip, such as a central processing unit (CPU).

The transceiver unit may be configured to perform the receiving and/or sending action performed by the first access network device in the first aspect or any possible design thereof. The processing unit may be used to perform actions other than receiving and sending performed by the first access network device in the first aspect or any possible design thereof, such as generating an MBS key according to the security information of the MBS, and pairing the MBS with the MBS key. Data is processed securely, etc.

In a fourth aspect, the embodiment of the present application provides a communication device that can implement the method implemented by the terminal device in the above second aspect or any possible design thereof. The apparatus comprises corresponding units or components for performing the method described above. The units included in the device may be implemented by software and/or hardware. The apparatus may be, for example, a terminal device, or a component or a baseband chip, a chip system, or a processor that can support the implementation of the above method in the terminal device.

Exemplarily, the communication device may include modular components such as a transceiver unit (or communication module, transceiver module) and a processing unit (or processing module), and these modules may implement the above second aspect or any possible design thereof The corresponding functions of the terminal equipment. When the communication device is a terminal device, the transceiver unit may be a transmitter and a receiver, or a transceiver obtained by integrating a transmitter and a receiver. The transceiver unit may include an antenna and a radio frequency circuit, etc., and the processing unit may be a processor, such as a baseband chip. When the communication device is a component having the functions of the above-mentioned terminal equipment, the transceiver unit may be a radio frequency unit, and the processing unit may be a processor. When the communication device is a system-on-a-chip, the transceiver unit may be an input-output interface of the system-on-a-chip, and the processing unit may be a processor of the system-on-a-chip, such as a central processing unit (CPU).

The transceiver unit may be used to perform receiving and/or sending actions performed by the terminal device in the second aspect or any possible design thereof. The processing unit can be used to perform actions other than reception and transmission performed by the terminal device in the second aspect or any possible design thereof, such as generating an MBS key according to MBS security information, and performing secure processing of MBS data based on the MBS key Wait.

In a fifth aspect, a communication system is provided, and the communication system includes the communication devices shown in the third aspect and the fourth aspect.

In a sixth aspect, a computer-readable storage medium is provided, and the computer-readable storage medium is used for storing computer instructions, and when the computer instructions are run on a computer, the computer is made to perform the above-mentioned first aspect to the second aspect or any of them. The method shown in one possible implementation.

In a seventh aspect, there is provided a computer program product containing instructions, the computer program product is used to store computer instructions, and when the computer instructions are run on a computer, the computer is made to execute the first aspect to the second aspect or any one of them The method shown in one possible implementation.

In an eighth aspect, there is provided a circuit, the circuit is coupled to a memory, and the circuit is used to execute the method shown in the above first aspect to the second aspect or any possible implementation manner thereof. The circuitry may include chip circuitry.

Description of drawings

FIG. 1 is a schematic diagram of a transmission of MBS data according to an embodiment of the present application;

FIG. 2 is a schematic diagram of a protocol stack for unicast transmission according to an embodiment of the present application;

FIG. 3 is a schematic diagram of unicast transmission according to an embodiment of the present application;

FIG. 4 is a schematic diagram of multicast transmission according to an embodiment of the present application;

FIG. 5 is a schematic structural diagram of a communication system according to an embodiment of the present application;

FIG. 6 is a schematic structural diagram of a communication device according to an embodiment of the present application;

FIG. 7 is a schematic structural diagram of a terminal device according to an embodiment of the present application;

FIG. 8 is a schematic structural diagram of an access network device according to an embodiment of the present application;

FIG. 9 is a schematic flowchart of a communication method according to an embodiment of the present application;

FIG. 10 is a schematic diagram of key generation according to an embodiment of the present application;

FIG. 11 is a schematic diagram of cell handover by a terminal device according to an embodiment of the present application.

Detailed ways

In order to make the purpose, technical solution and advantages of the application clearer, the application will be further described in detail below in conjunction with the accompanying drawings. The specific operation methods in the method embodiments can also be applied to the device embodiments or system embodiments.

In the following, some terms used in the embodiments of the present application are explained, so as to facilitate the understanding of those skilled in the art.

1) MBS: MBS is a service transmitted to multiple terminal devices at the same time, such as live broadcast service, public safety service, batch software update service, etc. A multicast service may also be called a multicast service. The MBS comes from the data server. First, the data server sends the MBS data to the core network device, then the core network device sends the MBS data to the access network device, and finally the access network device sends the MBS data to at least one terminal that receives the MBS. equipment. When the core network device sends MBS data to the access network device, the MBS data is transmitted through a common transmission channel, that is, the MBS session. When the access network device sends the data to the terminal device, there are two transmission methods: the first One can adopt point to multi-point (point to multi-point, PTM) transmission mode; the second can adopt point to point (point to point, PTP) transmission mode. As shown in Figure 1.

2) Data plane protocol stack: In unicast transmission, the data plane protocol stack includes packet data convergence protocol (packet data convergence protocol, PDCP), radio link control (radio link control, RLC) layer, media access control ( media access control (MAC) layer and physical (physical, PHY) layer, wherein the PDCP layer is located above the RLC layer, the RLC layer is located above the MAC, and the MAC layer is located above the PHY layer. Take the data sent from the access network device to the terminal device (that is, downlink transmission) as an example. The data first arrives at the PDCP layer of the access network device, and after being processed by the PDCP layer, it is transmitted to the RLC layer and the MAC layer. The (physical, PHY) layer is sent out. After receiving the data, the PHY layer of the terminal device transmits the data to the MAC layer and the RLC layer for processing, and then transmits to the PDCP layer for processing, as shown in FIG. 2 . When data is sent from the terminal device to the access network device (that is, uplink transmission), the direction is reversed. For unicast transmission (that is, unicast data transmission), there is uplink transmission and downlink transmission.

3) Security processing of unicast transmission: Security processing of unicast transmission: For unicast transmission, when the security function is enabled, security-related processing includes encryption/decryption and integrity protection/integrity verification process, the sending end The data packet is encrypted and/or integrity protected, and the receiving end performs corresponding decryption and/or integrity verification on the data packet. Security functions are divided into access layer security and non-access layer security. Access layer security is used to protect data transmission between access network devices and terminal devices, and non-access layer security is used to protect core network devices and terminal devices. The data transmission among them, wherein, the access layer security processing of the access network device and the terminal device is performed at the PDCP layer.

The process of integrity protection and verification is as follows: the sender calculates a parameter A based on parameters such as data packets and keys, and sends A to the verifier; the receiver calculates a parameter B based on the same parameters such as data packets and keys. , the verifier compares the parameters A and B, and if the parameters A and B are consistent, the integrity verification is passed, where the verifier can be the receiving end or a third party, as shown in Figure 3, which is an example of one of the calculation methods. Among them, NIA (Integrity Algorithm for 5G) is the 5G security algorithm, COUNT is the count value, KEY is the key, MESSAGE is the message itself to be integrity protected/verified, DIRECTION is the data transmission direction, and BEARER is the identification of the radio bearer.

4) The single frequency network (single frequency network, SFN) mechanism refers to: in a certain area, multiple synchronous cells transmit the same data to the terminal equipment on the same time and frequency resources at the same time, and the same physical signal sent by multiple cells When the superposition is performed on the air interface, what the terminal equipment receives is a single superimposed data, which can improve the strength of the received signal and eliminate the interference between cells. This mechanism requires that the data sent by multiple cells are exactly the same, otherwise the sent signals cannot be correctly combined.

5) In the embodiments of this application, "at least one" refers to one or more, and "multiple" refers to two or more. "And/or" describes the association relationship of associated objects, indicating that there may be three types of relationships, for example, A and/or B, which can mean: A exists alone, A and B exist simultaneously, and B exists alone, where A, B can be singular or plural. The character "/" generally indicates that the contextual objects are an "or" relationship. "At least one of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one item (piece) of a, b, or c can represent: a, b, c, a-b, a-c, b-c, or a-b-c, where a, b, c can be single or multiple .

And, unless otherwise stated, the ordinal numerals such as "first" and "second" mentioned in the embodiments of this application are used to distinguish multiple objects, and are not used to limit the size, content, order, and timing of multiple objects , priority or importance, etc. For example, the first information and the second information are only for distinguishing different information, and do not represent the difference in size, content, priority or importance of the two pieces of information.

Some terms and concepts involved in the embodiments of the present application are introduced above, and the technical features involved in the embodiments of the present application are introduced below.

At present, in the unicast service, take the access network device sending data to the terminal device as an example, the data first arrives at the PDCP layer of the access network device, and after being processed by the PDCP layer of the access network device, it is transmitted to the RLC layer and the MAC layer , after being processed, it is sent out from the physical layer and transmitted to the terminal device through the air interface. Then, each protocol layer on the terminal device side sequentially performs corresponding processing on the data packets according to the reverse processing order of the access network device. The unicast service can safely process the unicast data through the PDCP layer. However, when a network device performs multicast transmission, the multicast data packet does not pass through the PDCP layer. The multicast data packet directly passes through the RLC layer and the MAC layer, and finally is sent out through the physical layer. Multiple UEs receive the data packet, and then it is processed and sent to a higher layer through the physical layer, MAC layer, and RLC layer, as shown in Figure 4. Show. It can be seen that the multicast data is transmitted without considering the security processing process, which may cause security problems during the data transmission process, resulting in data tampering or eavesdropping. The security processing of data needs to be based on keys, and there is no clear solution for how to generate keys for security processing in multicast transmission.

Based on this, embodiments of the present application provide a communication method and device. In the embodiment of the present application, the access network device and the terminal device can generate the MBS key according to the MBS security information sent by the core network device, so that the MBS data can be safely processed based on the MBS key, and the multicast transmission can be improved. security. Wherein, the method and the device are based on the same inventive concept, and since the principles of the method and the device to solve problems are similar, the implementation of the device and the method can be referred to each other, and the repetition will not be repeated.

The communication method provided by this application can be applied to various communication systems, for example, it can be Internet of things (internet of things, IoT), narrowband Internet of things (narrow band internet of things, NB-IoT), long term evolution (long term evolution) , LTE), can also be the fifth generation (5 ^th generation, 5G) communication system, can also be LTE and 5G hybrid architecture, can also be 6G or new communication systems emerging in future communication development, etc. The 5G communication system described in this application may include at least one of a non-standalone (NSA) 5G communication system and a standalone (standalone, SA) 5G communication system. The communication system may also be a machine to machine (machine to machine, M2M) network, a machine type communication (machine type communication, MTC) or other networks.

As shown in FIG. 5 , the communication method provided by the embodiment of the present application can be applied to a communication system, and the communication system includes an access network device and six terminal devices, that is, UE1-UE6. In the communication system, UE1-UE6 can send uplink information to access network equipment, and the access network equipment can receive uplink data sent by UE1-UE6. In addition, UE4-UE6 may also form a sub-communication system. Access network devices can send downlink information to UE1, UE2, UE3, and UE5, and UE5 can send downlink information to UE4 and UE6 based on device-to-device (D2D) technology, or between UE4 and UE6 can be based on device-to-device (D2D) technology. Device-to-device (D2D) technologies communicate with each other.

The embodiments of the present application can also be used in other communication systems, as long as multicast transmission is required in the communication system. In addition, the embodiments of the application are applicable not only to the scenario where one access network device communicates with multiple UEs, but also to the scenario where multiple access network devices cooperate to communicate with one or more UEs at the same time (for example, SFN). FIG. 5 is only a schematic diagram, and does not specifically limit the type of the communication system and the quantity and type of devices included in the communication system.

The terminal equipment shown above may be user equipment (user equipment, UE), terminal (terminal), access terminal, terminal unit, terminal station, mobile station (mobile station, MS), remote station, remote terminal, mobile terminal (mobile terminal), wireless communication equipment, terminal agent, terminal equipment, cellular telephone, cordless telephone, session initiation protocol (session initiation protocol, SIP) telephone, wireless local loop (wireless local loop, WLL) station, personal digital processing (personal digital assistant, PDA) devices, handheld devices with wireless communication functions, computing devices or other processing devices connected to wireless modems, vehicle-mounted devices, wearable devices, terminal devices in future 5G networks or terminal devices in future evolved PLMN networks Wait. The terminal device may have a wireless transceiver function, which can communicate with one or more access network devices of one or more communication systems (such as wireless communication), and accept network services provided by the access network devices. Here, access The network equipment includes but not limited to the access network equipment shown in FIG. 5 .

In addition, terminal equipment can be deployed on land, including indoor or outdoor, handheld or vehicle-mounted; terminal equipment can also be deployed on water (such as ships, etc.); terminal equipment can also be deployed in the air (such as aircraft, balloons and satellites, etc.) . Specifically, the terminal device may be a mobile phone, a tablet computer (pad), a computer with a wireless transceiver function, a virtual reality (virtual reality, VR) terminal, an augmented reality (augmented reality, AR) terminal, an industrial control (industrial control ), wireless terminals in self driving, wireless terminals in remote medical, wireless terminals in smart grid, wireless terminals in transportation safety , wireless terminals in smart cities, wireless terminals in smart homes, etc. The terminal device may also be a communication chip with a communication module, or a vehicle with a communication function, or a vehicle-mounted device (such as a vehicle-mounted communication device, a vehicle-mounted communication chip), etc.

Access network equipment (or access network point refers to equipment that provides network access functions, such as wireless access network (radio access network, RAN) base station (or RAN equipment) and so on. Access network equipment can be specific Including a base station (base station, BS), or including a base station and a radio resource management device for controlling the base station, etc. The access network device may also include a relay station (relay device), an access point, and a base station in the future 5G network, The base station or NR base station in the future evolution of the PLMN network. The access network device can be a wearable device or a vehicle-mounted device. The access network device can also be a communication chip with a communication module.

For example, access network equipment includes but is not limited to: next-generation base station (g nodeB, gNB) in 5G, evolved node B (evolved node B, eNB) in long term evolution (long term evolution, LTE) system, wireless network A controller (radio network controller, RNC), a wireless controller under a cloud radio access network (cloud radio access network, CRAN) system, a base station controller (base station controller, BSC), a home base station (for example, home evolved nodeB, or home node B, HNB), baseband unit (baseBand unit, BBU), transmission point (transmitting and receiving point, TRP), transmission point (transmitting point, TP), mobile switching center, can also be the evolution type in LTE ( The evolutional) NB (eNB or eNodeB) can also be a base station device in a 5G network or an access network device in a future evolved PLMN network, or a wearable device or a vehicle-mounted device.

In some deployments, the access network equipment may include a centralized unit (CU) and a distributed unit (DU). The access network device may also include an active antenna unit (active antenna unit, AAU). The CU implements some functions of the access network equipment, and the DU implements some functions of the access network equipment. For example, the CU is responsible for processing non-real-time protocols and services, and realizing radio resource control (radio resource control, RRC) and PDCP layer functions. The DU is responsible for processing physical layer protocols and real-time services, realizing the functions of RLC layer, MAC layer and PHY layer. The AAU implements some physical layer processing functions, radio frequency processing and related functions of active antennas. Since the information of the RRC layer will eventually become the information of the PHY layer, or be transformed from the information of the PHY layer, under this architecture, high-level signaling, such as RRC layer signaling, can also be considered to be sent by the DU , or, sent by DU+AAU. It can be understood that the access network device may be a device including one or more of CU nodes, DU nodes, and AAU nodes. In addition, the CU can be divided into access network devices in the access network (radio access network, RAN), and the CU can also be divided into access network devices in the core network (core network, CN) (which can be referred to as CN devices). ), which is not limited in this application.

In addition, the access network device can be connected to a core network (core network, CN) device, and the core network device can be used to provide core network services for terminal devices connected to the access network. Core network devices may correspond to different devices in different systems. For example, in 3G, the core network equipment can correspond to the serving GPRS support node (SGSN) of general packet radio service (GPRS) and/or the gateway GPRS Support Node (GGSN) of GPRS . In 4G, the core network equipment may correspond to a mobility management entity (mobility management entity, MME) and/or a serving gateway (serving gateway, S-GW), etc. In 5G, core network equipment can correspond to access and mobility management function (access and mobility management function, AMF) entity, session management function (session management function, SMF) entity or user plane function (user plane function, UPF) entity, etc. .

In the following, the possible structures of the access network device and the terminal device will be introduced with reference to the accompanying drawings.

Exemplarily, Fig. 6 shows a possible structural schematic diagram of the device. The apparatus shown in FIG. 6 may be a communication device, or a chip applied in a communication device or other combined devices, components (or components) having the functions of the communication device shown in this application, etc., wherein the communication device may be a communication device of this application. The access network device shown in the embodiment, or may also be the terminal device shown in the embodiment of the present application. The apparatus may include a processing module 610 and a transceiving module 620 . Wherein, the transceiver module 620 may be a functional module, and the functional module can complete both the sending operation and the receiving operation. For example, the transceiver module 620 can be used to perform all the sending operations and receiving operations performed by the communication device. For example, when performing During the sending operation, the transceiver module 620 can be considered as a sending module, and when the receiving operation is performed, the transceiver module 620 can be considered as a receiving module; or, the transceiver module 620 can also be two functional modules, and the transceiver module 620 can be regarded as the two A general term for two functional modules, the two functional modules are the sending module and the receiving module, the sending module is used to complete the sending operation, for example, the sending module can be used to perform all the sending operations performed by the communication device, and the receiving module is used to complete the receiving Operation, the receiving module may be used to perform all receiving operations performed by the communication device.

Exemplarily, when the apparatus is a communication device, the transceiver module 620 may include a transceiver and/or a communication interface. Transceivers may include antennas and radio frequency circuits, among others. The communication interface is such as an optical fiber interface. The processing module 610 may be a processor, such as a baseband processor, and the baseband processor may include one or more central processing units (central processing unit, CPU).

When the device is a component having the function of the communication device shown in this application, the transceiver module 620 may be a radio frequency unit, and the processing module 610 may be a processor, such as a baseband processor.

When the device is a system-on-a-chip, the transceiver module 620 may be an input-output interface of a chip (such as a baseband chip), and the processing module 610 may be a processor of the system-on-a-chip, and may include one or more central processing units.

It should be understood that the processing module 610 in the embodiment of the present application may be implemented by a processor or a processor-related circuit component, and the transceiver module 620 may be implemented by a transceiver or a transceiver-related circuit component.

In one implementation, when the communication device is the access network device shown in the embodiment of the present application, the processing module 610 can be used to perform all the operations performed by the access network device in the embodiment of the present application except the transceiving operation , such as processing operations, and/or other processes used to support the technology described herein, such as generating MBS keys, and performing secure processing on MBS data. The transceiver module 620 may be used to perform all receiving and sending operations performed by the access network device in the embodiment of the present application, and/or to support other processes of the technologies described herein.

In another implementation manner, when the communication device is the terminal device shown in the embodiment of the present application, the processing module 610 can be used to perform all operations performed by the terminal device in the embodiment of the present application except the sending and receiving operations, such as processing operations, and/or other processes for supporting the techniques described herein, such as generating MBS keys, processing messages, information and/or signaling received by the transceiver module 620, and the like. The transceiver module 620 may be used to perform all the receiving and sending operations performed by the terminal device in the embodiment of the present application, and/or to support other processes of the technologies described herein.

Fig. 7 shows another possible structural diagram of a terminal device. As shown in FIG. 7 , the communication device includes structures such as a processor, a memory, a radio frequency unit (or radio frequency circuit), an antenna, and an input and output device. The processor is mainly used to process communication protocols and communication data, control devices, execute software programs, process data of software programs, and the like. Memory is primarily used to store software programs and data. The radio frequency unit is mainly used for the conversion of the baseband signal and the radio frequency signal and the processing of the radio frequency signal. Antennas are mainly used to send and receive radio frequency signals in the form of electromagnetic waves. Input and output devices, such as touch screens, display screens, and keyboards, are mainly used to receive data input by users and output data to users. It should be noted that some types of terminal equipment may not have input and output devices.

When data needs to be sent, the processor performs baseband processing on the data to be sent, and outputs the baseband signal to the radio frequency circuit. When data is sent to the terminal device, the radio frequency circuit receives the radio frequency signal through the antenna, converts the radio frequency signal into a baseband signal, and outputs the baseband signal to the processor, and the processor converts the baseband signal into data and processes the data. For ease of illustration, only one memory and processor are shown in FIG. 7 . In an actual terminal device product, there may be one or more processors and one or more memories. A memory may also be called a storage medium or a storage device. The memory may be set independently of the processor, or may be integrated with the processor, which is not limited in this embodiment of the present application.

In the embodiment of the present application, the antenna and the radio frequency circuit with the transceiver function can be regarded as the transceiver unit of the terminal equipment (the transceiver unit can be a functional unit, and the functional unit can realize the sending function and the receiving function; or, the transceiver unit can also be It includes two functional units, namely a receiving unit capable of receiving functions and a sending unit capable of transmitting functions), and the processor with processing functions is regarded as the processing unit of the terminal device. As shown in FIG. 7 , the terminal device includes a transceiver unit 710 and a processing unit 720 . The transceiver unit may also be referred to as a transceiver, a transceiver, a transceiver device, and the like. A processing unit may also be called a processor, a processing board, a processing module, a processing device, and the like. Optionally, the device in the transceiver unit 710 for realizing the receiving function can be regarded as a receiving unit, and the device in the transceiver unit 710 for realizing the sending function can be regarded as a sending unit, that is, the transceiver unit 710 includes a receiving unit and a sending unit. The transceiver unit may sometimes also be referred to as a transceiver, a transceiver, or a transceiver circuit. The receiving unit may sometimes be called a receiver, a receiver, or a receiving circuit, etc. The sending unit may sometimes be called a transmitter, a transmitter, or a transmitting circuit, etc.

It should be understood that the transceiver unit 710 may correspond to the transceiver module 620 , or in other words, the transceiver module 620 may be implemented by the transceiver unit 710 . The transceiver unit 710 is configured to perform the sending operation and the receiving operation of the terminal device in the embodiments shown in this application, and/or other processes for supporting the technology described herein. The processing unit 720 may correspond to the processing module 610 , or in other words, the processing module 610 may be realized by the processing unit 720 . The processing unit 720 is configured to perform other operations on the terminal device in the embodiment shown in this application except the transceiving operation, for example, to perform all receiving and sending operations performed by the terminal device in the embodiment shown in this application, and/or or other processes used to support the techniques described herein.

Fig. 8 shows another possible structural diagram of an access network device. As shown in FIG. 8 , the access network device includes structures such as a processor, a memory, a radio frequency unit (or radio frequency circuit) or an antenna. The processor is mainly used to process communication protocols and communication data, control access network devices, execute software programs, and process data of software programs. Memory is primarily used to store software programs and data. The radio frequency unit is mainly used for the conversion of the baseband signal and the radio frequency signal and the processing of the radio frequency signal.

As shown in FIG. 8, the access network device may include a transceiver unit 810 and a processing unit 820, wherein the transceiver unit 810 may include a sending unit and a receiving unit, or the transceiver unit 810 may be a unit. The transceiving unit 810 may correspond to the transceiving module 620 in FIG. 6 , that is, the transceiving unit 810 performs the actions performed by the transceiving module 620 . Optionally, the transceiver unit 810 may also be called a transceiver, a transceiver circuit, or a transceiver, etc., and may include at least one antenna 811 and a radio frequency unit 812 . The transceiver unit 810 is mainly used for transmitting and receiving radio frequency signals and converting radio frequency signals and baseband signals. The processing unit 820 is mainly used to perform baseband processing, control access network equipment, and the like. The transceiver unit 810 and the processing unit 820 may be physically set together, or may be physically separated, that is, distributed access network equipment.

Exemplarily, the transceiver unit 810 may include one or more radio frequency units, such as a remote radio unit (remote radio unit, RRU), and the processing unit 820 may include one or more baseband units (baseband unit, BBU) (also called It is a digital unit, digital unit, DU).

In an example, the processing unit 820 may be composed of one or more single boards, and multiple single boards may jointly support a wireless access network of a single access standard (such as an LTE network), or may separately support wireless access networks of different access standards. Radio access network (such as LTE network, 5G network or other networks). The processing unit 820 also includes a memory 821 and a processor 822 . The memory 821 is used to store necessary instructions and data. The processor 822 is used to control the access network device to perform necessary actions, for example, to control the access network device to execute the operation procedures related to the access network device in the embodiments shown in this application. The memory 821 and the processor 822 may serve one or more single boards. That is to say, memory and processors can be set independently on each single board. It may also be that multiple single boards share the same memory and processor. In addition, necessary circuits can also be set on each single board.

The network architecture and business scenarios described in the embodiments of the present application are for more clearly illustrating the technical solutions of the embodiments of the present application, and do not constitute limitations on the technical solutions provided by the embodiments of the present application. With the evolution of architecture and the emergence of new business scenarios, the technical solutions provided by the embodiments of this application are also applicable to similar technical problems.

The technical solutions in the embodiments of the present application will be described below with reference to the drawings in the embodiments of the present application. For ease of introduction, in the following, it is taken that the method is executed by the access network device and the terminal device as an example. The method can be applied to a multicast (or multicast) scenario. In a multicast scenario, an access network device can perform multicast transmission with one or more terminal devices receiving MBS, and the one or more terminal devices receiving MBS Can be called a multicast group. It should be understood that the multicast scenario is not limited to one access network device, and multiple access network devices may cooperate to perform multicast transmission with at least one terminal device. For example, in the SFN scenario, multiple access network devices cooperate to send The device sends data. In order to facilitate the understanding of the solution, an access network device participating in multicast transmission (hereinafter referred to as the first access network device) in a multicast scenario and a terminal device in the multicast group (hereinafter referred to as the first It should be understood that the communication process between the first access network device and other terminal devices in the multicast group, and other access network devices that cooperate with the first access network device to perform multicast transmission For the process of communicating between the network device and the terminal device in the multicast group, refer to the process of communicating between the first access network device and the first terminal device.

Referring to FIG. 9 , it is a schematic flowchart of a communication method provided by the present application. The method includes:

S901. The core network device sends the security information of the MBS to the first access network device. Correspondingly, the first access network device receives the security information of the MBS.

In this step S901, the receiving action performed by the first access network device may be performed by the transceiver module 620 in the apparatus shown in FIG. 6 .

It can be understood that when multiple access network devices cooperate to perform multicast transmission (for example, in an SFN scenario, multiple access network devices cooperate to send data to terminal devices), the core network device can send data to the multiple access network The device sends the MBS security information, or the multiple access network devices can exchange MBS security information.

Exemplarily, the security information may also be called security context, security context information, etc., including at least one of the following information: MBS group key, temporary mobile group identity (temporary mobile group identity, TMGI), key update parameters, security Algorithm ID. Wherein, the MBS group key may be a root key, and the subsequent MBS key may be derived based on the key, or the MBS group key may also be an intermediate key for generating the MBS key. Key update parameters can be parameters such as count (COUNT) value, key used for update or token. The MBS key is used as an input parameter to ensure the irreversibility, non-replication and security of the deduction process. The TMGI can be an MBS session identifier, an MBS service identifier or an MBS Internet Protocol (internet protocol, IP) multicast address, wherein the MBS IP multicast address can also be called a multicast IP address or a multicast IP address or an IP multicast address or IP multicast address. The security algorithm identifier may include at least one of the following: an identifier of a security algorithm used for encryption or decryption, and an identifier of a security algorithm used for integrity protection or integrity verification.

It should be noted that the parameter names included in the MBS security information listed above are only examples, and specific parameter names are not limited. In addition, the MBS security information may also include other parameters in specific implementations, which are not specifically limited here.

It can be understood that this step S901 is optional, and the first access network device may obtain the security information from other access network devices, or set it in advance. The embodiments of this application are not limited.

S902. The first access network device generates an MBS key according to the security information.

In this step S902, the actions performed by the first access network device may be performed by the processing module 610 in the apparatus shown in FIG. 6 .

Wherein, the MBS key may include at least one of the following: a first key and a second key, wherein the first key is used to encrypt the data of the MBS, and the second key is used to complete the integrity of the data of the MBS. Protect. It can be understood that when generating the first key, the identification of the security algorithm used for encryption or decryption in the security information can be used, and when generating the second key, the security algorithm used for integrity protection or integrity verification in the security information can be used. The ID of the algorithm. In another possible implementation manner, the first key and the second key are the same, that is, the data encryption and integrity protection processes of the MBS use the same key. In an example, the process of generating an MBS key may be shown in FIG. 10 . Optionally, in Figure 10, the security information can be used as an input parameter when generating the MBS key, and input to the security functional entity used to deduce the key, and the security functional entity can generate output parameters through security algorithm calculation, according to The output parameter gets the MBS key. It is worth noting that the input parameters in Figure 10 are only to show the process of generating the MBS key, and do not specifically limit the input parameters of the present invention. In different implementations, the input parameters may include the input parameters shown in the figure Or the input parameters mentioned in the specific embodiment, or may also include other input parameters necessary for generating the MBS key.

The following is an exemplary description of the process of generating the MBS key by the first access network device.

When generating the MBS key, the first access network device can also input other information besides the security information, such as the SFN area identifier where the first access network device is located, the tracking area identifier, the access network paging area identifier, the first One or more of the identifier of the access network device, the physical cell identifier of the first access network device, and the frequency information of the cell of the first access network device (for example, an absolute radio frequency channel number (ARFCN) item. In addition, other information may also include a count value. The count value is used to indicate the corresponding derivation process or deduction times, and different count values correspond to different deduction processes or deduction times. The first access network device can use the count value as input parameters to ensure that different MBS keys are obtained in different derivation processes, so as to ensure key isolation between different derivation processes; or the first access network device can determine from the MBS group key to The number of derivations required to obtain the MBS key.

The above security information and other information can be used as input parameters when generating the MBS key and input into the security function entity. The security function entity can generate output parameters through security algorithm calculation, and obtain the MBS key according to the output parameters.

In a possible implementation manner, the specific content included in the above other information may be related to the SFN capability of the first access network device and the SFN status of the first access network device. Therefore, the first access network device may And at least one of the following items generates the MBS key: the SFN capability of the first access network device, and the SFN status of the first access network device. The SFN capability can also be understood as whether the access network device supports the SFN function, and the SFN status can also be understood as whether the SFN function of the access network device is enabled.

In a specific example, when the first access network device meets the first condition, the MBS key may be generated according to the security information and the first information, where the first condition includes that the SFN capability of the first access network device is supported and/or Or the SFN state of the first access network device is enabled, and the first information includes at least one of the following items: the SFN area identifier, the tracking area identifier, and the access network paging area identifier where the first access network device is located. Or, when the first access network device satisfies the first condition, it may generate the MBS key according to the security information. Optionally, if the size of the SFN area is smaller than the size of the tracking area, the first information may include a tracking area identifier, that is, the first access network device may generate the tracking area identifier when the size of the SFN area is smaller than the size of the tracking area MBS key. If the size of the SFN area is smaller than the size of the paging area of the access network, the first information may include the identifier of the paging area of the access network, that is, the size of the first access network device may be smaller than the paging area of the access network The MBS key is generated according to the paging area identifier of the access network.

When the first access network device meets the second condition, it can generate the MBS key according to the security information and the second information, wherein the second condition includes that the SFN capability of the first access network device is not supported and/or the first access network device The SFN status of the network device is off, and the second information includes at least one of the following items: an identifier of the first access network device, a physical cell identifier of the first access network device, and frequency information of a cell of the first access network device.

If the first access network device does not support the SFN function or the SFN function is not enabled (that is, the SFN status is off), the cell signals under the first access network device do not need to be combined with the cell signals of other access network devices, that is, there is no need to For SFN transmission, the first access network device can use the relevant information of the access network device or the serving cell (that is, the second information) as an input parameter to generate an MBS key, so that only the MBS key needs to be updated when updating the MBS key. The MBS key of the first access network device or the serving cell is sufficient, so that the overhead of key update is reduced while improving security.

If the first access network device supports the SFN function or the SFN function is enabled (that is, the SFN status is enabled), the cell signals under the first access network device may need to be combined with the cell signals of other access network devices, so different The data sent by the access network devices must be exactly the same, and the MBS key used for security processing must also be the same, so the first access network device (or the first terminal device) cannot use the first access network device (or the first terminal device) when generating the MBS key. For all access network devices or cells that perform the same SFN function, the parameters unique to network access devices or serving cells must be consistent for generating MBS keys. At this time, the MBS key can be generated by using the information related to the SFN area (that is, the first information), which can ensure that the MBS keys used by all access network devices or all cells in the same SFN area are the same.

It should be understood that the SFN state is enabled only when the first access network device supports the SFN function, and if the first access network device does not support the SFN function, there is no such thing as the SFN state or the SFN state does not exist Therefore, when the SFN status of the first access network device is enabled, the SFN function of the first access network device may be supported by default.

It should be noted that, in this embodiment of the application, "the SFN state is on" may also be referred to as "SFN state is enabled", "SFN state is active", etc., and "SFN state is off" may also be referred to as "SFN state is not enabled", "SFN status is disabled or disabled", "SFN status is inactive", "SFN status is deactivated", "SFN status is inhibited or dormant", etc.

S903. The first access network device performs security processing on the MBS data based on the MBS key, and the security processing includes at least one of the following processing: encryption and integrity protection.

In this step S903, the actions performed by the first access network device may be performed by the processing module 610 in the apparatus shown in FIG. 6 .

S904. The first access network device sends the security-processed data to the first terminal device. Correspondingly, the first terminal device receives the data.

In this step S901, assuming that the apparatus shown in FIG. 6 is an access network device, the sending action performed by the first access network device may be performed by the transceiver module 620 in the apparatus shown in FIG. 6 . Assuming that the apparatus shown in FIG. 6 is a terminal device, the receiving action performed by the first terminal device may also be performed by the transceiver module 620 in the apparatus shown in FIG. 6 .

It can be understood that when the multicast group includes multiple terminal devices, the first access network device may send the data to all the multiple terminal devices. Wherein, the multicast group may include one or more terminal devices receiving the above-mentioned MBS.

S905. The first terminal device performs security processing on the received data based on the MBS key, and the security processing includes at least one of the following processing: decryption and integrity verification.

In this step S905, the actions performed by the first terminal device may be performed by the processing module 610 in the apparatus shown in FIG. 6 .

Wherein, the MBS key of the first terminal device may be generated by the first access network device and sent to the first terminal device, or may be generated by the first terminal device itself in the same manner as the first access network device.

Exemplarily, if the MBS key of the first terminal device is sent by the first access network device to the first terminal device, the first access network device may send the MBS key to the first terminal device through the following scheme 1 or scheme 2: key:

Solution 1, in the scenario where the first terminal device accesses the cell of the first access network device, the first access network device may send the MBS key to the first terminal device after generating the MBS key, and the first access network device The device may send the MBS key to the terminal device through an RRC message, for example, the MBS key is carried in the RRC reconfiguration message.

Solution 2: In the scenario where the first terminal device is handed over from the second access network device to the first access network device, the first access network device may send the MBS key to the second access network device, and the second access network device The access network device forwards the MBS key to the first terminal device. Exemplarily, the first access network device may send the MBS key to the second access network device through a handover request confirmation message, and the second access network device may send the MBS key in the handover command Carrying the MBS key and sending it to the first terminal device. Wherein, the MBS key of the first access network device is different from the MBS key of the second access network device. For example, based on the specific example of generating the MBS key in step S902, if the first access network device satisfies the first condition, that is, the first access network device does not support the SFN function or the SFN status is off, the first access network device according to The relevant information (that is, the second information) of the first access network device generates an MBS key, so the MBS key generated by the first access network device and the MBS key of other access network devices (such as the second access network device) keys are different. For another example, if the first access network device meets the second condition, that is, the first access network device supports the SFN function and/or the SFN status is enabled, the first access network device Related information (that is, the first information) generates an MBS key, so the MBS keys of the access network devices in the SFN area where the first access network device is located are the same, but the second access network device is not in the SFN where the first access network device is located Therefore, the MBS keys of the first access network device and the second access network device are different.

Taking the first terminal device switching from one SFN area (the SFN area where the second access network device is located) to another SFN area (the SFN area where the first access network device is located), as shown in Figure 11 as an example, the first The MBS key of the access network device may be sent to the second access network device through a handover request confirmation message. Specifically, the handover request message of the second access network device may carry the SFN area identifier. After the first access network device receives the message, if it determines that the SFN area identifier is different from its own SFN area identifier or the first access network device If the device does not support the SFN function and does not have an SFN area identifier, it can send the MBS key of the first access network device to the second access network device, and then the second access network device sends the MBS key to the second access network device through a handover command. The first terminal device uses the MBS key of the first access network device to securely process the MBS data after the handover is completed.

Optionally, when a terminal device (which may be the first terminal device or other terminal devices) switches between access network devices in the same SFN area, if the MBS keys used by different access network devices If they are the same, the MBS key may not be updated.

If the MBS key of the first terminal device is generated by the first terminal device, the MBS key can be generated through the following process: the core network device sends the security information of the MBS to the first terminal device, and the first terminal device can generate the MBS key based on the security information key, wherein the rule information and input parameters for the first terminal device and the first access network device to generate the MBS key need to be the same, so that the first access network device and the first terminal device can securely process the MBS data The keys are the same, so that the accuracy of the first terminal device in obtaining the MBS data can be improved. Among them, the rule information for generating the MBS key and the required input parameters can be stipulated in the agreement, or the core network device can send it to the first terminal device in advance, for example, the core network device will generate the MBS key during the authentication or registration process of the first terminal device. The rule information of the key is sent to the first terminal device.

Exemplarily, the first terminal device may also use the method described in the specific example in step S902 to generate the MBS key. Specifically, when the first terminal device uses the method described in the above example to generate the MBS key, it can obtain the SFN capability of the first access network device according to the first indication information sent by the first access network device, and according to the first access network device The second indication information sent by the network equipment obtains the SFN status of the first access network equipment, wherein the first indication information is used to indicate the SFN capability of the first access network equipment, and the second indication information is used to indicate the SFN status of the first access network equipment. SFN status of the device. Alternatively, the first indication information may also be used to indicate that the SFN capability of the first access network device is supported, and the second indication information may also be used to indicate that the SFN state of the first access network device is enabled.

It can be understood that when the SFN capability of the first access network device is not supported, the first access network device may not send the first indication information, that is, when the first access network device does not send the first indication indicating the SFN capability information, the terminal device considers that the SFN capability of the access network device is not supported. Similarly, when the SFN state of the first access network device is not enabled (closed), the first access network device may not send the second indication information, that is, when the first access network device does not send the first indication of the SFN state 2. When the information is indicated, the terminal device considers that the SFN capability of the access network device is not supported. The signaling overhead can be further saved through the above manner.

Wherein, the first indication information and the second indication information may be the same information. For example, the first access network device simultaneously indicates the SFN function of the first access network device and the SFN status of the first access network device through a piece of indication information, wherein, if the first access network device does not support the SFN function, the indication The information may indicate that the SFN function is not supported. If the first access network device supports the SFN function, the indication information may indicate the SFN status, thereby implicitly indicating that the SFN function is supported.

Certainly, the first indication information and the second indication information may also be two pieces of information. In this manner, the first indication information and the second indication information may be sent to the first terminal device through the same message, or may be sent to the first terminal device through two messages.

In addition, the first access network device may also indicate the SFN area identifier to the first terminal device.

In an implementation manner, the first access network device may indicate the SFN area identifier through the first indication information or the second indication information. In an example, the first access network device indicates the SFN function and the SFN area identifier through the first indication information, wherein, if the first access network device supports the SFN function, the first indication information may indicate the SFN area identifier, thereby hiding The formula indicates that the first access network device supports the SFN function, and if the first access network device does not support the SFN function, the first indication information may indicate that the SFN function is not supported. In another example, the first access network device indicates the SFN status and the SFN area identifier through the second indication information, wherein, if the SFN status of the first access network device is enabled, the second indication information may indicate the SFN area identifier , so as to implicitly indicate that the SFN state is on. If the SFN state of the first access network device is off, the second indication information may indicate that the SFN state is off. In another example, the first access network device indicates the SFN function, SFN status, and SFN area identifier through an indication message, wherein, if the first access network device does not support the SFN function, the indication information may indicate that the SFN function is Not supported; if the first access network device supports the SFN function but the SFN status is closed, the indication information can indicate that the SFN status is closed, so that the SFN function can be implicitly indicated as supported; if the first access network device supports the SFN function and The SFN state is enabled, and the indication information may indicate the SFN area identifier, thereby implicitly indicating that the SFN function is supported and the SFN state is enabled.

In another implementation manner, the first access network device may also indicate the SFN area identifier through the third indication information.

All the above-mentioned first indication information, second indication information and third indication information may be sent through a broadcast message, a system message or an RRC message.

In the embodiment of the present application, the access network device and the terminal device can generate an MBS key based on the security information of the MBS from the core network device, and realize the secure processing of the MBS data based on the MBS key, thereby improving multicast broadcast transmission security.

Moreover, the SFN mechanism of the access network device is considered when generating the MBS key, so that the SFN mechanism of the access network device side may not be affected, and the key update overhead may be reduced.

In a possible implementation manner, after the first access network device generates the MBS key, the MBS key needs to be updated in some scenarios. For example, when the first terminal device (or other terminal devices in the multicast group) leaves the multicast group, in order to prevent the first terminal device from continuing to receive MBS using the previous MBS key, the core network device or the first terminal device The network access device can update the MBS key (that is, re-deduce). For another example, when the SFN state of the first access network device changes, the first access network device may update the MBS key.

In an exemplary description, the reason for the terminal device (which may be the first terminal device or other terminal devices in the multicast group) to leave the multicast group may be that the terminal device has performed a cell handover, or the terminal device has The MBS is no longer interested, and so on. Of course, the terminal device may also leave the multicast group for other reasons. This application is only an example and does not limit the reasons for the terminal device to leave the multicast group.

It should be noted that the update of the MBS key may or may not be triggered after the terminal device performs cell handover.

An implementation of the update process may include the following steps:

Step 1, the core network device or the first access network device determines when to update the MBS key, for example, when a terminal device (which may be the first terminal device or other terminal devices in the multicast group) sends a message to When the core network device or the first access network device indicates that it is no longer interested in a certain MBS, or the core network device or the first access network device determines that the terminal device leaves the multicast group according to the subscription information of the terminal device, then The core network device or the first access network device may update the MBS key based on the departure of the terminal device.

Optionally, after the core network device detects that the terminal device stops receiving MBS data, it may also instruct the first access network to update the MBS key.

Step 2: The core network device or the first access network device determines the scope of updating the MBS key. Assuming that the MBS key is generated based on the first access network device or the relevant information of the serving cell (that is, the second information), then in When updating the MBS key, only the MBS key of the first access network device or the serving cell may be updated. Assuming that the MBS key is generated based on the SFN area identifier, the MBS key of the SFN area may be updated, Assuming that the MBS key is generated based on the tracking area identifier, the MBS key of the tracking area can be updated; assuming that the MBS key is generated based on the paging area identifier of the access network, the access network can be paged The MBS key of the zone is updated.

Step 3: The first access network device regenerates a new MBS key and sends it to the terminal device, or the first access network device sends an update instruction to the terminal device, instructing the terminal device to generate a new MBS key.

Wherein, step 1 and step 2 have no strict execution order.

In the embodiment of this application, according to whether the access network device has enabled the SFN function, it is determined whether the parameters of the derivation key include information related to the access network device or the cell: if the SFN function is enabled, the access network device or cell that participates in the SFN merge Information related to access network devices or cells cannot be included in the process of key generation; if the SFN function is not enabled or does not support the access network device or cell, access network devices or cells can be included in the process of key generation Related information. Therefore, the SFN mechanism on the access network device side is not affected, and the key update overhead can be reduced.

An embodiment of the present application provides a communication device. The communication device may be used to implement the terminal device involved in the foregoing embodiments, and the communication device may include the structure shown in FIG. 6 and/or FIG. 7 .

An embodiment of the present application provides a communication device. The communication device may be used to implement the first access network device involved in the foregoing embodiments, and the communication device may include the structure shown in FIG. 6 and/or FIG. 8 .

An embodiment of the present application provides a communication system. The communication system may include at least one terminal device and at least one access network device, where the terminal device and the access network device in the communication system may execute the method shown in any one of the above method embodiments.

The embodiment of the present application also provides a computer-readable storage medium, the computer-readable storage medium stores a computer program, and when the computer program is executed by a computer, the computer can implement any one of the above-mentioned method embodiments. Processes related to end devices or network devices.

The embodiment of the present application also provides a computer program product, which is used to store a computer program. When the computer program is executed by a computer, the computer can realize any one of the above method embodiments shown in the embodiment and the terminal device. Or network device-related processes.

The embodiment of the present application also provides a chip or a chip system, the chip may include a processor, and the processor may be used to call programs or instructions in the memory, and execute any one of the above method embodiments shown in the embodiment and the terminal device Or a process related to the first access network device. The system-on-a-chip may include the chip, and other components such as a memory or a transceiver.

An embodiment of the present application further provides a circuit, which can be coupled with a memory, and can be used to execute a procedure related to a terminal device or a network device in any one of the foregoing method embodiments. The system-on-a-chip may include the chip, and other components such as a memory or a transceiver.

It should be understood that the processor mentioned in the embodiments of the present application may be a CPU, or other general-purpose processors, digital signal processors (digital signal processors, DSPs), application specific integrated circuits (application specific integrated circuits, ASICs), off-the-shelf Programmable gate array (field programmable gate array, FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor, or the processor may be any conventional processor, or the like.

It should also be understood that the memory mentioned in the embodiments of the present application may be a volatile memory or a nonvolatile memory, or may include both volatile and nonvolatile memories. Among them, the non-volatile memory can be read-only memory (read-only memory, ROM), programmable read-only memory (programmable ROM, PROM), erasable programmable read-only memory (erasable PROM, EPROM), electrically programmable Erases programmable read-only memory (electrically EPROM, EEPROM) or flash memory. Volatile memory can be random access memory (RAM), which acts as external cache memory. By way of illustration and not limitation, many forms of RAM are available such as static random access memory (static RAM, SRAM), dynamic random access memory (dynamic RAM, DRAM), synchronous dynamic random access memory (synchronous DRAM, SDRAM), double data rate synchronous dynamic random access memory (double data rate SDRAM, DDR SDRAM), enhanced synchronous dynamic random access memory (enhanced SDRAM, ESDRAM), synchronous connection dynamic random access memory (synchlink DRAM, SLDRAM ) and direct memory bus random access memory (direct rambus RAM, DR RAM).

It should be noted that when the processor is a general-purpose processor, DSP, ASIC, FPGA or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components, the memory (storage module) is integrated in the processor.

It should be noted that the memories described herein are intended to include, but are not limited to, these and any other suitable types of memories.

It should be understood that, in various embodiments of the present application, the sequence numbers of the above-mentioned processes do not mean the order of execution, and the execution order of the processes should be determined by their functions and internal logic, and should not be used in the embodiments of the present application. The implementation process constitutes any limitation.

Those skilled in the art can appreciate that the modules and algorithm steps of the examples described in conjunction with the embodiments disclosed herein can be implemented by electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are executed by hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art may use different methods to implement the described functions for each specific application, but such implementation should not be regarded as exceeding the scope of the present application.

Those skilled in the art can clearly understand that for the convenience and brevity of the description, the specific working process of the above-described system, device, and module can refer to the corresponding process in the foregoing method embodiment, and details are not repeated here.

In the several embodiments provided in this application, it should be understood that the disclosed methods and devices may be implemented in other ways. For example, the device embodiments described above are only illustrative. For example, the division of the modules is only a logical function division. In actual implementation, there may be other division methods. For example, multiple modules or components can be combined or can be Integrate into another system, or some features may be ignored, or not implemented. In another point, the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces, and the indirect coupling or communication connection of devices or units may be in electrical, mechanical or other forms.

The modules described as separate components may or may not be physically separated, and the components displayed as modules may or may not be physical modules, that is, they may be located in one place, or may also be distributed to multiple network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the solutions in the embodiments of the present application.

In addition, each functional module in each embodiment of the present application may be integrated into one processing module, each module may exist separately physically, or two or more modules may be integrated into one module.

If this function is realized in the form of a software function module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the essence of the technical solution of this application or the part that contributes or the part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for Make a computer device (which may be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the method in each embodiment of the present application. The aforementioned computer-readable storage medium may be any available medium that can be accessed by a computer. Take this as an example but not limited to: computer-readable media may include random access memory (random access memory, RAM), read-only memory (read-only memory, ROM), electrically erasable programmable read-only memory (electrically erasable programmable read-only memory) read only memory, EEPROM), compact disc read-only memory (CD-ROM), universal serial bus flash disk (universal serial bus flash disk), mobile hard disk, or other optical disk storage, disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and that can be accessed by a computer.

The above is only a specific implementation of the application, but the scope of protection of the embodiment of the application is not limited thereto, and any skilled person familiar with the technical field can easily think of changes within the technical scope disclosed in the embodiment of the application Or replacement, should be covered within the scope of protection of the embodiments of the present application. Therefore, the protection scope of the embodiments of the present application should be determined by the protection scope of the claims.

Claims

A communication method, characterized in that the method is applicable to a first access network device, and the method includes:

Receive the security information of the multicast broadcast service MBS;

generate an MBS key according to the security information;

Perform security processing on the MBS data based on the MBS key, and the security processing includes at least one of the following processing: encryption and integrity protection;

Send the data to the terminal device.
The method according to claim 1, wherein said generating an MBS key according to said security information comprises:

The MBS key is generated according to the security information and at least one of the following items: the single frequency network SFN capability of the first access network device, and the SFN status of the first access network device.
The method according to claim 2, wherein the MBS key is generated according to the security information and at least one of the following items: the single frequency network (SFN) capability of the first access network device, the second - The SFN state of the access network equipment, including:

When the first condition is met, the MBS key is generated according to the security information and first information or the MBS key is generated according to the security information, and the first information includes at least one of the following items: the first connection The SFN area identifier, the tracking area identifier, and the paging area identifier of the access network where the network access device is located, the first condition includes that the SFN capability is supported and/or the SFN status is enabled;

When the second condition is met, generate the MBS key according to the security information and second information, where the second information includes at least one of the following: the identifier of the first access network device, the first access network device The physical cell identity of the network device, the frequency information of the cell of the first access network device, and the second condition includes that the SFN capability is not supported and/or the SFN state is off.
The method according to any one of claims 1-3, wherein the MBS key includes at least one of the following: a first key, a second key; Performing security processing on the MBS data includes: encrypting the data based on the first key, and performing integrity protection on the data based on the second key.
The method according to any one of claims 1-4, wherein the security information includes at least one of the following information: MBS group key, temporary mobile group identifier TMGI, key update parameters, and security algorithm identifier.
The method according to claim 5, wherein the TMGI is an MBS session identifier, an MBS service identifier or an Internet Protocol IP multicast address of the MBS.
The method according to claim 2 or 3, wherein the method further comprises:

sending first indication information and/or second indication information to the terminal device, where the first indication information is used to indicate the SFN capability of the first access network device, and where the second indication information is used to indicate the The SFN status of the first access network device.
The method according to any one of claims 1-7, wherein the method further comprises:

If the terminal device stops receiving the MBS, update the MBS key.
The method according to claim 2 or 3, wherein the method further comprises:

If the SFN state of the first access network device changes, the MBS key is updated.
A communication method, characterized in that the method is applicable to a terminal device, and the method includes:

Obtain the MBS key of the multicast broadcast service;

Receive MBS data;

Perform security processing on the data based on the MBS key, and the security processing includes at least one of the following processing: decryption and integrity verification.
The method according to claim 10, wherein said obtaining the MBS key of a multicast broadcast service comprises:

receiving security information of said MBS;

Generate the MBS key according to the security information.
The method according to claim 11, wherein said generating said MBS key according to said security information comprises:

Acquire first indication information and/or second indication information, where the first indication information is used to indicate the SFN capability of the first access network device, and where the second indication information is used to indicate that the first access network device SFN status of the device;

generating the MBS key according to at least one indication information of the first indication information and the second indication information and the security information.
The method according to claim 12, wherein the generating the MBS key according to at least one of the first indication information and the second indication information and the security information comprises:

When the first condition is met, the MBS key is generated according to the security information and first information or the MBS key is generated according to the security information, and the first information includes at least one of the following items: the first connection The SFN area identifier, tracking area identifier, and access network paging area identifier of the network access device, the first condition is that the first indication information indicates that the SFN function of the first access network device is supported and/or The second indication information indicates that the SFN state of the first access network device is enabled; or

When the second condition is met, generate the MBS key according to the security information and second information, where the second information includes at least one of the following: the identifier of the first access network device, the first access network device The physical cell identity of the network device, the frequency information of the cell of the first access network device, the second condition includes that the first indication information indicates that the SFN capability of the first access network device is not supported and/or Or the second indication information indicates that the SFN state of the first access network device is closed.
The method according to any one of claims 10-13, wherein the MBS key includes at least one of the following: a first key and a second key, wherein the Performing security processing on the data includes: decrypting the data based on the first key, and performing integrity verification on the data based on the second key.
The method according to any one of claims 10-14, wherein the security information includes at least one of the following information: MBS group key, temporary mobile group identifier TMGI, key update parameters, and security algorithm identifier.
The method according to claim 15, wherein the TMGI is an MBS session identifier, an MBS service identifier or an MBS Internet Protocol IP multicast address.
The method according to claim 10, wherein said obtaining the MBS key of a multicast broadcast service comprises:

Receive the MBS key from the first access network device, where the MBS key is generated based on the security information of the MBS.
A communication device, characterized by comprising:

The transceiver module is used to receive the security information of the multicast broadcast service MBS;

A processing module, configured to generate an MBS key according to the security information;

And, perform security processing on the MBS data based on the MBS key, and the security processing includes at least one of the following processing: encryption, integrity protection;

The transceiver module is further configured to send the data to the terminal device.
The device according to claim 18, wherein the processing module, when generating the MBS key according to the security information, is specifically configured to:

Generate the MBS key according to the security information and at least one of the following items: the single frequency network SFN capability of the first access network device, and the SFN status of the first access network device.
The apparatus according to claim 19, wherein the processing module generates the MBS key according to the security information and at least one of the following items: the single frequency network (SFN) capability of the first access network device . When in the SFN state of the first access network device, it is specifically used for:

When the first condition is met, the MBS key is generated according to the security information and first information or the MBS key is generated according to the security information, and the first information includes at least one of the following items: the first connection The SFN area identifier, the tracking area identifier, and the paging area identifier of the access network where the network access device is located, the first condition includes that the SFN capability is supported and/or the SFN status is enabled;

When the second condition is met, generate the MBS key according to the security information and second information, where the second information includes at least one of the following: the identifier of the first access network device, the first access network device The physical cell identity of the network device, the frequency information of the cell of the first access network device, and the second condition includes that the SFN capability is not supported and/or the SFN state is off.
The device according to any one of claims 18-20, wherein the MBS key includes at least one of the following: a first key and a second key; When performing security processing on the data of the MBS, it is specifically used to: encrypt the data based on the first key, and perform integrity protection on the data based on the second key.
The device according to any one of claims 18-21, wherein the security information includes at least one of the following information: MBS group key, temporary mobile group identifier TMGI, key update parameters, and security algorithm identifier.
The device according to claim 22, wherein the TMGI is an MBS session identifier, an MBS service identifier or an Internet Protocol IP multicast address of the MBS.
The device according to claim 19 or 20, wherein the transceiver module is also used for:

sending first indication information and/or second indication information to the terminal device, where the first indication information is used to indicate the SFN capability of the first access network device, and where the second indication information is used to indicate the The SFN status of the first access network device.
The device according to any one of claims 18-24, wherein the processing module is further configured to:

If the terminal device stops receiving the MBS, update the MBS key.
The device according to claim 19 or 20, wherein the processing module is further used for:

If the SFN state of the first access network device changes, the MBS key is updated.
A communication device, characterized in that the device includes:

A processing module, configured to acquire a multicast broadcast service MBS key;

A transceiver module, configured to receive data from the MBS;

The processing module is further configured to perform security processing on the data based on the MBS key, and the security processing includes at least one of the following processing: decryption and integrity verification.
The device according to claim 27, wherein the processing module, when acquiring the multicast broadcast service MBS key, is specifically used for:

receiving the security information of the MBS through the transceiver module;

Generate the MBS key according to the security information.
The device according to claim 28, wherein the processing module, when generating the MBS key according to the security information, is specifically configured to:

Acquire first indication information and/or second indication information, where the first indication information is used to indicate the SFN capability of the first access network device, and where the second indication information is used to indicate that the first access network device SFN status of the device;

generating the MBS key according to at least one indication information of the first indication information and the second indication information and the security information.
The device according to claim 29, wherein the processing module generates the MBS key according to at least one of the first indication information and the second indication information and the security information , specifically for:

When the first condition is met, the MBS key is generated according to the security information and first information or the MBS key is generated according to the security information, and the first information includes at least one of the following items: the first connection The SFN area identifier, tracking area identifier, and access network paging area identifier of the network access device, the first condition is that the first indication information indicates that the SFN function of the first access network device is supported and/or The second indication information indicates that the SFN state of the first access network device is enabled; or

When the second condition is met, generate the MBS key according to the security information and second information, where the second information includes at least one of the following: the identifier of the first access network device, the first access network device The physical cell identity of the network device, the frequency information of the cell of the first access network device, the second condition includes that the first indication information indicates that the SFN capability of the first access network device is not supported and/or Or the second indication information indicates that the SFN state of the first access network device is off.
The device according to any one of claims 27-30, wherein the MBS key includes at least one of the following: a first key and a second key; the processing module, based on the MBS key, When performing security processing on the data with a key, it is specifically used to: decrypt the data based on the first key, and verify the integrity of the data based on the second key.
The device according to any one of claims 27-31, wherein the security information includes at least one of the following information: MBS group key, temporary mobile group identifier TMGI, key update parameters, and security algorithm identifier.
The device according to claim 32, wherein the TMGI is an MBS session identifier, an MBS service identifier or an MBS Internet Protocol IP multicast address.
The device according to claim 27, wherein the processing module, when acquiring the multicast broadcast service MBS key, is specifically used for:

receiving the MBS key from the first access network device through the transceiving module, where the MBS key is generated based on the security information of the MBS.
A communication device, characterized by comprising:

memory for storing instructions;

A processor, configured to call and execute the instruction from the memory, so that the communication device executes the method according to any one of claims 1-9.
A communication device, characterized by comprising:

memory for storing instructions;

A processor, configured to call and execute the instruction from the memory, so that the communication device executes the method according to any one of claims 10-17.
A communication system, characterized by comprising the communication device according to any one of claims 18-26 and the communication device according to any one of claims 27-34.
A computer-readable storage medium, characterized in that instructions are stored in the computer-readable storage medium, and when the instructions are invoked and executed on a computer, the computer executes any one of claims 1-17. method described in the item.
A computer program product, characterized in that, when the computer program product is run on a computer, the computer is made to execute the method according to any one of claims 1-17.
A circuit, characterized in that the circuit is coupled to a memory, and the circuit is used to read and execute a program stored in the memory to perform the method according to any one of claims 1-17.