[go: up one dir, main page]
More Web Proxy on the site http://driver.im/

WO2024120500A1 - Procédé de communication et appareil associé - Google Patents

Procédé de communication et appareil associé Download PDF

Info

Publication number
WO2024120500A1
WO2024120500A1 PCT/CN2023/137277 CN2023137277W WO2024120500A1 WO 2024120500 A1 WO2024120500 A1 WO 2024120500A1 CN 2023137277 W CN2023137277 W CN 2023137277W WO 2024120500 A1 WO2024120500 A1 WO 2024120500A1
Authority
WO
WIPO (PCT)
Prior art keywords
network device
access network
terminal
communication
key
Prior art date
Application number
PCT/CN2023/137277
Other languages
English (en)
Chinese (zh)
Inventor
胡星星
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2024120500A1 publication Critical patent/WO2024120500A1/fr

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/041—Key generation or derivation
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/009—Security arrangements; Authentication; Protecting privacy or anonymity specially adapted for networks, e.g. wireless sensor networks, ad-hoc networks, RFID networks or cloud networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/03—Protecting confidentiality, e.g. by encryption
    • H04W12/033—Protecting confidentiality, e.g. by encryption of the user plane, e.g. user's traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/043—Key management, e.g. using generic bootstrapping architecture [GBA] using a trusted network node as an anchor
    • H04W12/0431—Key distribution or pre-distribution; Key agreement
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W48/00—Access restriction; Network selection; Access point selection
    • H04W48/08—Access restriction or access information delivery, e.g. discovery data delivery

Definitions

  • the present application relates to the field of communications, and in particular to a communication method and related devices.
  • Non-terrestrial network such as satellite communication
  • NTN Non-terrestrial network
  • satellite communication has the advantages of wide coverage, long communication distance, high reliability, high flexibility, high throughput, etc., and is not affected by geographical environment, climate conditions and natural disasters. Therefore, introducing non-terrestrial network equipment such as satellites into the next generation mobile network can provide communication services for areas that are difficult to cover by terrestrial networks (for example, oceans, forests, etc.), and can also provide more data transmission resources and support a larger number of connections.
  • terrestrial networks for example, oceans, forests, etc.
  • the NTN gateway deployment cannot cover all satellites.
  • satellites in some areas cannot exchange information with the core network through the NTN gateway, resulting in the terminal being unable to initiate a non-access stratum (NAS) connection to the core network through the satellite, and the satellite cannot exchange terminal signaling with the core network. That is, the terminal in this area cannot enjoy network services.
  • NAS non-access stratum
  • the access network device where the target cell is located and/or the access network device where the source cell is located may not be within the coverage of the NTN gateway.
  • how the access network device where the target cell is located obtains a new security context to ensure the security of communication becomes an urgent problem to be solved.
  • the present application provides a communication method and related apparatus, which can enable a terminal to obtain a new security context in a timely manner when switching to a target access network device to ensure the security of communication.
  • a communication method is provided, which can be applied to a core network device.
  • it can be executed by the core network device, or it can be executed by a component configured in the core network device (such as a chip, a chip system, etc.), or it can be implemented by a logic module or software that can implement all or part of the functions of the core network device.
  • a component configured in the core network device such as a chip, a chip system, etc.
  • a logic module or software that can implement all or part of the functions of the core network device.
  • the method includes: receiving first information from a first access network device, the first information including an identification of a terminal; determining one or more candidate target access network devices for the terminal; sending security parameters to the one or more candidate target access network devices, the security parameters including at least one key pair for deriving a communication key; wherein the second access network device belongs to the one or more candidate target access network devices, and the communication key derived from at least one key pair sent to the second access network device is used to encrypt subsequent post-switching communications of the terminal after accessing the second access network device.
  • the process of deriving communication keys in this application is: a key pair derives an intermediate key (for example, KeNB), and a communication key is derived based on the intermediate key.
  • the communication keys include the radio resource control (RRC) signaling integrity protection key (Krrcint), the RRC signaling encryption key (Krrcenc), and the user plane encryption key (Kupenc), which are used for RRC signaling integrity protection, RRC signaling encryption, and data plane encryption, respectively.
  • RRC radio resource control
  • Krrcint the RRC signaling encryption key
  • Kupenc user plane encryption key
  • the core network device can determine at least one candidate target access network device for the terminal, and send at least one key pair for deriving the communication key to these candidate access network devices. Therefore, after the terminal indicated by the first information switches to any candidate target access network device among at least one candidate target access network device (referred to as the second access network device in this application), when switching occurs again, the second access network device can quickly derive a new intermediate key based on the previously received key pair without requesting the core network device to allocate new security parameters (also referred to as security context) for it, and then derive the communication key, thereby improving the efficiency of communication key derivation and improving the communication security between the terminal and the switched cell.
  • security context also referred to as security context
  • determining one or more candidate target access network devices for the terminal includes: determining one or more candidate target access network devices based on at least one of the following: a tracking area code (TAC) of the terminal; the location of the terminal; the location of the first access network device; or the communication duration expected by the terminal and the moving speed of the first access network device.
  • TAC tracking area code
  • the first access network device may be a mobile non-terrestrial network device such as a satellite.
  • the location of the first access network device is When the terminal accesses the first access network device, the location of the first access network.
  • the core network device may also determine the position of the first access network device when the terminal accesses the first access network device based on the moving path of the access network device and the time when the terminal accesses the first access network device.
  • the candidate target access network devices determined based on this method can cover all target access network devices that the terminal may access when switching occurs.
  • there are multiple candidate target access network devices and security parameters are sent to one or more candidate target access network devices, including: sending different key pairs to different candidate target access network devices, or sending the same key pair to different candidate target access network devices.
  • the core network device may send a key pair to each candidate target access network device, and each candidate target access network device receives a different key pair, which can improve the communication security of the terminal after subsequent switching.
  • the core network device may send multiple key pairs to each candidate target access network device, and the multiple key pairs received by each candidate target access network device are different from each other, and the key pairs received by different candidate target access network devices may be completely the same, completely different, or partially the same.
  • the access network device to which the terminal is currently connected may send an unused key pair to the target access network device, thereby avoiding the situation where the target access network device cannot derive a communication key and cannot encrypt the communication between the terminal and the subsequent switched cell due to the lack of a new key pair, and also avoiding the situation where the switching fails due to the lack of a new key pair in the target access network device.
  • the method further includes: sending indication information to the first access network device, where the indication information is used to indicate one or more candidate target access network devices.
  • the first access network device when it decides to switch the terminal to other target access network devices, it can determine the target access network device to which the terminal can switch based on the received indication information, so as to avoid switching failure when the terminal is switched to other access network devices that have not received the key pair sent by the core network device.
  • the method further includes: sending an identifier of the terminal to one or more candidate target access network devices.
  • the core network device sends the terminal identifier to the second access network device, which enables the candidate target access network device to determine which terminal the security parameter corresponds to when receiving the security parameter, thereby avoiding the situation where the same security parameter is used by multiple terminals at the same time.
  • a communication method is provided, which can be applied to an access network device.
  • it can be executed by the access network device, or it can be executed by a component configured in the access network device (such as a chip, a chip system, etc.), or it can be implemented by a logic module or software that can realize all or part of the functions of the access network device.
  • a component configured in the access network device such as a chip, a chip system, etc.
  • a logic module or software that can realize all or part of the functions of the access network device.
  • the method includes: receiving security parameters from a core network device, the security parameters including at least one key pair for deriving a communication key, the communication key being used to encrypt subsequent communications of the terminal after switching after the terminal accesses the second access network device; when switching occurs after the terminal accesses the second access network device, deriving the communication key based on a first key pair of the at least one key pair.
  • the second access network device is the target access network device for the terminal to re-access, and is also one of the one or more candidate target access network devices determined by the core network device.
  • Re-access can be understood as the terminal switching from the first access network device to the second access network device, or the terminal disconnecting from the first access network device and re-accessing the second access network device.
  • the second access network device can obtain at least one key pair for deriving a communication key in advance when it has not received an access request for the terminal.
  • the second access network device does not need to request the core network device to assign new security parameters to it, but can quickly derive a new intermediate key based on the previously received key pair, and then derive the communication key, thereby improving the efficiency of the communication key derivation and improving the communication security between the terminal and the subsequent switched cell.
  • the method further includes: receiving an identifier of the terminal from the core network device.
  • the second access network device can determine which terminal the security parameter corresponds to when receiving the identifiers of multiple terminals, thereby avoiding the situation where the same security parameter is used by multiple terminals at the same time.
  • the subsequent switching includes switching of the terminal within a cell or between cells managed by the second access network device, or switching of the terminal from the second access network device to a third access network device.
  • the second access network device sends a handover command to the terminal, and the target cell indicated in the handover command is the source cell.
  • This handover mode can be understood as a handover within a cell.
  • the third access network device may be an access network device accessed by the terminal after switching from the second access network device multiple times.
  • each key pair in at least one key pair includes a next hop (next hop, NH) and a next hop link counter (NH chaining count, NCC).
  • NH next hop
  • NCC next hop link counter
  • a communication method is provided, which can be applied to a core network device.
  • it can be executed by the core network device, or it can be executed by a component configured in the core network device (such as a chip, a chip system, etc.), or it can be implemented by a logic module or software that can implement all or part of the functions of the core network device.
  • a component configured in the core network device such as a chip, a chip system, etc.
  • a logic module or software that can implement all or part of the functions of the core network device.
  • the method includes: receiving first information from a first access network device, the first information including an identification of a terminal; sending security parameters to the first access network device, the security parameters including at least one key pair for deriving a communication key, the communication key being used to encrypt subsequent post-switching communications of the terminal after accessing a second access network device, the second access network device being a target access network device determined by the first access network device for the terminal.
  • the process of deriving communication keys in this application is: a key pair derives an intermediate key (such as KeNB), and a communication key is derived based on the intermediate key.
  • the communication key includes RRC signaling integrity protection key, RRC signaling encryption key, and user plane encryption key, which are used for RRC signaling integrity protection, RRC signaling encryption, and data plane encryption, respectively.
  • the core network device After receiving the first information containing the terminal identification, the core network device sends at least one key pair for deriving the communication key to the access network device that sent the first information.
  • the first access network device can send the received key pair to the second access network device. Therefore, when the terminal indicated by the first information switches again, the second access network device does not need to request the core network device to allocate new security parameters for it, but can directly derive a new intermediate key based on the key pair sent by the first access network device, and then derive the communication key, thereby improving the efficiency of the communication key derivation and improving the communication security between the terminal and the switched cell.
  • the method further includes: sending an identifier of the terminal to the first access network device.
  • the second access network device can determine which terminal the security parameter corresponds to when receiving the terminal identifier, thereby avoiding the situation where the same security parameter is used by multiple terminals at the same time.
  • a communication method is provided, which can be applied to an access network device.
  • it can be executed by the access network device, or it can be executed by a component configured in the access network device (such as a chip, a chip system, etc.), or it can be implemented by a logic module or software that can realize all or part of the functions of the access network device.
  • a component configured in the access network device such as a chip, a chip system, etc.
  • a logic module or software that can realize all or part of the functions of the access network device.
  • the method includes: sending first information to a core network device, the first information including an identifier of a terminal; receiving security parameters from the core network device; determining to switch the terminal to a second access network device; sending the security parameters to the second access network device, the security parameters including at least one key pair for deriving a communication key, the communication key being used to encrypt subsequent post-switching communications of the terminal after accessing the second access network device.
  • the first access network device can send the security parameters from the core network device to the second access network device when the terminal is actually switched to the second access network device, so that when the second access network device is switched after accessing the terminal, the second access network device can immediately derive a new intermediate key based on the key pair from the first access network device without requesting the core network device to allocate new security parameters for it, and then derive the communication key, thereby ensuring the communication security between the terminal and the cell after subsequent switching.
  • the method further includes: sending the identifier of the terminal from the core network device to the second access network device.
  • a communication method is provided, which can be applied to an access network device.
  • it can be executed by the access network device, or it can be executed by a component configured in the access network device (such as a chip, a chip system, etc.), or it can be implemented by a logic module or software that can realize all or part of the functions of the access network device.
  • a component configured in the access network device such as a chip, a chip system, etc.
  • a logic module or software that can realize all or part of the functions of the access network device.
  • the method includes: receiving security parameters from a first access network device, the security parameters including at least one key pair for deriving a communication key, the communication key being used to encrypt subsequent communications of the terminal after switching after the terminal accesses the second access network device; when switching occurs after the terminal accesses the second access network device, deriving the communication key based on a first key pair of the at least one key pair.
  • the second access network device can receive security parameters from the first access network device before accessing the terminal. Therefore, when the terminal accessed to the second access network device switches, the second access network device does not need to request the core network device to allocate new security parameters for it, but can quickly derive a new intermediate key based on the key pair from the first access network device, and then derive the communication key, thereby improving the efficiency of communication key derivation and improving the communication security between the terminal and the subsequent switched cell.
  • the method further includes: receiving an identifier of the terminal from the first access network device.
  • the subsequent switching includes switching of the terminal within a cell or between cells managed by the second access network device, or switching of the terminal from the second access network device to the third access network device.
  • each key pair in at least one key pair includes an NH and an NCC.
  • a communication method is provided, which can be applied to a core network device.
  • it can be executed by the core network device, or it can be executed by a component configured in the core network device (such as a chip, a chip system, etc.), or it can be implemented by a logic module or software that can realize all or part of the functions of the core network device.
  • a component configured in the core network device such as a chip, a chip system, etc.
  • a logic module or software that can realize all or part of the functions of the core network device.
  • the method includes: receiving first information from a first access network device, the first information including an identification of a terminal; determining one or more candidate target access network devices for the terminal; and sending integrity information to the one or more candidate target access network devices, the integrity information being used to perform security authentication on the terminal.
  • the core network device can determine at least one candidate target access network device for the terminal and send integrity information to these candidate access network devices. Therefore, when the terminal indicated by the first information accesses any one of the one or more candidate target access network devices, even if there is no communication between the core network device and the target access network device, it will not affect the first access network device's security authentication of the terminal, thereby improving communication security.
  • determining one or more candidate target access network devices for the terminal includes: determining the one or more candidate target access network devices based on: the tracking area code of the terminal; the location of the terminal; the location of the first access network device when the terminal accesses the first access network device; the moment when the terminal accesses the first access network device; the communication duration expected by the terminal and the moving speed of the first access network device.
  • the candidate target access network devices determined based on this method can cover all target access network devices that the terminal may access when reconstruction occurs.
  • the one or more candidate target access network devices include the first access network device.
  • sending an integrity message to the first access network device can reduce the probability of reconstruction failure when the terminal accesses the first access network device again.
  • the integrity information includes: at least one uplink non-access stratum integrity message authentication code (uplink-non access stratum-message authentication code, UL-NAS-MAC) and at least one downlink non-access stratum integrity message authentication code (downlink-non access stratum-message authentication code, DL-NAS-MAC).
  • uplink non-access stratum integrity message authentication code uplink-non access stratum-message authentication code, UL-NAS-MAC
  • downlink non-access stratum integrity message authentication code downlink-non access stratum-message authentication code
  • the integrity information also includes: at least one UL-uplink counter (count).
  • the method further includes: sending a cell identifier of a candidate cell corresponding to the integrity information to the one or more candidate target access network devices, the candidate cell being a cell managed by the one or more candidate target access network devices.
  • the target access network device of the cell can determine the integrity information corresponding to the cell identifier from the received integrity information to complete security authentication, thereby improving the reliability of security authentication.
  • a communication method is provided, which can be applied to an access network device.
  • it can be executed by the access network device, or it can be executed by a component configured in the access network device (such as a chip, a chip system, etc.), or it can be implemented by a logic module or software that can realize all or part of the functions of the access network device.
  • a component configured in the access network device such as a chip, a chip system, etc.
  • a logic module or software that can realize all or part of the functions of the access network device.
  • the method includes: receiving integrity information from a core network device, wherein the integrity information is used to perform security authentication on a terminal; receiving second information from a terminal, wherein the second information is used to request RRC reconstruction; and performing security authentication on the terminal based on the second information and the integrity information.
  • the terminal accesses any candidate target access network device among one or more candidate target access network devices, even if there is no communication between the core network device and the target access network device, it will not affect the first access network device's security authentication of the terminal, thereby ensuring communication security.
  • the second information includes: serving-temporary mobile subscriber identities (S-TMSI), uplink counter (UL-count) and UL-NAS-MAC.
  • S-TMSI serving-temporary mobile subscriber identities
  • UL-count uplink counter
  • UL-NAS-MAC serving-temporary mobile subscriber identities
  • the integrity information includes: at least one UL-NAS-MAC and at least one DL-NAS-MAC; the verification of the terminal based on the second information and the integrity information includes: when there is a UL-NAS-MAC in the at least one UL-NAS-MAC that is identical to the UL-NAS-MAC included in the second information, the verification is successful.
  • the integrity information also includes: at least one UL-count; the verification of the terminal based on the second information and the integrity information includes: when there is a UL-NAS-MAC in the at least one UL-NAS-MAC that is identical to the UL-NAS-MAC included in the second information and when there is a UL-count in the at least one UL-count that is identical to the UL-count included in the second information, the verification is successful.
  • the integrity information also includes: at least one UL-count, and there is a correspondence between the at least one UL-count, at least one UL-NAS-MAC and at least one DL-NAS-MAC, and the correspondence indicates that each UL-COUNT corresponds to one UL-NAS-MAC and one DL-NAS-MAC; the verification of the terminal based on the second information and the integrity information includes: if the UL-count in the integrity information is the same as the UL-count in the second information, and the UL-NAS-MAC corresponding to the UL-count in the integrity information is the same as the UL-NAS-MAC in the second information, then the verification is successful.
  • the method further includes: sending the DL-NAS-MAC in the integrity information to the terminal.
  • the method further includes: receiving a cell identifier of a candidate cell corresponding to the integrity information from the core network device, the candidate cell being a cell managed by the access network device.
  • the method further includes: based on the cell identifier of the first cell accessed by the terminal, determining the integrity information corresponding to the first cell from the cell identifiers of the candidate cells corresponding to the integrity information from the core network device.
  • a communication device including: a module for executing a method in any possible implementation of any of the above aspects.
  • the device includes a module for executing a method in any possible implementation of any of the above aspects.
  • the communication device may include a module or unit corresponding to the method/operation/step/action described in any of the above aspects, and the module or unit may be a hardware circuit, software, or a combination of hardware circuit and software.
  • the communication device is a communication chip.
  • the communication chip may include an input circuit or interface for sending information or data, and an output circuit or interface for receiving information or data.
  • the communication device is a core network device.
  • the core network device may include a transmitter for sending information or data, and a receiver for receiving information or data.
  • the core network device may include a module for executing the method in any possible implementation of the first aspect and/or the third aspect.
  • the communication device is an access network device.
  • the access network device may include a transmitter for sending information or data, and a receiver for receiving information or data.
  • the access network device may include a module for executing the method in any possible implementation of the second aspect, the fourth aspect, and/or the fifth aspect.
  • the communication device is used to execute the method in any possible implementation of any of the above aspects, and the communication device can be configured in an access network device or a core network device.
  • another communication device including a processor, wherein the processor is used to call and run the computer program from a memory, so that the communication device executes the method in any possible implementation of any of the above aspects.
  • processors there are one or more processors.
  • the communication device further comprises a memory for storing a computer program.
  • the memory may be integrated with the processor, or the memory may be separately arranged from the processor.
  • the communication device also includes a transmitter (transmitter) and a receiver (receiver), and the transmitter and the receiver can be set separately or integrated together, which is called a transceiver (transceiver).
  • a transmitter transmitter
  • a receiver receiver
  • the transmitter and the receiver can be set separately or integrated together, which is called a transceiver (transceiver).
  • a computer program product comprising: a computer program (also referred to as code, or instruction), which, when executed, enables a computer to execute a method in any possible implementation of any of the above aspects.
  • a computer-readable storage medium which stores a computer program (also referred to as code, or instruction) which, when executed on a computer, enables the computer to execute a method in any possible implementation of any of the above aspects.
  • a computer program also referred to as code, or instruction
  • a chip system which includes at least one processor for supporting the implementation of the functions involved in any aspect of the first aspect, such as receiving or processing the data involved in the above method.
  • the chip system also includes a memory, which is used to store program instructions and data, and the memory is located inside or outside the processor.
  • a communication system comprising a core network device and an access network device.
  • the core network device is used to implement the method in any possible implementation manner of the first aspect above, and the access network device is used to implement the method in any possible implementation manner of the second aspect above.
  • the core network device is used to implement the method in any possible implementation manner of the third aspect above, and the access network device is used to implement the method in any possible implementation manner of the fourth and fifth aspects above.
  • the core network device is used to implement the method in any possible implementation manner of the sixth aspect above, and the access network device is used to implement the method in any possible implementation manner of the seventh aspect above.
  • the communication system may also include other devices that interact with the core network device and/or access network device in the solution provided in this application.
  • FIG1 is a schematic diagram of the architecture of a communication system applicable to an embodiment of the present application.
  • FIG2 is a schematic flow chart of establishing a security context between a base station and a terminal in LTE;
  • FIG3 is a schematic flow chart of updating a key
  • FIG4 is a schematic flow chart of a key updating method during handover between base stations in LTE;
  • FIG5 is a schematic flow chart of a method for updating a key during cross-core network handover in LTE
  • FIG6 is a schematic diagram of a wireless access network architecture based on NTN
  • FIG7 is a schematic flow chart of a communication method provided in an embodiment of the present application.
  • FIG8 is a schematic flow chart of another communication method provided in an embodiment of the present application.
  • FIG9 is a schematic flow chart of another communication method provided in an embodiment of the present application.
  • FIG10 is a schematic flow chart of another communication method provided in an embodiment of the present application.
  • FIG11 is a schematic flow chart of another communication method provided in an embodiment of the present application.
  • FIG12 is a schematic flow chart of another communication method provided in an embodiment of the present application.
  • FIG13 is a schematic block diagram of a communication device provided in an embodiment of the present application.
  • FIG14 is a schematic block diagram of another communication device provided in an embodiment of the present application.
  • LTE long term evolution
  • FDD frequency division duplex
  • TDD LTE time division duplex
  • UMTS universal mobile telecommunications system
  • NR new radio
  • 5G fifth generation
  • FIG1 is a schematic diagram of the architecture of a communication system 10 applicable to an embodiment of the present application.
  • the communication system 10 includes a wireless access network 100 and a core network 200.
  • the communication system 10 may also include the Internet 300.
  • the wireless access network 100 may include at least one wireless access network device (such as 110a and 110b in FIG1 ), and may also include at least one terminal (such as 110a and 110b in FIG1 ). 120a-120j).
  • the terminal is connected to the wireless access network device by wireless means, and the wireless access network device is connected to the core network by wireless or wired means.
  • the core network device and the wireless access network device can be independent and different physical devices, or the functions of the core network device and the logical functions of the wireless access network device can be integrated on the same physical device, or the functions of part of the core network device and part of the wireless access network device can be integrated on one physical device. Terminals and wireless access network devices can be connected to each other by wire or wireless means.
  • Figure 1 is only a schematic diagram, and the communication system 10 can also include other network devices, such as wireless relay devices and wireless backhaul devices, which are not drawn in Figure 1.
  • the core network device refers to the device in the core network (CN) that provides service support for the terminal.
  • core network devices are: the access and mobility management function (mobile management entity, MME) entity in LTE.
  • AMF access and mobility management function
  • SMF session management function
  • UPF user plane function
  • the AMF entity can be responsible for the access management and mobility management of the terminal
  • the SMF entity can be responsible for session management, such as user session establishment, etc.
  • the UPF entity can be a functional entity of the user plane, mainly responsible for connecting to the external network.
  • the entity in the present application can also be referred to as a network element or a functional entity.
  • the AMF entity can also be referred to as an AMF network element or an AMF functional entity.
  • the SMF entity can also be referred to as an SMF network element or an SMF functional entity, etc.
  • the radio access network device in the embodiment of the present application refers to a radio access network (RAN) node (or device) that connects a terminal to a wireless network.
  • the radio access network device may be a base station, for example, an evolved NodeB (eNodeB), a transmission reception point (TRP), a next generation base station (next generation NodeB, gNB) in a fifth generation (5th generation, 5G) mobile communication system, a next generation base station in a sixth generation (6th generation, 6G) mobile communication system, a base station in a future mobile communication system, or an access node in a WiFi system.
  • eNodeB evolved NodeB
  • TRP transmission reception point
  • gNB next generation base station
  • 5G fifth generation
  • 6th generation, 6G sixth generation
  • a base station in a future mobile communication system or an access node in a WiFi system.
  • the radio access network device may also be a module or unit that performs some functions of a base station, for example, a centralized unit (CU) or a distributed unit (DU).
  • the centralized unit CU can also be divided into the control plane (CU-CP) and the user plane (CU-UP).
  • CU-CP is responsible for the control plane functions, mainly including radio resource control (RRC) and the packet data convergence protocol (PDCP) corresponding to the control plane, namely PDCP-C.
  • PDCP-C is mainly responsible for the encryption and decryption of the control plane data, integrity protection, data transmission, etc.
  • CU-UP is responsible for the user plane functions, mainly including the service data adaptation protocol (SDAP) and the PDCP corresponding to the user plane, namely PDCP-U.
  • SDAP is mainly responsible for processing the data of the core network and mapping the flow to the bearer.
  • PDCP-U is mainly responsible for the encryption and decryption, integrity protection, header compression, sequence number maintenance, data transmission, etc. of the data plane.
  • CU-CP and CU-UP are connected through the E1 interface.
  • CU-CP represents gNB and is connected to the core network through the NG interface. It is connected to DU through the F1 interface control plane, namely F1-C;
  • CU-UP is connected to DU through the F1 interface user plane, namely F1-U.
  • PDCP-C is also in CU-UP, or it can be a RAN device including CU nodes and DU nodes.
  • the wireless access network device can be a macro base station (such as 110a in Figure 1), a micro base station or an indoor station (such as 110b in Figure 1), a relay node or a donor node, etc.
  • the wireless access network device can also be an open radio access network (open-radio access network, O-RAN) device, which can include an open distributed unit (open-distributed unit, O-DU) and an open centralized unit (open-central unit, O-CU).
  • O-RAN open radio access network
  • wireless access network device in the present application can also be implemented by software functions running on hardware, or by virtualization functions instantiated on a platform (such as a cloud platform).
  • a platform such as a cloud platform.
  • the embodiments of the present application do not limit the specific technology and specific device form adopted by the wireless access network device.
  • the terminal in the embodiments of the present application may also be referred to as a terminal, a user equipment (UE), a mobile station, a mobile terminal, etc.
  • the terminal can be widely used in various scenarios, for example, device-to-device (D2D), vehicle-to-everything (V2X) communication, machine-type communication (MTC), Internet of Things (IOT), virtual reality, augmented reality, industrial control, automatic driving, telemedicine, smart grid, smart furniture, smart office, smart wear, smart transportation, smart city, etc.
  • D2D device-to-device
  • V2X vehicle-to-everything
  • MTC machine-type communication
  • IOT Internet of Things
  • virtual reality augmented reality
  • industrial control automatic driving
  • telemedicine smart grid
  • smart furniture smart office
  • smart wear smart transportation
  • smart city etc.
  • the terminal can be a mobile phone, a tablet computer, a computer with wireless transceiver function, a wearable device, a vehicle, a drone, a helicopter, an airplane, a ship, a robot, a mechanical arm, a smart home device, etc.
  • the embodiments of the present application do not limit the specific technology and specific device form adopted by the terminal.
  • the access network equipment and terminals can be fixed or movable.
  • the access network equipment and terminals can be deployed on land, including indoors or outdoors, handheld or vehicle-mounted; they can also be deployed on the water surface; they can also be deployed on airplanes, balloons, and artificial satellites in the air.
  • the embodiments of the present application do not limit the application scenarios of the access network equipment and terminals.
  • the terminal when the terminal performs uplink and downlink transmission with the access network device, the terminal needs to access the access network device managed by the access network device.
  • a service cell so that the terminal can communicate with the access network equipment.
  • the current service cell may not be able to provide services for the terminal, resulting in the terminal needing to switch to other service cells to provide services for it.
  • the following takes LTE as an example, and combines the examples shown in Figures 2 to 5 to illustrate the key update process in the handover process. It should be understood that the key update process in the handover process can also be extended to NR.
  • the UE is the terminal and the base station is the access network device for illustration.
  • FIG2 is a schematic flow chart of establishing a security context between a base station and a terminal in LTE. As shown in FIG2 , the method 20 includes S201 to S204. The steps shown in FIG2 are described in detail below.
  • S201, MME and UE will each derive an intermediate key (KeNB) through the root key (Kasme).
  • the above steps occur in a scenario where the UE initially accesses a base station (hereinafter referred to as a source base station (Source-eNB)).
  • a source base station hereinafter referred to as a source base station (Source-eNB).
  • the eNB that the UE initially accesses can be referred to as a source base station (Source-eNB).
  • MME sends an initial context setup request message to Source-eNB.
  • the request message carries the integrity protection algorithm and encryption algorithm set of KeNB and UE and is sent to .
  • the communication keys include the RRC signaling integrity protection key (Krrcint), the RRC signaling encryption key (Krrcenc), and the user plane encryption key (Kupenc), which are used for RRC signaling integrity protection, RRC signaling encryption, and data plane encryption, respectively.
  • Nrrcint the RRC signaling integrity protection key
  • Krrcenc the RRC signaling encryption key
  • Kupenc the user plane encryption key
  • S204 The Source-eNB and the UE complete the negotiation of the integrity protection algorithm and the encryption algorithm.
  • the signaling between Source-eNB and UE is integrity protected and encrypted, and the data is encrypted for transmission.
  • KeNB1 indicates the KeNB used before the switching
  • KeNB2 indicates the KeNB used after the switching.
  • NH is derived by the terminal and the core network device using a chain, that is, the NH generated this time will be used to generate the next NH, so that NH can be provided from the core network device to the access network device in a forward secure manner.
  • the core network device and the terminal derive KeNB and NH based on the root key.
  • the derived KeNB is used this time, and the derived NH is used to derive the next HN.
  • NCC is issued by the core network equipment and is associated with each KeNB and NH.
  • NCC is used to count the number of derivations of the NH key chain and the key chain between the synchronization terminal and the access network equipment, and to determine whether the next KeNB is derived from the current KeNB or from a new NH (derivation can also be called derivation).
  • Each KeNB is associated with the NCC corresponding to the NH.
  • the intermediate key can be derived from the currently activated intermediate key (called horizontal key derivation) or from NH (called vertical key derivation). Horizontal key derivation does not increase the NCC. Vertical key derivation increases the NCC.
  • PCI physical cell identifier
  • Fig. 4 is a schematic flow chart of a key updating method 400 during inter-base station handover in LTE. As shown in Fig. 4, the method 400 includes S401 to S410. The steps shown in Fig. 4 are described in detail below.
  • Source-eNB decides to perform handover between base stations and calculates an intermediate key.
  • the direct handover between base stations may also be referred to as X2 handover, where X2 is an interface between base stations eNB.
  • the above-mentioned intermediate key is derived through the current KeNB, the switching target cell PCI and the downlink frequency (for example, E-UTRA absolute radio frequency channel number (downlink E-UTRAN absolute radio frequency channel number, DlEarfcn)).
  • the derivation formula can be predefined, for example, predefined by the protocol. This application does not specifically limit the content of the derivation formula used.
  • Source-eNB sends a handover request message to the target base station (Target-eNB).
  • the handover request message carries the intermediate key and the NCC associated with the KeNB used to derive the intermediate key.
  • Target-eNB saves the intermediate key and NCC, and derives the communication key from the intermediate key.
  • the communication keys include keys Krrcint, Krrcenc, and Kupenc.
  • Target-eNB sends a handover request acknowledgement message to Source-eNB.
  • the request message carries the PCI, DlEarfcn and NCC of the target cell.
  • the Target-eNB generates a radio resource control (RRC) connection reconfiguration message, which may include the PCI and DlEarfcn of the target cell in the target PCI and carrier frequency (carrierFreq) information element in the mobility control information (mobility control info), and include the NCC in the NCC information element in the handover security configuration (security configHO), and then send the RRC connection reconfiguration message to the Source-eNB through the X2handover request acknowledgement message.
  • RRC radio resource control
  • Source-eNB sends a radio resource control (RRC) connection reconfiguration message to UE.
  • RRC connection reconfiguration message carries the PCI, DlEarfcn and NCC of the target cell.
  • the RRC connection reconfiguration message is an RRC connection reconfiguration message generated by Target-eNB and sent to Source-eNB.
  • the UE derives an intermediate key based on the RRC connection reconfiguration message, and derives a communication key (Krrcint, Krrcenc, Kupenc) from the intermediate key.
  • the UE sends an RRC connection reconfiguration complete message to the Target-eNB, and the RRC connection reconfiguration complete message is secured and encrypted by the key derived in S406.
  • the Target-eNB receives the RRC connection reconfiguration complete message and decrypts and performs integrity check on the message using the key derived in S403.
  • the intermediate key calculated by the Source-eNB in S401 and the intermediate key calculated by the UE in S406 must be the same. Otherwise, a key error will occur and the UE handover will fail.
  • Target-eNB sends a path switch request message to MME.
  • MME receives the path switch request message, increases the locally saved NCC by 1, and then derives a new NH based on the root key and the current NH to form a new ⁇ NH, NCC ⁇ pair for storage.
  • MME sends a path switch request acknowledgement message to Target-eNB, and the path switch request response message carries the newly derived ⁇ NH, NCC ⁇ pair.
  • Target-eNB receives the path switch request response message and saves the ⁇ NH, NCC ⁇ pair.
  • Target-eNB sends a UE context release message to Source-eNB.
  • Source-eNB receives the context release message and releases the UE context, and X2 handover is completed.
  • Fig. 5 is a schematic flow chart of a method 500 for updating a key during cross-core network handover in LTE. As shown in Fig. 5 , the method 500 includes S501 to S509 , and each step shown in Fig. 5 is described in detail below.
  • Source-eNB decides to perform cross-core network handover. That is, perform S1 handover, S1 is the interface between the wireless network and the core network.
  • Source-eNB sends a handover required message to MME.
  • MME receives the handover required message, and based on the handover required message, increases the locally stored NCC by 1, and then derives a new NH based on the original Kasme and the current NH to form a new ⁇ NH, NCC ⁇ pair for storage.
  • MME sends a handover request message to Target-eNB, and the handover request message carries a new ⁇ NH, NCC ⁇ pair.
  • Target-Cell receives the request message, saves the new ⁇ NH, NCC ⁇ pair, and derives the key KeNB*, and further derives Krrcint, Krrcenc, and Kupenc.
  • Target-eNB sends a handover request confirmation message to MME, and the request response message carries the PCI, DlEarfcn and NCC of the target cell.
  • the Target-eNB may generate a radio resource control (RRC) connection reconfiguration message, include the PCI and DlEarfcn of the target cell in the targetPCI and carrierFreq information elements in the mobility control info, include the NCC in the NCC information element in the Security ConfigHO, and send the RRC connection reconfiguration message to the MME through the handover request confirmation message of S1.
  • RRC radio resource control
  • MME sends a handover command message to Source-eNB.
  • the handover command message carries the PCI, DlEarfcn and NCC of the target cell.
  • the handover command message sent by MME to Source-eNB carries the RRC connection reconfiguration message generated by Target-eNB.
  • Source-eNB sends an RRC connection reconfiguration message to the UE.
  • the RRC connection reconfiguration message carries the PCI, DlEarfcn and NCC of the target cell.
  • the UE receives the RRC connection reconfiguration message and obtains the NCC based on the received message.
  • the RRC connection reconfiguration message is an RRC connection reconfiguration message generated by the Target-eNB and sent to the Source-eNB through the MME.
  • the UE Since the acquired NCC value is inconsistent with the locally stored NCC value, the UE needs to first synchronize the NCC value and obtain the synchronized NH to obtain the ⁇ acquired NCC, synchronized NH ⁇ pair. At this time, the ⁇ acquired NCC, synchronized NH ⁇ pair is consistent with the ⁇ NH, NCC ⁇ pair stored in the Target-Cell in S503.
  • the UE adds 1 to the local NCC value and calculates the corresponding synchronized NH value (for example, deriving a new NH based on the root key and the current NH) until the local NCC value is the same as the NCC value in the RRC connection reconfiguration message.
  • the UE obtains the ⁇ NCC in the RRC connection reconfiguration message, synchronized NH ⁇ pair
  • the UE derives the intermediate key based on the derived ⁇ NCC in the RRC connection reconfiguration message, synchronized NH ⁇ pair, and the target cell PCI and DlEarfcn received in the RRC connection reconfiguration message.
  • the communication keys Krrcint, Krrcenc, and Kupenc are then derived from the intermediate key.
  • Target-Cell uses the key obtained in S503 to decrypt and perform integrity check on the RRC connection reconfiguration complete message.
  • Target-eNB sends a handover notify message to MME.
  • MME receives the handover notify message.
  • MME sends a UE context release message to Source-eNB.
  • Source-eNB receives the message and releases the UE context, and S1 handover is completed.
  • the target base station uses the intermediate key sent by the source base station.
  • the target base station uses the new ⁇ NH, NCC ⁇ pair sent by the core network to derive a new intermediate key.
  • the UE and the target base station use the new intermediate key to derive the communication keys Krrcint, Krrcenc, and Kupenc.
  • a handover failure may occur, in which case the UE will initiate RRC reconstruction.
  • the UE will also trigger RRC reconstruction.
  • the detection of radio link failure includes, for example, detecting that the downlink signal quality is lower than a threshold value, detecting that the number of retransmissions of uplink data packets at the radio link control (RLC) layer reaches a threshold value, and detecting a random access failure.
  • RLC radio link control
  • the UE may select a cell for reestablishment and send an RRC reestablishment request to the base station where the cell (the cell can be called a new cell) is located.
  • the new cell may not be the target cell corresponding to the handover request initiated by the network side. Therefore, when the UE undergoes RRC reestablishment, in order to ensure the security of communication, the network side needs to verify the UE (or security authentication).
  • NB-IoT narrowband internet of things
  • the access layer will be encrypted, and the other is that the access layer is not encrypted (for example, NB-IoT data transmission through the control plane).
  • the access layer is not encrypted, in order to protect the RRC reestablishment process (that is, it is necessary to verify which UE is the UE for RRC reestablishment), the following mechanism can be used for verification:
  • Step 1 The UE access layer sends the cell identity of the new cell being reestablished in RRC to the NAS of the UE.
  • Step 2 The NAS of the UE calculates the first 16 bits (called UL-NAS-MAC) and the last 16 bits (called XDL-NAS-MAC) of NAS-MAC.
  • Step 3 The UE's NAS provides the S-TMSI (or truncated 5G-S-TMSI) to the UE's AS for calculating the 5 least significant bits (LSB) of NAS-count of NAS-MAC and UL-NAS-MAC.
  • S-TMSI or truncated 5G-S-TMSI
  • Step 4 The UE sends an RRC reestablishment request message to the new cell (i.e., the cell corresponding to the RRC reestablishment request), and carries the S-TMSI (or truncated 5G-S-TMSI) in the message, which is used to calculate the 5 less important bits of NAS COUNT of NAS-MAC, and UL-NAS-MAC.
  • the new cell i.e., the cell corresponding to the RRC reestablishment request
  • S-TMSI or truncated 5G-S-TMSI
  • Step 5 The base station corresponding to the new cell sends S-TMSI (or truncated 5G-S-TMSI) to the core network, which is used to calculate the 5 less important bits of NAS COUNT of NAS-MAC, UL-NAS-MAC, and cell identify of the new cell.
  • S-TMSI or truncated 5G-S-TMSI
  • Step 6 The core network estimates the uplink complete NAS-count based on the five less significant bits of NAS-count received from the base station for calculating NAS-MAC, and calculates XNAS-MAC.
  • the core network uses the same input as the UE side when calculating XNAS-MAC (ie, estimated uplink NAS count, direction bit set to 0, and the cell identity of the new cell as the message).
  • XNAS-MAC ie, estimated uplink NAS count, direction bit set to 0, and the cell identity of the new cell as the message.
  • Step 7 The core network compares the first 16 bits of NAS-MAC with the UL-NAS-MAC reported by the UE received from the base station. If they are the same, the verification is successful. After that, the core network sends the last 16 bits of NAS-MAC (called DL-NAS-MAC) to the base station corresponding to the new cell, and the base station corresponding to the new cell sends it to the UE, and the UE also verifies (checks whether it is the same as the XDL-NAS-MAC saved by the UE). If they are the same, the UE has completed the RRC reconstruction process.
  • DL-NAS-MAC the last 16 bits of NAS-MAC
  • the key update during switching in NR is basically the same as that in LTE, except that the root key (Kamse) is changed to KAMF, KeNB is changed to KgNB, X2 is changed to Xn, and S1 is changed to NG.
  • Kamse root key
  • KeNB is changed to KgNB
  • X2 is changed to Xn
  • S1 is changed to NG.
  • KgNB when performing cell switching within the base station of NR, there is no need to update KgNB.
  • NTN-based radio access networks With the widespread use of NTN, terminals can use NTN-based radio access networks (RAN) for communication.
  • RAN radio access networks
  • the following introduces NTN-based radio access networks using satellite communication as an example of NTN.
  • Satellites Based on the functions provided by satellites in the radio access network, it can be divided into four types: 1. Satellites act as relay units, providing wireless frequency filtering, frequency conversion and amplification; 2. Satellites act as base stations to provide services for terminals; 3. Satellites act as gNB-DU; 4. Satellites act as integrated access and backhaul (IAB).
  • IAB integrated access and backhaul
  • NTN systems can also include non-ground network devices such as high altitude platforms (HAPS), and the non-ground network devices involved in this application are not limited to the above examples.
  • the non-ground network devices in this application can also be referred to as aerial network devices.
  • HAPS high altitude platforms
  • FIG6 shows a wireless access network architecture 600 based on NTN.
  • the satellite 620 is used as an access network device, the terminal 610 can communicate with the satellite 620 through the Uu interface, the satellite 620 and the NTN gateway 630 are devices in the access network, and the satellite 620 can communicate with the core network 640 through the NG interface.
  • Scenario 1 the deployment of the NTN gateway can cover all satellites in orbit, that is, all satellites can establish an interface (for example, S1, NG interface) with the core network through the gateway.
  • scenario 2 due to reasons such as operator planning or geographical area restrictions (such as being unable to be deployed on the sea), the deployment of the NTN gateway cannot cover all satellites, resulting in satellites in some areas being unable to establish a feeder link through the NTN gateway, that is, the satellite cannot exchange information with the core network, resulting in the terminal being unable to initiate a NAS connection to the core network through the satellite, and the satellite cannot exchange terminal signaling with the core network. Therefore, the terminal in this area cannot enjoy the services of the network device.
  • scenario 2 can also be referred to as a store and forward mode.
  • the non-terrestrial network device when it cannot exchange signals with the core network device, it can receive and save signals (such as NAS signals) or data from the terminal, and forward the signals or data from the terminal to the core network device when the non-terrestrial network device moves to an area where it can exchange information with the core network device.
  • the store-and-forward mode also includes the non-terrestrial network device receiving and saving signals or data about the terminal from the core network when it can exchange signals with the core network device, and forwarding the signals or data about the terminal from the core network to the terminal when the non-terrestrial network device moves to an area that can cover the terminal.
  • the store-and-forward mode can be defined as an operating mode of the NTN access system, in which the NTN access system cannot provide a feeder link connected to the NTN gateway, but can still provide communication services to users under the access network device.
  • the access network device where the target cell (the cell that the terminal re-accesses after switching) is located and/or the access network device where the source cell (the serving cell before switching) is located may not be within the coverage of the NTN gateway, so it is impossible to implement cell switching and key update according to the methods shown in Figures 2 to 5 above.
  • the access network device where the target cell is located (hereinafter referred to as the target access network device) obtains a new security context to ensure the security of communication becomes an urgent problem to be solved.
  • the embodiment of the present application provides a communication method and related devices, and the core network device can determine at least one candidate target access network device for the terminal after receiving the first information containing the terminal identification, and send at least one key pair for deriving the communication key to these candidate access network devices, so that after the terminal indicated by the first information accesses the second access network device (referred to as the second access network device in this application), even if the second access network device is not within the service range of the gateway, it will not affect the second access network device from obtaining security parameters.
  • the second access network device referred to as the second access network device in this application
  • the second access network device can quickly derive a new intermediate key based on the received key pair, and then derive the communication key, thereby improving the efficiency of the communication key derivation and improving the communication security between the terminal and the access network device after the subsequent switch.
  • indication may include direct indication and indirect indication, and may also include explicit indication and implicit indication.
  • the information indicated by a certain information is called information to be indicated.
  • the information to be indicated may also be indirectly indicated by indicating other information, wherein the other information has an association with the information to be indicated. It is also possible to indicate only a part of the information to be indicated, while the other parts of the information to be indicated are known or agreed in advance.
  • the indication of specific information can be achieved by using the arrangement order of each piece of information that is pre-agreed (eg, specified by a protocol), thereby reducing indication overhead to a certain extent.
  • predefinition can be implemented by pre-saving corresponding codes, tables or other methods that can be used to indicate relevant information in a device (for example, including a terminal and a network device), and this application does not limit its specific implementation method.
  • the “protocol” involved in the embodiments of the present application may refer to a standard protocol in the communication field, for example, it may include an LTE protocol, an NR protocol, and related protocols used in future communication systems, and the present application does not limit this.
  • multiple means two or more.
  • “And/or” describes the association relationship of associated objects, indicating that three relationships may exist.
  • a and/or B can mean: A exists alone, A and B exist at the same time, and B exists alone, where A and B can be singular or plural.
  • the character “/” generally indicates that the associated objects before and after are in an "or” relationship.
  • “At least one of the following” or similar expressions refers to any combination of these items, including any combination of single or plural items.
  • At least one of a, b and c can mean: a, or b, or c, or a and b, or a and c, or b and c, or a, b and c, where a, b, c can be single or plural.
  • the communication method provided in the embodiment of the present application is described in detail below in conjunction with Figures 7 to 12.
  • the method can be applied to the communication system 10 shown in Figure 1 and the architecture 600 shown in Figure 6, but the embodiment of the present application is not limited thereto.
  • the access network device may also be a chip, a chip system, or a processor that supports the access network device to implement the method, or a logic module or software that can implement all or part of the functions of the access network device;
  • the core network device may also be a chip, a chip system, or a processor that supports the core network device to implement the method, or a logic module or software that can implement all or part of the functions of the core network device.
  • the present application does not limit the form of the subject of the interaction.
  • Fig. 7 is a schematic flow chart of a communication method 700 provided in an embodiment of the present application. As shown in Fig. 7, the method 700 may include S701 to S703. Each step in the method 700 is described in detail below.
  • a first access network device sends first information to a core network device, where the first information includes an identifier of a terminal.
  • the core network device receives the first information.
  • the first access network device in the embodiment of the present application may be the satellite 620 in FIG. 6 , or other non-ground network devices, such as a high altitude platform (HAPS) device.
  • HAPS high altitude platform
  • the first access network device is the source access network device of the terminal switching.
  • the first information can also be used to indicate that the terminal has accessed the first access network device, or to indicate that the terminal has accessed the first access network device.
  • the terminal identifier can be sent by the terminal to the first access network device, and then sent by the first access network device to the core network device.
  • the terminal identifier can also be an identifier assigned by the first access network device or the core network device to the terminal at the interface between the first access network device and the core network device.
  • the core network device determines one or more candidate target access network devices for the terminal.
  • the candidate target access network device is a target access network device to which the terminal may switch.
  • one or more candidate target access network devices may be determined by the core network device based on at least one of the following: the TAC of the terminal; the location of the terminal; the location of the first access network device when the terminal accesses the first access network device; the time when the terminal accesses the first access network device; the communication duration expected by the terminal and the moving speed of the first access network device. It should be understood that the above information used to determine the candidate target access network device may be sent by the first access network device to the core network device.
  • the process of the core network device determining the candidate target access network device based on the communication duration expected by the terminal and the moving speed of the first access network device is as follows: the terminal sends its expected communication duration to the first access network device; the first access network device sends the communication duration to the first access network device; The core network device estimates one or more candidate target base stations to which the terminal may switch based on the communication time and the moving speed of the first access network device (eg, a satellite).
  • the terminal sends its expected communication duration to the first access network device
  • the first access network device sends the communication duration to the first access network device
  • the core network device estimates one or more candidate target base stations to which the terminal may switch based on the communication time and the moving speed of the first access network device (eg, a satellite).
  • the core network device sends security parameters to one or more candidate target access network devices, where the security parameters include at least one key pair used to derive a communication key.
  • the one or more candidate target access network devices receive the security parameters.
  • the second access network device belongs to one or more candidate target access network devices, and the communication key derived from at least one key pair sent to the second access network device is used to encrypt subsequent post-switching communications of the terminal after accessing the second access network device.
  • the terminal switches to the second access network device, that is, the terminal accesses the second access network device, and the switch occurs after accessing the second access network device.
  • the second access network device can derive the communication key based on the first key pair of at least one received key pair (that is, derive the intermediate key by vertically deriving the key, and then derive the communication key based on the intermediate key).
  • the communication key derived from the first key pair is used to encrypt the communication between the terminal and the target access network device after the switch. For example, if the terminal switches from the second access network device to the third access network device, the communication key derived from the first key pair is used to encrypt the communication between the terminal and the third access network device.
  • the core network device sends security parameters to one or more candidate target access network devices before the terminal accesses the one or more candidate target access network devices.
  • the security parameters including at least one key pair for deriving a communication key may also be referred to as a security context, or other names, which are not limited in the embodiment of the present application.
  • each key pair in the at least one key pair includes NH and NCC, that is, the ⁇ NH, NCC ⁇ pair mentioned above.
  • the process of deriving the communication key based on the ⁇ NH, NCC ⁇ pair can refer to the relevant descriptions in Figures 2 to 5 above.
  • the above communication keys refer to Krrcint, Krrcenc and Kupenc shown above.
  • the core network device after receiving the first information containing the terminal identification, can determine at least one candidate target access network device for the terminal, and send at least one key pair for deriving a communication key to these candidate access network devices.
  • the second access network device does not need to request the core network device to assign new security parameters to it, but can quickly derive a new intermediate key based on the previously received key pair (that is, derive the intermediate key by vertically deriving the key), and then use it to derive the communication key, thereby improving the efficiency of the communication key derivation and improving the communication security between the terminal and the access network device after the subsequent switch.
  • the terminal initiates initial access at access network device #1 and successfully accesses access network device #1.
  • access network device #1 will send the identifier of the connected terminal to the core network device.
  • the core network device determines the terminal corresponding to the terminal based on the identifier of the terminal, and predicts that the terminal may subsequently switch to access network device #2 or access network device #3 based on the TAC of the terminal, or the location of the terminal, or the location of access network device #1 when the terminal accesses the first access network device, or at least one of the information at the moment when the terminal accesses the first access network device.
  • the access network device #2 and access network device #3 here are the above-mentioned candidate target access network devices.
  • the core network will send the ⁇ NH, NCC ⁇ pair corresponding to access network device #2 and access network device #3 to access network device #2 and access network device #3 in advance.
  • the subsequent switching includes switching of the terminal within a cell managed by the second access network device or between cells, or switching of the terminal from the second access network device to a third access network device.
  • the second access network device sends a switching command to the terminal, and the target cell indicated in the switching command is the source cell.
  • This switching method can be understood as switching within the cell; or, the terminal has a wireless link failure in the source cell, and when it is rebuilt again, the cell for rebuilt access is still the source cell. This method can also be understood as switching within the cell.
  • the terminal switching from the second access network device to the third access network device may be that the terminal switches from the second access network device to the third access network device after one or more switches.
  • the process of the terminal switching from the second access network device to the third access network device may include switching within the access network device and switching between access network devices. For example, after accessing the second access network device, the terminal first switches within the cell managed by the second access network device or between cells, and then switches to the third access network device.
  • the intermediate key can be derived by horizontally deriving the key, or the intermediate key can be derived by vertically deriving the key.
  • the second access network device may forward unused key pairs to other target access network devices after the terminal is switched when the terminal is switched.
  • the method 700 further includes: S704, the core network device sends the identifier of the terminal to one or more candidate target access network devices.
  • the one or more candidate target access network devices receive the identifier of the terminal.
  • the number of terminals accessed by the second access network device (a candidate target access network device among one or more candidate target access network devices) can be multiple. Therefore, when the core network device sends security parameters to the second access network device, it can also indicate the terminal identifier so that the second access network device can determine which terminal the received security parameters are used for switching.
  • the terminal identifier sent by the core network device to the second access network device and the terminal identifier included in the first information received by the core network from the first access network device may be the same or different, wherein the different terminal identifiers refer to different identification methods used to identify the same terminal.
  • the first access network device may send the terminal identifier included in the first information to the second access network device.
  • S704 when S704 is executed, the present application does not limit the execution order of S704 and S703.
  • S703 may be executed first and then S704; S704 may be executed first and then S703; or S703 and S704 may be executed simultaneously.
  • security parameters are sent to one or more candidate target access network devices, including: sending different key pairs to different candidate target access network devices, or sending the same key pair to different candidate target access network devices.
  • the core network device may send a key pair to each candidate target access network device, and each candidate target access network device receives a different key pair, which can improve the communication security of the terminal after subsequent switching.
  • the core network device can send multiple key pairs to each candidate target access network device, and the multiple key pairs received by each candidate target access network device are different from each other.
  • the key pairs received by different candidate target access network devices can be completely the same, completely different, or partially the same.
  • the target access network device can send unused key pairs to other access network devices, avoiding the inability to derive communication keys and encrypt communications between the terminal and other access network devices due to the lack of new key pairs in other access network devices, and also avoiding the failure of switching due to the lack of new key pairs in other access network devices.
  • the terminal accesses the second access network device
  • the second access network device when the second access network device cannot exchange signaling with the core network device, it can receive and save signaling or data from the terminal, and forward the signaling or data from the terminal to the core network device when the second access network device moves to an area where it can exchange information with the core network device.
  • the second access network device When the second access network device can exchange signaling with the core network device, it receives and saves signaling or data about the terminal from the core network, and when the second access network device moves to an area that can cover the terminal, the second access network device forwards signaling or data about the terminal from the core network to the terminal.
  • the second access network device when the terminal accesses the second access network device, the second access network device does not establish a feeder link through the NTN gateway, and thus information cannot be exchanged between the second access network device and the core network.
  • the method 700 further includes: S705, the core network device sends indication information to the first access network device, the indication information is used to indicate one or more candidate target access network devices.
  • the first access network device receives the indication information.
  • the first access network device when it decides to switch the terminal to other target access network devices, it can determine the target access network device to which the terminal can switch based on the received indication information, so as to avoid switching failure caused by the terminal switching to other access network devices that have not received the key pair sent by the core network device.
  • step S705 when step S705 is executed, the present application does not limit the execution order of S705 and S703.
  • S703 can be executed first and then S705; S705 can also be executed first and then S703, or S703 and S705 can be executed at the same time.
  • the method 700 further includes: S706, the core network device sends the terminal identifier to the first access network device, and the terminal identifier is sent by the core network device to one or more candidate target access network devices (i.e., the terminal identifier sent in S704).
  • the first access network device decides to switch the terminal to the target access network device
  • the first access network device sends the terminal identifier received from the core network device to the target access network device, so that the target access network device finds the security parameters corresponding to the terminal received from the core network device according to the terminal identifier.
  • step S706 when step S706 is executed, the present application does not limit the execution order of S706 and S703.
  • S703 can be executed first and then S706; S706 can also be executed first and then S703, or S703 and S706 can be executed at the same time.
  • Fig. 8 is a schematic flow chart of another communication method 800 provided in an embodiment of the present application. As shown in Fig. 8, the method 800 includes S801 to S804. Each step in the method 800 is described in detail below.
  • a first access network device sends first information to a core network device, where the first information includes an identifier of a terminal.
  • the core network device receives the first information.
  • the core network device sends security parameters to the first access network device, where the security parameters include at least one key pair used to derive a communication key.
  • the first access network device receives the security parameters.
  • the communication key is used to encrypt subsequent communication after the terminal accesses the second access network device, and the second access network device is the target access network device determined by the first access network device for the terminal.
  • the communication key can also be used to encrypt the communication of the terminal after switching within the cell managed by the first access device or between cells.
  • the intermediate key can be derived by horizontal key derivation or by vertical key derivation, and then the communication key can be derived based on the intermediate key.
  • S803 The first access network device determines to switch the terminal to the second access network device.
  • S804 The first access network device sends the security parameter to the second access network device.
  • the second access network device receives the security parameter.
  • the first access network device may send only the key pair that has not been used in the security parameters to the second access network device.
  • the core network device after receiving the first information containing the terminal identifier, the core network device sends at least one key pair for deriving a communication key to the access network device that sends the first information.
  • the terminal corresponding to the terminal identifier contained in the first information switches to the second access network device (the first access network device is the target access network device determined by the terminal), the received key pair can be sent to the second access network device.
  • the second access network device can quickly derive a new intermediate key based on the key pair sent by the first access network device (that is, derive the intermediate key by vertically deriving the key), and then derive the communication key, thereby improving the derivation efficiency of the communication key and improving the communication security between the terminal and the access network device after the subsequent switch.
  • the method 800 also includes: S805, the core network device sends the terminal identifier to the first access network device.
  • the first access network device receives the terminal identifier and sends the terminal identifier to the second access network device.
  • the number of terminals accessed in the first access network device may be multiple. Therefore, when the core network device sends security parameters to the first access network device, it can also indicate the terminal identifier so that the first access network device can determine which terminal the received security parameters are used for switching.
  • each key pair in at least one key pair includes NH and NCC, that is, the ⁇ NH, NCC ⁇ pair mentioned above.
  • the process of deriving the communication key based on the ⁇ NH, NCC ⁇ pair can refer to the relevant descriptions in the above-mentioned Figures 2 to 5.
  • the subsequent switching includes switching of the terminal within a cell managed by the second access network device or between cells, or switching of the terminal from the second access network device to a third access network device.
  • the communication method provided by the present application may include: the core network device simultaneously sends security parameters to the first access network device and one or more candidate target access network devices.
  • the detailed process can refer to the description of the embodiments shown in Figures 7 and 8 above.
  • Fig. 9 is a schematic flow chart of another communication method 900 provided in an embodiment of the present application. As shown in Fig. 9, the method 900 includes S901 to S911. The steps shown in Fig. 9 are described in detail below.
  • a source base station sends first information to a core network device.
  • the core network device receives the first information, where the first information includes an identifier of a terminal.
  • the core network device sends security parameters to multiple candidate target base stations.
  • the multiple candidate target base stations receive the security parameters.
  • the security parameters include a key pair for deriving a communication key.
  • Each key pair in a key pair includes NH and NCC. That is, the ⁇ NH, NCC ⁇ pair mentioned above.
  • the process of deriving a communication key based on the ⁇ NH, NCC ⁇ pair can refer to the relevant descriptions in the above Figures 2 to 5.
  • the security parameters may carry the identifier of the terminal.
  • the core network device needs to determine a candidate target base station for the terminal corresponding to the terminal identifier included in the first information.
  • the specific determination process can refer to the relevant description in S702 above, which will not be repeated here.
  • the following takes the example of the terminal switching from the source base station to the first target base station (one of multiple candidate target base stations) and the second target base station (one of the remaining candidate target base stations among multiple candidate target base stations except the first target base station) in sequence to explain in detail the key update process during the switching process.
  • the terminal switches from the source base station to the first candidate target base station.
  • the first candidate target base station decides to perform inter-base station handover and derives an intermediate key based on the NH in the received key pair.
  • the first candidate target base station sends a handover request message to the second candidate target base station.
  • the handover request message carries the intermediate key and the NCC associated with the NH used to derive the intermediate key.
  • the second candidate target base station saves the intermediate key and the NCC, and derives a communication key based on the intermediate key.
  • the second candidate target base station sends a handover request confirmation message to the first candidate target base station.
  • the request message carries the PCI, DlEarfcn and NCC of the target cell.
  • the first candidate target base station sends an RRC connection reconfiguration message to the terminal.
  • the RRC connection reconfiguration message carries the PCI, DlEarfcn and NCC of the target cell.
  • S909 The terminal determines whether the locally stored NCC value is the same as the NCC value in the RRC connection reconfiguration message.
  • the terminal first synchronizes the NCC value and calculates the corresponding NH so that the NCC value on the terminal is the same as the NCC value in the RRC reconfiguration message, and executes S910.
  • the above-mentioned process of synchronizing the NCC value and the NH may refer to the relevant description in the above-mentioned method 500, which will not be repeated here.
  • the terminal derives an intermediate key and a communication key based on the NH corresponding to the value of the NCC in the RRC reconfiguration message.
  • the terminal sends an RRC reconfiguration completion message to the second candidate target base station, and encrypts the message using the derived communication key.
  • the second candidate target base station receives the message and decrypts it using the communication key derived by the terminal (ie, the communication key derived in S906).
  • the terminal successfully accesses the second candidate target base station.
  • the first candidate target base station when multiple key pairs for deriving communication keys are included in the security parameters, combined with the example shown in FIG. 9 above, when the terminal switches from the first candidate target base station to the second candidate target base station, the first candidate target base station can give priority to using the NH corresponding to the NCC with a smaller NCC value among the multiple key pairs to derive the intermediate key, thereby continuing to execute subsequent steps.
  • the first candidate target base station when the first candidate target base station sends a switching request message to the second candidate target base station, it can send the unused key pairs together to the second candidate target base station.
  • the core network device after receiving the first information containing the terminal identification, can determine at least one candidate target base station for the terminal and send a key pair for deriving the communication key to these candidate target base stations.
  • the second candidate target base station after the terminal indicated by the first information switches to the first candidate target base station among at least one candidate target base station, when it switches to the second candidate target again, the second candidate target base station does not need to request the core network device to allocate new security parameters for it, but can quickly derive a new intermediate key based on the previously received key pair, and then derive the communication key, thereby improving the efficiency of the communication key derivation and improving the communication security between the terminal and the second candidate target base station.
  • the following takes the example of a first access network device receiving multiple key pairs as an example, and describes in detail the communication method provided in an embodiment of the present application in combination with FIG10 .
  • Fig. 10 is a schematic flow chart of another communication method 1000 provided in an embodiment of the present application. As shown in Fig. 10, the method 1000 includes S1001 to S1007. The steps shown in Fig. 10 are described in detail below.
  • a source base station sends first information to a core network device.
  • the core network device receives the first information, where the first information includes an identifier of a terminal.
  • the core network device sends a security parameter to the source base station.
  • the source base station receives the security parameter.
  • the security parameters include at least one key pair for deriving the communication key.
  • Each key pair in each key pair includes NH and NCC. That is, the ⁇ NH, NCC ⁇ pair mentioned above.
  • the process of deriving the communication key based on the ⁇ NH, NCC ⁇ pair can refer to the relevant descriptions in the above Figures 2 to 5.
  • the core network device needs to send an intermediate key to the source base station.
  • the core network device may also send the above security parameters to the source base station.
  • the security parameters sent by the core network device to the source base station include an identifier of the terminal.
  • the source base station decides to execute the handover between base stations and calculates the intermediate key.
  • the source base station sends a handover request message to the first target base station, and carries a security parameter.
  • the security parameter may also be sent independently without being attached to the handover request message.
  • the terminal switches from the source base station to the first target base station.
  • the first target base station decides to perform handover between base stations, and derives an intermediate key based on the first NH in the received key pair.
  • the first NH is the NH in the key pair.
  • the security parameters received by the first target base station include multiple key pairs
  • the first NH can be the NH in the key pair with the smallest NCC value among the multiple key pairs.
  • the terminal switches from the first target base station to the second target base station.
  • the first candidate target base station includes multiple key pairs
  • the first candidate target base station when the first candidate target base station sends a handover request message to the second candidate target base station, the unused key pairs may be sent to the second candidate target base station.
  • the core network device after receiving the first information containing the terminal identification, sends multiple key pairs for deriving communication keys to the source base station that sends the first information.
  • the source base station sends the received key pair to the first target base station.
  • the first target base station does not need to request the core network device to allocate new security parameters for it, but can directly derive a new intermediate key based on the key pair sent by the source base station, and then derive the communication key, thereby improving the efficiency of the communication key derivation and improving the communication security between the terminal and the second target base station.
  • the key pair used to derive the communication key is determined by the source access network device.
  • the key pair used to derive the communication key can also be determined by the terminal.
  • the method flow of the terminal determining the key pair used to derive the communication key in the switching process is introduced below.
  • Fig. 11 is a schematic flow chart of another communication method 1100 provided in an embodiment of the present application. As shown in Fig. 11, the method 1100 includes S1101 to S1106. The steps shown in Fig. 11 are described in detail below.
  • a first access network device sends first information to a core network device.
  • the core network device receives the first information, where the first information includes an identifier of a terminal.
  • the core network device sends security parameters to one or more candidate target access network devices.
  • the one or more candidate target access network devices receive the security parameters.
  • the security parameters include at least one key pair for deriving the communication key.
  • Each key pair in each key pair includes NH and NCC. That is, the ⁇ NH, NCC ⁇ pair mentioned above.
  • the process of deriving the communication key based on the ⁇ NH, NCC ⁇ pair can refer to the relevant descriptions in the above Figures 2 to 5.
  • the core network device needs to determine one or more candidate target access network devices for the terminal corresponding to the terminal identifier included in the first information.
  • the specific determination process can refer to the relevant description in S702 above.
  • the terminal is disconnected from the first access network device, and re-accesses the second access network device.
  • the second access network device is one of one or more candidate target access devices.
  • a wireless link failure occurs between the terminal and the first access network device, and the terminal initiates a reestablishment request to establish a connection with the second access network device.
  • the terminal accesses the second access network device after a period of time.
  • S1104 The terminal sends the NCC that the terminal wishes to use on the second access network device to the second access network device.
  • the second access network device determines a key pair identical to the received NCC from multiple key pairs, and derives a communication key based on the determined key pair.
  • the above S1104 can be replaced by: the terminal sends the NCC used by the terminal before accessing the first target base station to the second access network device; and the above S1105 can be replaced by: the second access network device determines a key pair that is identical to the received NCC plus 1 from multiple key pairs, and derives a communication key based on the determined key pair.
  • S1106 The terminal uses the second key pair to derive a communication key, wherein the second key pair is the same as the key pair determined by the second access network device.
  • the terminal first synchronously obtains a key pair, that is, a new NCC and NH value (the terminal adds 1 to the local NCC value, calculates the corresponding NH value (for example, derives a new NH based on the root key and the current NH), and then derives the intermediate key, and then derives the communication key from the intermediate key.
  • the derived communication key is used to encrypt communication between the terminal and the first candidate target base station to ensure the security of communication.
  • the terminal when the terminal switches between cells or within cells managed by the first candidate target access network, or switches to other candidate target access network devices, it can derive intermediate keys by vertically deriving keys or by horizontally deriving keys.
  • the specific derivation method to be used can be determined by the first target access network.
  • the first candidate target access network may send an unused key pair to the second candidate target access network.
  • the core network device after receiving the first information containing the terminal identification, can determine at least one candidate target access network for the terminal, and send multiple key pairs for deriving communication keys to these candidate target access networks.
  • the terminal indicated by the first information disconnects from the source base station and accesses the first candidate target access network
  • the terminal can send the NCC expected to be used to the first candidate target access network, so that the first candidate target access network can determine the key pair expected to be used by the terminal from multiple key pairs and derive the communication key, thereby improving the communication security between the terminal and the first candidate target access network.
  • FIG12 shows a method for performing security authentication on the terminal undergoing RRC reestablishment in scenario 2 of the architecture 600.
  • Fig. 12 is a schematic flow chart of another communication method 1200 provided in an embodiment of the present application. As shown in Fig. 12, the method 1200 includes S1201 to S1205. Each step in the method 1200 is described in detail below.
  • a first access network device sends first information to a core network device, where the first information includes an identifier of a terminal.
  • the core network device receives the first information.
  • the first access network device in the embodiment of the present application may be the satellite 620 in Figure 6, or other non-terrestrial network devices, such as HAPS devices.
  • the first access network device is the access network device to which the terminal is connected before RRC reestablishment occurs.
  • the terminal identifier contained in the first information may be an identifier corresponding to a terminal that has been connected to the first access network device, or an identifier corresponding to a terminal that has successfully accessed the first access network device but has left the first access network device.
  • the core network device determines one or more candidate target access network devices for the terminal.
  • the process of the core network device determining the candidate target access network device can refer to the relevant description in the above S702, which will not be repeated here.
  • the one or more candidate target access network devices include the first access network device.
  • the core network device sends integrity information to one or more candidate target access network devices, where the integrity information is used to perform security authentication on the terminal.
  • the one or more candidate target access network devices receive the integrity information.
  • S1204 The terminal sends second information to any candidate target access network device among the one or more candidate target access network devices, where the second information is used to request RRC reestablishment.
  • any candidate target access network device receives the second information from the terminal.
  • any of the above-mentioned candidate target access network devices may be a target access network device selected when the terminal performs reconstruction after the terminal is disconnected from the first access network device.
  • S1205 Any one of the one or more candidate target access network devices performs security authentication based on the second information and the integrity information.
  • the core network device after receiving the first information including the identification of the terminal, can determine at least one candidate target access network device for the terminal and send integrity information to these candidate access network devices. In this way, when the terminal accesses any candidate target access network device among one or more candidate target access network devices, even if the core network device is different from the target access network device, There is no communication between the two terminals, and it will not affect the first access network device to perform security authentication on the terminal, thus ensuring communication security.
  • the first access network device may send a request message for obtaining integrity information to the core network device, and carry the terminal identifier in the request message.
  • the request message may also include cell identifiers of multiple candidate cells.
  • sending an integrity message to the first access network device can reduce the probability of RRC reconstruction failure when the terminal accesses the first access network device again.
  • the second information includes: S-TMSI, UL-count and UL-NAS-MAC.
  • the S-TMSI, UL-count and UL-NAS-MAC included in the above second information can be obtained by any calculation method, which will not be repeated here.
  • the above-mentioned integrity information includes: at least one UL-NAS-MAC and at least one DL-NAS-MAC; any one of the above-mentioned one or more candidate target access network devices performs security authentication on the terminal based on the second information and the integrity information, including: when there is a UL-NAS-MAC in at least one UL-NAS-MAC that is identical to the UL-NAS-MAC included in the second information, the verification is successful.
  • the above-mentioned integrity information also includes: at least one UL-count; any target access network of the above-mentioned one or more candidate target access network devices performs security authentication on the terminal based on the second information and the integrity information, including: when there is a UL-NAS-MAC in the at least one UL-NAS-MAC that is identical to the UL-NAS-MAC included in the second information, and there is a UL-count in at least one UL-count that is identical to the UL-count included in the second information, the verification is successful.
  • the above-mentioned integrity information also includes: at least one UL-count, there is a corresponding relationship between the at least one UL-count, at least one UL-NAS-MAC and at least one DL-NAS-MAC, and the corresponding relationship indicates that each UL-count corresponds to a UL-NAS-MAC and a DL-NAS-MAC; any target access network among the above-mentioned one or more candidate target access network devices performs security authentication on the terminal based on the second information and the integrity information, including: the UL-count in the integrity information is the same as the UL-count in the second information, and the UL-NAS-MAC corresponding to the UL-count in the integrity information is the same as the UL-NAS-MAC in the second information, then the verification is successful.
  • the method 1200 further includes: S1206, the core network device sends a cell identifier of a candidate cell corresponding to the integrity information to one or more candidate target access network devices, where the candidate cell is a cell managed by one or more candidate access network devices.
  • the one or more candidate target access network devices receive the cell identifier of the candidate cell corresponding to the integrity information from the core network device.
  • S1206 may be executed between S1203 and S1204, or S1206 and S1203 may be executed simultaneously, that is, the identifier of the candidate cell corresponding to the integrity information is sent while the integrity information is sent.
  • the integrity information may include multiple UL-NAS-MACs and multiple DL-NAS-MACs.
  • the core network device can obtain the cell identifier managed by the target access network device.
  • the core network device can obtain multiple UL-NAS-MACs and multiple DL-NAS-MACs according to the cell identifiers managed by each target access network device, and associate the multiple UL-NAS-MACs and multiple DL-NAS-MACs with the corresponding cell identifiers, so that the access network device that receives the integrity information can determine the UL-NAS-MAC and DL-NAS-MAC corresponding to the cell selected by the terminal for RRC reconstruction from the multiple integrity information when receiving the second information of the terminal, and verify it.
  • the method 1200 when executing the above S1205, the method 1200 also includes: S1207, any candidate target access network device determines the integrity information corresponding to the first cell from the cell identifiers of the candidate cells corresponding to the integrity information from the core network device based on the cell identifier of the first cell accessed by the terminal.
  • S1207 is a step that is continued to be executed after the terminal accesses the first cell when performing RRC reestablishment, that is, S1207 is executed after S1204.
  • the method 1200 further includes: S1208, any candidate target access network device sends the DL-NAS-MAC in the integrity information to the terminal.
  • the terminal receives the DL-NAS-MAC and compares it with the DL-NAS-MAC calculated by the local end. If they are the same, the verification is passed.
  • any candidate target access network device when there is a corresponding relationship between at least one UL-NAS-MAC and at least one DL-NAS-MAC, any candidate target access network device sends the DL-NAS-MAC corresponding to the verified UL-NAS-MAC to the terminal.
  • FIG13 shows a communication device 1300 provided in an embodiment of the present application.
  • the communication device 1300 includes: a transceiver module 1310 and a processing module 1320 .
  • the communication device 1300 is the above-mentioned core network device, or a chip of the core network device.
  • the transceiver module 1310 is used to: receive first information from a first access network device, wherein the first information includes an identification of a terminal; the processing module 1320 is used to: determine one or more candidate target access network devices for the terminal; the transceiver module 1310 is also used to: send security parameters to one or more candidate target access network devices, wherein the security parameters include at least one key pair for deriving a communication key; wherein the second access network device belongs to one or more candidate target access network devices, and the communication key derived from the at least one key pair sent to the second access network device is used to encrypt subsequent post-switching communications of the terminal after accessing the second access network device.
  • the subsequent switching includes switching of the terminal within a cell managed by the second access network device or between cells, or switching of the terminal from the second access network device to a third access network device.
  • the transceiver module 1310 is further used to: send an identifier of the terminal to the second access network device.
  • the processing module 1320 is also used to determine one or more candidate target access network devices based on at least one of the following: the TAC of the terminal; the location of the terminal; the location of the first access network device; or the communication duration expected by the terminal and the moving speed of the first access network device.
  • the location of the above-mentioned first access network device is the location of the first access network when the terminal accesses the first access network device.
  • each key pair of the at least one key pair includes a NH and a NCC.
  • the transceiver module 1310 is further used to: send different key pairs to different candidate target access network devices, or send the same key pair to different candidate target access network devices.
  • the terminal accesses the second access network device, there is no communication between the core network device and the second access network device.
  • the transceiver module 1310 is used to: receive first information from a first access network device, the first information including an identification of a terminal; and send security parameters to the first access network device, the security parameters including at least one key pair for deriving a communication key, the communication key being used to encrypt subsequent post-switching communications of the terminal after accessing a second access network device, wherein the second access network device is a target access network device determined by the first access network device for the terminal.
  • the transceiver module 1310 is used to: receive first information from a first access network device, the first information including an identifier of a terminal; the processing module 1320 is used to: determine one or more candidate target access network devices for the terminal; the transceiver module 1310 is also used to: send integrity information to one or more candidate target access network devices, the integrity information being used to perform security authentication on the terminal.
  • the communication device 1300 may specifically be a core network device in the above-mentioned embodiment, and the communication device 1300 may be used to execute each process and/or step corresponding to the core network device in the above-mentioned methods 700 to 1200, and will not be described again here to avoid repetition.
  • the communication device 1300 is an access network device, or a chip of an access network device.
  • the transceiver module 1310 is used to: receive security parameters from a core network device, the security parameters including at least one key pair for deriving a communication key, the communication key being used to encrypt subsequent communications of the terminal after switching after the terminal accesses the second access network device; the processing module 1320 is used to: derive a communication key based on a first key pair of at least one key pair when switching occurs after the terminal accesses the second access network device.
  • the transceiver module 1310 is further used to: receive an identifier of the terminal from a core network device.
  • the transceiver module 1310 is used to: send first information to the core network device, the first information including the identification of the terminal; receive security parameters from the core network device; the processing module 1320 is used to: determine to switch the terminal to the second access network device; the transceiver module 1310 is also used to: send security parameters to the second access network device, the security parameters including at least one key pair for deriving a communication key, wherein the communication key is used to encrypt subsequent post-switching communications of the terminal after accessing the second access network device.
  • the transceiver module 1310 is used to: receive security parameters from a first access network device, the security parameters including at least one key pair for deriving a communication key, the communication key being used to encrypt subsequent communications of the terminal after switching after the terminal accesses the second access network device; the processing module 1320 is used to: derive a communication key based on a first key pair of at least one key pair when switching occurs after the terminal accesses the second access network device.
  • the transceiver module 1310 is used to: receive integrity information from a core network device, the integrity information being used to perform security authentication on the terminal; and, receive second information from the terminal, the second information being used to request RRC reconstruction; the processing module 1320 is used to: perform security authentication on the terminal based on the second information and the integrity information.
  • the communication device 1300 may specifically be the first access network device or the second access network device in the above-mentioned embodiment, and the communication device 1300 may be used to execute the various processes and/or steps corresponding to the first access network device and the second access network device in the above-mentioned methods 700 to 1200, and will not be described again here to avoid repetition.
  • module here is embodied in the form of a functional module.
  • the term "module” here may refer to an application specific integrated circuit (ASIC), an electronic circuit, a processor (such as a shared processor, a dedicated processor or a group processor, etc.) and a memory for executing one or more software or firmware programs, a combined logic circuit and/or other suitable components that support the described functions.
  • ASIC application specific integrated circuit
  • processor such as a shared processor, a dedicated processor or a group processor, etc.
  • memory for executing one or more software or firmware programs, a combined logic circuit and/or other suitable components that support the described functions.
  • the communication device 1300 may be specifically a core network device or an access network device in the above-mentioned embodiment, or the functions of the core network device or the access network device in the above-mentioned embodiment may be integrated in the communication device 1300, and the communication device 1300 may be used to execute the various processes and/or steps corresponding to the core network device or the access network device in the above-mentioned method embodiment, and in order to avoid repetition, it will not be repeated here.
  • the communication device 1300 has the function of implementing the corresponding steps performed by the data processing device in the method; the above functions can be implemented by hardware, or by hardware executing corresponding software.
  • the hardware or software includes one or more modules corresponding to the above functions.
  • the transceiver module 1320 can be a communication interface, such as a transceiver interface.
  • FIG. 14 shows another communication device 1400 provided in an embodiment of the present application.
  • the communication device 1400 includes a processor 1410.
  • the processor 1410 is used to execute instructions, so that the communication device 1400 can execute the communication method provided in the above method embodiment.
  • the communication device 1400 also includes a memory 1420 for storing instructions.
  • the processor 1410 and the memory 1420 can be connected through an internal connection path.
  • the communication device 1400 also includes a transceiver 1430.
  • the functions of the communication device 1300 in the above embodiment can be integrated in the communication device 1400, and the communication device 1400 can be used to execute the various steps and/or processes corresponding to the core network device in the above method embodiment, or the communication device 1400 can also be used to execute the various steps and/or processes corresponding to the access network device in the above method embodiment.
  • the memory 1420 may include a read-only memory and a random access memory, and provide instructions and data to the processor. A part of the memory may also include a non-volatile random access memory. For example, the memory may also store information about the device type.
  • the processor 1410 may be used to execute instructions stored in the memory, and when the processor executes the instruction, the processor 1410 may execute the various steps and/or processes corresponding to the core network device in the above method embodiment, or the processor 1410 may execute the various steps and/or processes corresponding to the access network device in the above method embodiment.
  • the processor 1410 may be a central processing unit (CPU), the processor 1410 may also be other general-purpose processors, digital signal processors (DSP), ASICs, field programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc.
  • the processor 1410 may be a microprocessor or the processor 1410 may also be any conventional processor, etc.
  • each step of the above method 700 to method 1200 can be completed by an integrated logic circuit of hardware in a processor or an instruction in the form of software.
  • the steps of the method disclosed in conjunction with the embodiment of the present application can be directly embodied as a hardware processor for execution, or a combination of hardware and software modules in a processor for execution.
  • the software module can be located in a mature storage medium in the art such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, etc.
  • the storage medium is located in a memory, and the processor executes the instructions in the memory, and completes the steps of the above method in conjunction with its hardware. To avoid repetition, it is not described in detail here.
  • the present application also provides a computer-readable medium on which a computer program is stored.
  • a computer program is stored on which a computer program is stored.
  • the present application also provides a computer program product, which implements the steps of any of the above method embodiments when executed by a computer.
  • the present application also provides a communication system, which includes a core network device and an access network device, wherein the core network device is used to execute each step corresponding to the core network device in any of the above method embodiments, and the access network device is used to execute each step corresponding to the access network device in any of the above method embodiments.
  • the communication system may further include a terminal.
  • the disclosed systems, devices and methods can be implemented in other ways.
  • the device embodiments described above are only schematic.
  • the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed.
  • Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.
  • the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.
  • each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.
  • the computer software product is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present application.
  • the aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

La présente demande concerne un procédé de communication et un appareil associé, de telle sorte que lorsqu'un terminal est commuté vers un dispositif de réseau d'accès cible, un nouveau contexte de sécurité peut être rapidement obtenu pour assurer la sécurité de communication. Le procédé comprend les étapes suivantes : un premier dispositif de réseau d'accès envoie à un dispositif de réseau central des premières informations comprenant un identifiant d'un terminal ; et le dispositif de réseau central, sur la base de l'identifiant reçu du terminal, détermine un ou plusieurs dispositifs de réseau d'accès cible candidats pour le terminal, et envoie un paramètre de sécurité au dispositif de réseau d'accès cible candidat déterminé, le paramètre de sécurité comprenant au moins une paire de clés utilisée pour dériver une clé de communication. Un second dispositif de réseau d'accès appartient au ou aux dispositifs de réseau d'accès cible candidats, et la clé de communication dérivée de la ou des paires de clés envoyées au second dispositif de réseau d'accès est utilisée pour chiffrer une communication ultérieure après la commutation du terminal après avoir accédé au second dispositif de réseau d'accès.
PCT/CN2023/137277 2022-12-08 2023-12-07 Procédé de communication et appareil associé WO2024120500A1 (fr)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202211574252.6A CN118175541A (zh) 2022-12-08 2022-12-08 通信方法及相关装置
CN202211574252.6 2022-12-08

Publications (1)

Publication Number Publication Date
WO2024120500A1 true WO2024120500A1 (fr) 2024-06-13

Family

ID=91357333

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2023/137277 WO2024120500A1 (fr) 2022-12-08 2023-12-07 Procédé de communication et appareil associé

Country Status (2)

Country Link
CN (1) CN118175541A (fr)
WO (1) WO2024120500A1 (fr)

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2010105442A1 (fr) * 2009-03-20 2010-09-23 深圳华为通信技术有限公司 Procédé, appareil et système de génération de paramètres-clés d'évolution
US20200178135A1 (en) * 2018-12-03 2020-06-04 Electronics And Telecommunications Research Institute Method for handover in non-terrestrial network, and apparatus for the same
CN112956236A (zh) * 2019-02-02 2021-06-11 Oppo广东移动通信有限公司 切换过程中安全信息的处理方法及装置、网络设备、终端
WO2021154137A1 (fr) * 2020-01-31 2021-08-05 Telefonaktiebolaget Lm Ericsson (Publ) Déclenchement d'un transfert intercellulaire ultérieur pendant un transfert intercellulaire de pile de protocoles actifs doubles
CN114731564A (zh) * 2020-09-17 2022-07-08 上海诺基亚贝尔股份有限公司 条件切换

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2010105442A1 (fr) * 2009-03-20 2010-09-23 深圳华为通信技术有限公司 Procédé, appareil et système de génération de paramètres-clés d'évolution
US20200178135A1 (en) * 2018-12-03 2020-06-04 Electronics And Telecommunications Research Institute Method for handover in non-terrestrial network, and apparatus for the same
CN112956236A (zh) * 2019-02-02 2021-06-11 Oppo广东移动通信有限公司 切换过程中安全信息的处理方法及装置、网络设备、终端
WO2021154137A1 (fr) * 2020-01-31 2021-08-05 Telefonaktiebolaget Lm Ericsson (Publ) Déclenchement d'un transfert intercellulaire ultérieur pendant un transfert intercellulaire de pile de protocoles actifs doubles
CN114731564A (zh) * 2020-09-17 2022-07-08 上海诺基亚贝尔股份有限公司 条件切换

Also Published As

Publication number Publication date
CN118175541A (zh) 2024-06-11

Similar Documents

Publication Publication Date Title
US11950314B2 (en) Configuration method and apparatus, and system
WO2019128947A1 (fr) Procédé de communication et dispositif de communication
WO2019062996A1 (fr) Procédé, appareil, et système de protection de sécurité
WO2019019736A1 (fr) Procédé de mise en œuvre de sécurité, et appareil et système associés
US20170359719A1 (en) Key generation method, device, and system
JP7516578B2 (ja) Ｉａｂネットワーク通信方法及び関連デバイス
CN111448813B (zh) 与配置的安全保护进行通信的系统和方法
CN106817696B (zh) 处理用于双连接的数据传送/接收的装置及方法
WO2021185259A1 (fr) Procédé et appareil de communication
EP3629538B1 (fr) Procédé et appareil de communication
US11399280B2 (en) Communication of numbered sequence packets using old and new cipher keys
US20230171651A1 (en) Logical channel lch configuration method, communication apparatus, and communication system
US10750357B2 (en) Data transmission method and apparatus, and related device
WO2016026088A1 (fr) Procédé de commutation de trajet, point d'ancrage mobile et station de base
KR102104844B1 (ko) 데이터 전송 방법， 제1 장치 및 제2 장치
US20240031065A1 (en) Communication method and communication apparatus
WO2023186028A1 (fr) Procédé et appareil de communication
US20230354136A1 (en) Integrated access and backhaul communication method and apparatus
US20230309172A1 (en) Rlf recovery method and apparatus for iab network, and related device
WO2024120500A1 (fr) Procédé de communication et appareil associé
WO2020164510A1 (fr) Procédé de communication, appareil de communication et support de stockage lisible par ordinateur
US20240073762A1 (en) Communication method, apparatus, and system
WO2024093719A1 (fr) Procédé de transmission de données, et appareil
WO2023185960A1 (fr) Procédé et appareil de communication
WO2022141025A1 (fr) Procédé et appareil de transmission de données

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 23900069

Country of ref document: EP

Kind code of ref document: A1