WO2018202131A1 - 通信方法、装置及*** - Google Patents

通信方法、装置及*** Download PDF

Info

Publication number
WO2018202131A1
WO2018202131A1 PCT/CN2018/085608 CN2018085608W WO2018202131A1 WO 2018202131 A1 WO2018202131 A1 WO 2018202131A1 CN 2018085608 W CN2018085608 W CN 2018085608W WO 2018202131 A1 WO2018202131 A1 WO 2018202131A1
Authority
WO
WIPO (PCT)
Prior art keywords
data packet
sequence number
key
indication information
bearer
Prior art date
Application number
PCT/CN2018/085608
Other languages
English (en)
French (fr)
Inventor
张宏平
严乐
赵力
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP18794037.4A priority Critical patent/EP3609163B1/en
Publication of WO2018202131A1 publication Critical patent/WO2018202131A1/zh
Priority to US16/673,313 priority patent/US11399280B2/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/041—Key generation or derivation
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L47/00—Traffic control in data switching networks
    • H04L47/10—Flow control; Congestion control
    • H04L47/34—Flow control; Congestion control ensuring sequence integrity, e.g. using sequence numbers
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/10—Integrity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/10—Integrity
    • H04W12/106—Packet or message integrity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W28/00—Network traffic management; Network resource management
    • H04W28/02—Traffic management, e.g. flow control or congestion control
    • H04W28/0205—Traffic management, e.g. flow control or congestion control at the air interface
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W28/00—Network traffic management; Network resource management
    • H04W28/02—Traffic management, e.g. flow control or congestion control
    • H04W28/0252—Traffic management, e.g. flow control or congestion control per individual bearer or channel
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/03—Protecting confidentiality, e.g. by encryption
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W76/00—Connection management
    • H04W76/20—Manipulation of established connections
    • H04W76/27—Transitions between radio resource control [RRC] states
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W80/00—Wireless network protocols or protocol adaptations to wireless operation
    • H04W80/02—Data link layer protocols

Definitions

  • the present application relates to the field of wireless communication technologies, and in particular, to a communication method, apparatus, and system.
  • the security protection function is performed at the Packet Data Convergence Protocol (PDCP) layer.
  • PDCP Packet Data Convergence Protocol
  • Each of the air interfaces carries an entity corresponding to one PDCP layer.
  • the functions of the PDCP layer are as follows:
  • the PDCP layer For the sender, after receiving a packet from the upper layer, the PDCP layer first assigns a PDCP sequence number and then encrypts it. For Radio Resource Control (RRC) signaling, integrity protection is also performed prior to encryption. Then, the PDCP header is added to the encrypted data packet to generate a PDCP layer Protocol Data Unit (PDU). Finally, the PDCP PDU is delivered to the lower layer and sent out from the air interface.
  • RRC Radio Resource Control
  • the PDCP layer For the receiver, after receiving a PDCP PDU from the lower layer, the PDCP layer first removes the header and then decrypts it. For RRC signaling, an integrity check is also performed after decryption. In order to ensure the sequential delivery of data packets, if the data packets are in order (ie, the PDCP sequence number of the current data packet is the PDCP sequence number of the last submitted data packet plus one), the data packet is directly delivered to the upper layer, otherwise, waiting The data packets are not delivered to the upper layer until they are in order.
  • the receiver submits the data packet with the sequence number 100 to the upper layer
  • the data packet with the sequence number 102 is received, since the data packet 102 is not the next data packet of the data packet 100, the data packet 102 is not submitted, waiting for direct access.
  • the data packet 101 and the data packet 102 are delivered to the upper layer.
  • the receiver needs to use the same key for decryption.
  • the receiver does not know from which serial number the sender starts to use the new key (ie, the key confusion period problem).
  • the cell handover updates the key, and the key update is always implemented through the cell handover procedure. That is, during the cell handover process, the data transmission is interrupted, and the terminal applies the new key after receiving the handover command. After the handover is completed, the data transmission always uses the new key, so that the sender and the receiver can use the same.
  • the key is used to encrypt and decrypt the data packet. That is to say, the LTE system solves the key confusion period by transmitting interrupts.
  • the present application provides a communication method, device and system, which can correctly decrypt a data packet, effectively solve the problem of key confusion period, and ensure that data transmission is not interrupted.
  • the present application provides a communication method, which is applied to a sender.
  • the method may include: for a bearer that needs to update a key, the first application of the new key encrypted on the bearer may be encrypted.
  • the sequence number and the sequence number of the last packet encrypted with the old key are set to be discontinuous.
  • the indication information is sent to the second device (ie, the recipient).
  • the indication information may be used to determine a sequence number of a sequence between a sequence number of the first application-applied data key encrypted by the first application and a sequence number of the last application-encrypted data packet.
  • the present application provides a communication method, which is applied to a receiving party, and the method may include: receiving the indication information sent by a first device (ie, a sender), and skipping according to the indication information, The sequence number of the interval is decrypted by using the old key for the data packet whose sequence number is the sequence number of the interval, and the new packet is used for the data packet whose sequence number is the sequence number of the interval. Key decryption.
  • the bearer includes at least one of the following: a data bearer, or a signaling bearer.
  • the sequence number of the first packet to which the new key is encrypted and the sequence number of the last packet to which the old key is encrypted may be referred to as "hole”. That is to say, after the receiver receives the indication information sent by the sender, the receiver can skip the "hole” and decrypt the data packet after the "hole” with the new key, and the packet before the "hole” Decrypt using the old key.
  • skipping "hole" means that the receiver, upon receiving the indication information, uses the first data packet encrypted by the application new key as the next data packet encrypted by the last application old key.
  • the data packet is delivered to the upper layer after decryption, even if the sequence number of the first data packet encrypted with the new key is not equal to the serial number of the last data packet encrypted with the old key.
  • the indication information may include a sequence number of the first data packet to which the new key is encrypted.
  • the serial number y may be used to indicate the sequence number of the first data packet encrypted using the new key.
  • the “hole” skipped by the receiver corresponds to the sequence number y-1 to the sequence number y-n.
  • the receiver can decrypt the data packet whose sequence number is greater than or equal to y using the new key, and decrypt the data packet whose sequence number is less than or equal to y-n-1 using the old key.
  • y and n are positive integers.
  • n can be one.
  • the indication information may include a sequence number of the data packet encrypted by the last application old key.
  • the sequence number x may be used to indicate the sequence number of the data packet encrypted by the last application old key.
  • the “hole” skipped by the receiver corresponds to the sequence number x+1 to the sequence number x+n.
  • the receiver may decrypt the data packet whose sequence number is greater than or equal to x+n+1 using the new key, and decrypt the data packet whose sequence number is less than or equal to x using the old key.
  • x and n are positive integers.
  • n can be one.
  • the indication information may include sequence number information corresponding to the “hole”, that is, the sequence number of the first application new key and the sequence number of the last application old key encrypted data packet. Sequence number information between intervals.
  • the sequence number information corresponding to the “hole” may be the range [a, b] of the sequence number of the interval.
  • the "hole” skipped by the receiver corresponds to the sequence number a to the sequence number b.
  • the receiving party may use the new key to decrypt the data packet whose sequence number is greater than b, and decrypt the data packet whose sequence number is less than a using the old key.
  • the sequence number information corresponding to the “hole” may also be the sequence number of the interval. Where a and b are positive integers.
  • the indication information may further include: a number of sequence numbers included in the sequence number of the interval.
  • the number of the sequence numbers included in the sequence number of the interval may also be a predefined value.
  • the indication information may be carried in an RRC layer signaling or a PDCP control PDU.
  • the base station may carry the indication information in an RRC message sent to the terminal for triggering cell handover.
  • the indication information for multiple bearers may be bearer level.
  • the indication information and the bearer identifier corresponding to the multiple bearers may be carried in one signaling (which may be an RRC layer signaling or a PDCP control PDU).
  • one signaling may be separately sent for each bearer, that is, multiple signalings are sent, and the multiple signaling may respectively carry the multiple bearers respectively.
  • the indication information For example, the sender separately transmits the PDCP Control PDU through each bearer.
  • the PDCP control PDU sent on a bearer may carry the indication information corresponding to the bearer.
  • the PDCP control PDU sent on one bearer carries the identification information of the bearer. In this way, after receiving the PDCP control PDU, the receiver can directly know the bearer corresponding to the indication information carried by the PDCP control PDU, and does not need to additionally indicate the bearer corresponding to the indication information, thereby reducing signaling overhead.
  • the indication information may be sent to the terminal by the source base station, or may be sent to the terminal by the target base station, or may be sent to the terminal by using both the source base station and the target base station.
  • the indication information may be sent to the terminal by using multiple serving base stations (such as the MeNB and the SeNB), and the terminal may ensure that the indication information is received by the terminal as soon as possible.
  • multiple serving base stations such as the MeNB and the SeNB
  • the recipient may decrypt first for the received data packet. After receiving the indication information, the receiver further determines whether the key used to decrypt the data packet is correct. If not, the correct key is used again for decryption. This avoids the situation where a large number of packets need to be decrypted at the same time.
  • Some possible implementations can include:
  • the first implementation manner the old key is used to decrypt the data packet of the bearer from the second device.
  • This implementation is more applicable to situations where the second device has not yet acquired a new key. For example, assume that the second device is a terminal and the first device is a base station. Then, when the terminal has not received the RRC message sent by the base station for triggering the change key, the terminal may decrypt the received data packet by using the old key.
  • the second device may determine, according to the indication information, whether the data packet decrypted by the old key has been correctly decrypted, and if it is decrypted by mistake, The newly decrypted data packet is decrypted using the new key.
  • a second implementation manner applying a new key to decrypt the data packet of the bearer from the second device.
  • This implementation is more applicable to situations where the second device has acquired a new key. For example, assume that the second device is a terminal and the first device is a base station. Then, after the terminal receives the RRC message sent by the base station for triggering the change key, the terminal may decrypt the received data packet by using the new key.
  • the examples are merely illustrative of the application and should not be construed as limiting.
  • the second device may determine, according to the indication information, whether a data packet decrypted by applying a new key has been correctly decrypted, and if it is decrypted by mistake, The old decrypted data packet is decrypted using the old key.
  • whether the second device decrypts the data packet firstly whether the new key or the old key is used is not limited to the policies mentioned in the foregoing two implementation manners, and may be different in actual applications. Should not constitute a limit.
  • the second device may first determine whether the data packet is in order, and if it is in order, decrypt, instead of decrypting first. . This can reduce unnecessary decryption. It should be noted that, in the present application, after receiving the indication information, the second device may skip “hole”, and encrypt the first data packet encrypted by the new application key and the last data packet encrypted by the old application key. Seen as sequential.
  • the triggering condition for triggering the bearer key update may include at least one of the following: a key of the serving base station corresponding to the bearer changes, or the bearer The corresponding cell is switched, or the bearer is reconfigured. It is not limited to these trigger conditions. In actual applications, there may be other trigger conditions that can trigger the bearer key update.
  • the sender ie, the first device
  • the receiver the second device
  • the sender may send the indication information to the receiver (the second device), to indicate that the receiver skips the “hole” and “for” The packet after the hole is decrypted with the new key, and the packet before the "hole” is decrypted using the old key.
  • the present application provides a communication device, which may include a plurality of functional modules for respectively performing the method provided by the first aspect, or provided by any of the possible implementations of the first aspect Methods.
  • the present application provides a communication device, which may include a plurality of functional modules for respectively performing the method provided by the second aspect, or provided by any one of the possible embodiments of the second aspect Methods,
  • the present application provides a communication device for performing the method described in the first aspect.
  • the communication device can include a memory and a processor, transceiver coupled to the memory, wherein the transceiver is for communicating with other communication devices.
  • the memory is for storing implementation code of a method described in the first aspect
  • the processor is for executing program code stored in the memory, ie performing the method provided by the first aspect, or in a possible implementation of the first aspect Any of the methods provided.
  • the present application provides a communication apparatus for performing the method described in the second aspect.
  • the communication device can include a memory and a processor, transceiver coupled to the memory, wherein the transceiver is for communicating with other communication devices.
  • the memory is for storing implementation code of the method described in the second aspect
  • the processor is for executing program code stored in the memory, that is, performing the method provided by the second aspect, or in a possible implementation manner of the second aspect Any of the methods provided.
  • the present application provides a wireless communication system, including a first device and a second device, wherein: the first device is operable to perform the communication method provided by the first aspect, or the first aspect possible implementation manner A communication method provided by any one of them.
  • the second device may be used to perform the communication method provided by the second aspect, or the communication method provided by any one of the possible implementations of the second aspect.
  • a computer readable storage medium on which the instructions are stored, and when the instructions are executed, the computer can implement the communication method provided by the first aspect, or the first aspect A communication method provided by any of the possible embodiments.
  • a computer readable storage medium on which the instructions are stored, the computer can implement the communication method provided by the second aspect, or the second aspect when the instruction is executed A communication method provided by any of the possible embodiments.
  • 1 is a functional block diagram of a PDCP layer at both ends of a transmission and reception in LTE;
  • FIG. 2 is a schematic diagram of networking of a wireless communication system according to the present application.
  • FIG. 3 is a schematic diagram of networking of another wireless communication system according to the present application.
  • FIG. 4 is a schematic diagram of a bearer in a dual connectivity scenario related to the present application.
  • FIG. 5 is a schematic diagram of a hardware architecture of a terminal according to an embodiment of the present application.
  • FIG. 6 is a schematic diagram of a hardware architecture of a base station according to an embodiment of the present application.
  • FIGS. 7A-7B are schematic diagrams of two reception timings for "holes" in the present application.
  • FIG. 8 is a schematic overall flow chart of a communication method provided by the present application.
  • FIG. 9 is a schematic flowchart of a communication method provided by the present application in a base station key update scenario
  • FIG. 10 is a schematic flowchart of a communication method provided in the present application in a bearer reconfiguration scenario
  • FIG. 11 is a schematic flowchart of a communication method provided by the present application in a cell handover scenario
  • FIG. 12 is a functional block diagram of a wireless communication system, a terminal, and a network device provided by the present application.
  • FIG. 2 shows a wireless communication system to which the present application relates.
  • the wireless communication system may be a fifth-generation mobile communication (5th generation, 5G) system, a new air interface (NR) system, a long term evolution (LTE) system, or a machine and a future evolution.
  • 5G fifth-generation mobile communication
  • NR new air interface
  • LTE long term evolution
  • M2M Machine to Machine
  • the wireless communication system 100 can include one or more terminals 101, one or more network devices 102, and a core network 103. among them:
  • the terminal 101 can be distributed throughout the wireless communication system 100, either stationary or mobile.
  • the terminal 101 may be a mobile device, a mobile station, a mobile unit, an M2M terminal, a wireless unit, a remote unit, a user agent, a mobile client, and the like.
  • the network device 102 can be a base station, can be used to communicate with one or more terminals, and can also be used to communicate with one or more base stations having partial terminal functions (such as between a macro base station and a micro base station, such as an access point). Communication).
  • the network device 102 may be a base station (gNB) in a future 5G system, a new air interface (NR) system, or an evolved base station (eNB) in an LTE system, or may be time-division synchronous code division multiple access ( Base Transceiver Station (BTS) in the Time Division Synchronous Code Division Multiple Access (TD-SCDMA) system.
  • BTS Base Transceiver Station
  • TD-SCDMA Time Division Synchronous Code Division Multiple Access
  • the network device 102 may also be an Access Point (AP), a TransNode (Trans TRP), a Central Unit (CU), or other network entity, and may include some of the functions of the above network entities or All features.
  • AP Access Point
  • Trans TRP TransNo
  • the core network 103 may be a NextGen core in a future 5G system, a new air interface (NR) system, an Evolved Packet Core (EPC) in an LTE system, or a TD-SCDMA system. In the core network and so on.
  • NextGen core in a future 5G system
  • NR new air interface
  • EPC Evolved Packet Core
  • LTE Long Term Evolution
  • TD-SCDMA Time Division Multiple Access
  • the network device 102 may be a base station (gNB) in a new air interface (NR) system
  • the core network 103 may be a core network (NextGen core) in a new air interface (NR) system.
  • the terminal 101 can access the core network (NextGen core) through a base station (gNB).
  • the network device 102 may also be a base station (eNB) in an LTE system
  • the core network 103 may also be a NextGen core in a new air interface (NR) system. That is, the terminal 101 can access the core network (NextGen core) in the new air interface (NR) system through the base station (eNB) in the LTE system.
  • the wireless communication system 100 may also be a networking mode applied in a dual connectivity (DC) scenario, such as future 5G non-independent. (non-standalone) networking mode, refer to Figure 3.
  • DC dual connectivity
  • the wireless communication system 100 may be a 5G non-standalone networking mode, and may include a terminal 101, a network device 104 and a core network 105 in an LTE communication system, and a network in a future new air interface (NR) communication system.
  • the terminal 101 is connected to the network device 102 and the network device 104.
  • the two network devices serve as a primary base station (MeNB) and a secondary base station (Secondary eNB, SeNB) of the terminal 101, respectively.
  • the primary base station (MeNB) assumes more control functions.
  • the bearer type in the wireless communication system 100 shown in FIG. 3 may include:
  • MCG bearer The bearer data can only be transmitted through the cell under the primary base station, encrypted and decrypted at the primary base station, and transmitted to the core network or through the primary base station through the primary base station. Receive data sent by the core network.
  • SCG bearer The bearer data can only be transmitted through the cell under the secondary base station, encrypted and decrypted at the secondary base station, and transmitted to the core network or through the secondary base station through the secondary base station. Receive data sent by the core network.
  • MCG split bearer The bearer data can be transmitted through the serving cell under the primary base station and the secondary base station, but can only be encrypted and decrypted at the primary base station, and the primary base station transmits data to the core network or The data sent by the core network is received by the primary base station.
  • the bearer data can be transmitted through the serving cell under the primary base station and the secondary base station, but can only be encrypted and decrypted at the secondary base station, and the data is transmitted to the core network through the secondary base station. The data sent by the core network is received by the secondary base station.
  • the key of the new base station needs to be applied to encrypt the data. For example, as shown in FIG. 4, if the MCG bearer and the SCG bearer are replaced, the PDCP layer entity corresponding to the MCG bearer is moved from the original MeNB to the original SeNB, and the applied key needs to be updated to the key of the original SeNB. Similarly, the PDCP layer entity corresponding to the SCG bearer will be moved from the original SeNB to the original MeNB, and the applied key needs to be updated to the original MeNB key.
  • the examples are merely illustrative of the application and should not be construed as limiting.
  • the wireless communication system 100 may also be configured by a macro base station (macro eNB) and a pico eNB (pico eNB) in the LTE communication system.
  • the networking mode applied to the dual-link scenario may also be a networking mode applied to a multi-connection scenario. The application does not limit the networking mode of the wireless communication system.
  • the terminal 200 may be a sender (in uplink transmission) or a receiver (in downlink transmission).
  • the terminal 200 may include: one or more terminal processors 201, a memory 202, a communication interface 203, a receiver 205, a transmitter 206, a coupler 207, an antenna 208, a user interface 202, and an input and output module. (including audio input and output module 210, key input module 211, display 212, etc.).
  • These components can be connected by bus 204 or other means, and FIG. 5 is exemplified by a bus connection. among them:
  • Communication interface 203 can be used by terminal 200 to communicate with other communication devices, such as network devices.
  • the network device may be the network device 300 shown in FIG. 3.
  • the communication interface 203 may be a Long Term Evolution (LTE) (4G) communication interface, or may be a 5G or a future communication interface of a new air interface.
  • LTE Long Term Evolution
  • 5G Fifth Generation
  • the terminal 200 may be configured with a wired communication interface 203, such as a Local Access Network (LAN) interface.
  • LAN Local Access Network
  • Transmitter 206 can be used to perform transmission processing, such as signal modulation, on signals output by terminal processor 201.
  • Receiver 205 can be used to perform reception processing, such as signal demodulation, on the mobile communication signals received by antenna 208.
  • transmitter 206 and receiver 205 can be viewed as a wireless modem.
  • the number of the transmitter 206 and the receiver 205 may each be one or more.
  • the antenna 208 can be used to convert electromagnetic energy in a transmission line into electromagnetic waves in free space, or to convert electromagnetic waves in free space into electromagnetic energy in a transmission line.
  • the coupler 207 is configured to divide the mobile communication signal received by the antenna 208 into multiple channels and distribute it to a plurality of receivers 205.
  • the terminal 200 may also include other communication components such as a GPS module, a Bluetooth module, a Wireless Fidelity (Wi-Fi) module, and the like. Not limited to the above-described wireless communication signals, the terminal 200 can also support other wireless communication signals such as satellite signals, short-wave signals, and the like. Not limited to wireless communication, the terminal 200 may also be configured with a wired network interface (such as a LAN interface) to support wired communication.
  • a wired network interface such as a LAN interface
  • the input and output module can be used to implement the interaction between the terminal 200 and the user/external environment, and can include the audio input and output module 210, the key input module 211, the display 212, and the like. Specifically, the input and output module may further include: a camera, a touch screen, a sensor, and the like. The input and output modules communicate with the terminal processor 201 through the user interface 209.
  • Memory 202 is coupled to terminal processor 201 for storing various software programs and/or sets of instructions.
  • memory 202 can include high speed random access memory, and can also include non-volatile memory, such as one or more magnetic disk storage devices, flash memory devices, or other non-volatile solid state storage devices.
  • the memory 202 can store an operating system (hereinafter referred to as a system) such as an embedded operating system such as ANDROID, IOS, WINDOWS, or LINUX.
  • the memory 202 can also store a network communication program that can be used to communicate with one or more additional devices, one or more terminal devices, one or more network devices.
  • the memory 202 can also store a user interface program, which can realistically display the content of the application through a graphical operation interface, and receive user control operations on the application through input controls such as menus, dialog boxes, and keys. .
  • the memory 202 may be used to store an implementation program of the resource allocation method provided by one or more embodiments of the present application on the terminal 200 side.
  • the communication method provided by one or more embodiments of the present application please refer to the subsequent embodiments.
  • Terminal processor 201 can be used to read and execute computer readable instructions. Specifically, the terminal processor 201 can be used to invoke a program stored in the memory 212, such as the implementation method of the communication method provided by one or more embodiments of the present application on the terminal 200 side, and execute the instructions included in the program.
  • a program stored in the memory 212 such as the implementation method of the communication method provided by one or more embodiments of the present application on the terminal 200 side, and execute the instructions included in the program.
  • the terminal 200 can be the terminal 101 in the wireless communication system 100 shown in FIG. 2 or FIG. 3, and can be implemented as a mobile device, a mobile station, a mobile unit, a wireless unit, and a remote unit. , user agents, mobile clients, and more.
  • the terminal 200 shown in FIG. 5 is only one implementation manner of the embodiment of the present application. In an actual application, the terminal 200 may further include more or less components, which are not limited herein.
  • FIG. 6 illustrates a network device 300 provided by some embodiments of the present application.
  • the network device 300 may be a sender (in downlink transmission) or a receiver (in uplink transmission).
  • network device 300 can include one or more network device processors 301, memory 302, communication interface 303, transmitter 305, receiver 306, coupler 307, and antenna 308. These components can be connected via bus 304 or other types, and FIG. 6 is exemplified by a bus connection. among them:
  • Communication interface 303 can be used by network device 300 to communicate with other communication devices, such as terminal devices or other network devices.
  • the terminal device may be the terminal 200 shown in FIG. 2.
  • the communication interface 303 may be a Long Term Evolution (LTE) (4G) communication interface, or may be a 5G or a future communication interface of a new air interface.
  • LTE Long Term Evolution
  • the network device 300 may also be configured with a wired communication interface 303 to support wired communication.
  • the backhaul link between one network device 300 and other network devices 300 may be a wired communication connection.
  • Transmitter 305 can be used to perform transmission processing, such as signal modulation, on signals output by network device processor 301.
  • Receiver 306 can be used to perform reception processing on the mobile communication signals received by antenna 308. For example, signal demodulation.
  • transmitter 305 and receiver 306 can be viewed as a wireless modem. In the network device 300, the number of the transmitter 305 and the receiver 306 may each be one or more.
  • the antenna 308 can be used to convert electromagnetic energy in a transmission line into electromagnetic waves in free space, or to convert electromagnetic waves in free space into electromagnetic energy in a transmission line.
  • Coupler 307 can be used to divide the mobile pass signal into multiple channels and distribute it to multiple receivers 306.
  • Memory 302 is coupled to network device processor 301 for storing various software programs and/or sets of instructions.
  • memory 302 may include high speed random access memory, and may also include non-volatile memory, such as one or more magnetic disk storage devices, flash memory devices, or other non-volatile solid state storage devices.
  • the memory 302 can store an operating system (hereinafter referred to as a system) such as an embedded operating system such as uCOS, VxWorks, or RTLinux.
  • the memory 302 can also store a network communication program that can be used to communicate with one or more additional devices, one or more terminal devices, one or more network devices.
  • the network device processor 301 can be used to perform wireless channel management, implement call and communication link establishment and teardown, and provide cell handover control and the like for users in the control area.
  • the network device processor 301 may include: an Administration Module/Communication Module (AM/CM) (a center for voice exchange and information exchange), and a Basic Module (BM) (for Complete call processing, signaling processing, radio resource management, radio link management and circuit maintenance functions), code conversion and sub-multiplexer (TCSM) (for multiplexing demultiplexing and code conversion functions) )and many more.
  • AM/CM Administration Module/Communication Module
  • BM Basic Module
  • TCSM code conversion and sub-multiplexer
  • the network device processor 301 can be used to read and execute computer readable instructions. Specifically, the network device processor 301 can be used to invoke a program stored in the memory 302, such as a communication method provided by one or more embodiments of the present application, on the network device 300 side, and execute instructions included in the program.
  • a program stored in the memory 302 such as a communication method provided by one or more embodiments of the present application, on the network device 300 side, and execute instructions included in the program.
  • the network device 300 can be the network device 102 or the network device 104 in the wireless communication system 100 shown in FIG. 2 or FIG. 3, and can be implemented as a base transceiver station, a wireless transceiver, and a basic service set (BSS).
  • BSS basic service set
  • the network device 300 shown in FIG. 6 is only one implementation of the embodiment of the present application. In actual applications, the network device 300 may further include more or fewer components, which are not limited herein.
  • the embodiment of the present application provides a communication method, which can be applied to an embodiment corresponding to the foregoing wireless communication system 100, the terminal 200, and the network device 300, respectively.
  • the communication method provided by the present application solves the problem of the key confusion period occurring when the bearer key is updated by setting the "hole” by using the characteristics of the PDCP layer to deliver in order.
  • the sender sets the sequence number of the first data packet encrypted by using the new key and the sequence number of the last data packet encrypted by the old key to be discontinuous, intentionally creating a sequence number interval (ie, “hole”) ).
  • the transmitting direction sends the indication information to the receiver to determine the sequence number corresponding to the “hole”.
  • the receiver can skip the “hole” and decrypt the data packet after the “hole” with the new key, and use the old packet before the “hole”. Key decryption. In this way, the correct decryption of the data packet can be achieved, and the data transmission is guaranteed to be uninterrupted.
  • the bearer may be a data bearer DRB or a signaling bearer SRB.
  • hole is the serial number(s) of the sequence between the sequence number of the first packet to which the new key is applied and the sequence number of the packet to which the last old key is encrypted.
  • skipping "hole” means that the receiver, upon receiving the indication information, uses the first data packet encrypted by the application new key as the next data packet encrypted by the last application old key.
  • the data packet is delivered to the upper layer after decryption, even if the sequence number of the first data packet encrypted with the new key is not equal to the sequence number of the last data packet encrypted with the old key plus one. That is, in the present application, it can be considered that the next packet of the last packet encrypted with the old key is the first packet encrypted with the new key, even if there is a "hole" between the two.
  • the sequence number x of the last data packet encrypted with the old key is not continuous with the sequence number y of the first data packet encrypted with the new key, ie, y Greater than x+1. That is to say, there is a "hole" between x and y.
  • x and y are both positive integers.
  • the indication information arrives at the receiver earlier than the packet y.
  • the receiver may skip the "hole" between x and y according to the indication information, and after submitting the decrypted packet x to the upper layer after decrypting the packet y using the new key, submit it to the upper layer. Decrypted packet y.
  • the indication information arrives at the receiver later than the packet y.
  • the packet y will not be delivered to the upper layer.
  • the receiver skips the "hole”, decrypts the data packet y with the new key, and submits the decrypted data packet y to the upper layer immediately after submitting the decrypted data packet x to the upper layer. .
  • FIG. 7 is only for explaining the present application and should not be construed as limiting.
  • serial number of the present application may be a PDCP sequence number in a PDCP PDU, or may be a PDCP COUNT value.
  • the data carried by the signaling will be integrity protected.
  • the data carried by the data may also need integrity protection, and also involves the problem of key update.
  • the communication method provided by the present application can also be applied to the scenario of integrity protection.
  • the PDCP layer can be used to update the bearer key by setting a "hole".
  • the sender may set the sequence number of the first data packet that is used for integrity protection using the new key and the sequence number of the last data packet that uses the old key for integrity protection to be discontinuous, intentionally creating a sequence number interval. (ie "empty").
  • the transmitting direction sends the indication information to the receiver to determine the sequence number corresponding to the “hole”.
  • the receiver can skip the “hole” and use the new key for integrity check on the data packet after the “hole”, and the data before the “hole”
  • the package uses the old key for integrity checking.
  • the specific embodiment shown in the embodiment of FIG. 8 and the specific embodiments in the three scenarios shown in the embodiment of FIG. 9-11 are also applicable to the integrity protection of the data packet, and the “encryption” in each embodiment can be simply replaced. In the "integrity protection (or production integrity message authentication code)", you can replace the decryption with "integrity check.” For the sake of brevity of the manual, the details are not repeated here. In this way, the data packet can be correctly and completely completed. Sex check and ensure that data transmission is not interrupted.
  • the indication information may include a sequence number of the first data packet to which the new key is encrypted.
  • the serial number y may be used to indicate the sequence number of the first data packet encrypted using the new key.
  • the “hole” skipped by the receiver corresponds to the sequence number y-1 to the sequence number y-n.
  • the receiver can decrypt the data packet whose sequence number is greater than or equal to y using the new key, and decrypt the data packet whose sequence number is less than or equal to y-n-1 using the old key.
  • y and n are positive integers.
  • n can be one.
  • the indication information may include a sequence number of the data packet encrypted by the last application old key.
  • the sequence number x may be used to indicate the sequence number of the data packet encrypted by the last application old key.
  • the “hole” skipped by the receiver corresponds to the sequence number x+1 to the sequence number x+n.
  • the receiver may decrypt the data packet whose sequence number is greater than or equal to x+n+1 using the new key, and decrypt the data packet whose sequence number is less than or equal to x using the old key.
  • x and n are positive integers.
  • n can be one.
  • the indication information may include sequence number information corresponding to the “hole”, that is, the sequence number of the first application new key and the sequence number of the last application old key encrypted data packet. Sequence number information between intervals.
  • the sequence number information corresponding to the “hole” may be the range [a, b] of the sequence number of the interval.
  • the "hole” skipped by the receiver corresponds to the sequence number a to the sequence number b.
  • the receiving party may use the new key to decrypt the data packet whose sequence number is greater than b, and decrypt the data packet whose sequence number is less than a using the old key.
  • the sequence number information corresponding to the “hole” may also be the sequence number of the interval. Where a and b are positive integers.
  • the indication information may further include: a number of sequence numbers included in the sequence number of the interval.
  • the number of the sequence numbers included in the sequence number of the interval may also be a predefined value.
  • the sequence number of the interval includes one sequence number (predefined by a protocol or indicated by the indication information). That is, the sequence number y of the first data packet encrypted by using the new key is the sequence number x+2 of the last data packet encrypted by using the old key, and the sequence number (x+1) is the sequence number of the interval. .
  • the indication information includes the sequence number x of the last data packet encrypted by the old key
  • the indication information is used to indicate that the receiver skips the last sequence number of x, that is, x+1.
  • the indication information includes the sequence number y of the first data packet encrypted by using the new key
  • the indication information is used to indicate that the receiver skips the previous serial number of y, that is, y-1.
  • the indication information may be carried in RRC layer signaling or in a PDCP control PDU.
  • the base station may carry the indication information in an RRC message sent to the terminal for triggering cell handover.
  • the indication information for multiple bearers may be bearer level.
  • the indication information and the bearer identifier corresponding to the multiple bearers may be carried in one signaling (which may be an RRC layer signaling or a PDCP control PDU).
  • one signaling may be separately sent for each bearer, that is, multiple signalings are sent, and the multiple signaling may respectively carry the multiple bearers respectively.
  • the indication information For example, the sender separately transmits the PDCP Control PDU through each bearer.
  • the PDCP control PDU sent on a bearer may carry the indication information corresponding to the bearer.
  • the PDCP control PDU sent on one bearer carries the identification information of the bearer. In this way, after receiving the PDCP control PDU, the receiver can directly know the bearer corresponding to the indication information carried by the PDCP control PDU, and does not need to additionally indicate the bearer corresponding to the indication information, thereby reducing signaling overhead.
  • the indication information may be sent to the terminal by the source base station, or may be sent to the terminal by the target base station, or may be sent to the terminal by the source base station and the target base station.
  • the indication information may be sent to the terminal by using multiple serving base stations (such as the MeNB and the SeNB), and the terminal may ensure that the indication information is received by the terminal as soon as possible.
  • multiple serving base stations such as the MeNB and the SeNB
  • FIG. 8 shows the overall flow of the communication method provided by the present application.
  • the first device is the sender and the second device is the receiver.
  • the first device In the uplink transmission process, the first device may be a terminal, and the second device may be a network device.
  • the first device In the downlink transmission process, the first device may be a network device, and the second device may be a terminal.
  • the communication method can be expanded to:
  • the first device may set a “hole” for the bearer that needs to update the key, and apply the new key to encrypt the data packet of the bearer.
  • the "hole” is the sequence number of the interval between the sequence number of the first packet to which the new key is applied and the sequence number of the packet to which the last old key is encrypted.
  • the first device sends the indication information to the second device, where the sequence number corresponding to the “hole” is indicated.
  • the first device sends, to the second device, a data packet encrypted with a new key. It should be understood that before the key of the bearer application is updated, the first device may encrypt the data packet of the bearer by using the old key, and send the data packet encrypted by the old key to the second device, which may be referred to S101. .
  • the second device receives the indication information and the data packet sent by the first device. Moreover, the second device may skip the "hole” according to the indication information, decrypt the data packet before the "hole” using the old key, and decrypt the data packet after the "hole” using the new key. Regarding how to skip the "hole” according to the indication information, reference may be made to the foregoing content, and details are not described herein again.
  • the data packet encrypted with the old key, the indication information, and the data packet encrypted with the new key may arrive at the second device out of order. Due to the existence of "holes" and the characteristics of the PDCP layer being delivered in order, the second device can follow the indication regardless of whether the indication information arrives before or after the first data packet encrypted with the new key. The information is correctly decrypted. For details, refer to the related descriptions of FIG. 7A-7B, and details are not described herein again.
  • the communication method provided by the present application can perform the data packet encrypted by using the new and old keys, respectively, while ensuring that the data transmission is not interrupted when the key of the bearer application is updated. Correct decryption completely solves the key confusion period problem.
  • the first device is not limited to first setting “hole” and then applying a new key to encrypt the data packet, and the first device may first apply the new key to encrypt the bearer data packet. And sending a packet encrypted with the new key to the second device. That is to say, S104 in the figure can also occur before S103.
  • the second device may decrypt first for the received data packet. After receiving the indication information, it is determined whether the key used to decrypt the data packet is correct. If not, the correct key is used again for decryption. This avoids the situation where a large number of packets need to be decrypted at the same time. Such an embodiment is more applicable to the scenario shown in FIG. 7B, that is, the indication information is later than the scene in which the first packet encrypted with the new key arrives.
  • the first implementation manner the old key is used to decrypt the data packet of the bearer from the second device.
  • This implementation is more applicable to situations where the second device has not yet acquired a new key. For example, assume that the second device is a terminal and the first device is a base station. Then, when the terminal has not received the RRC message sent by the base station for triggering the change key, the terminal may decrypt the received data packet by using the old key.
  • the second device may determine, according to the indication information, whether the data packet decrypted by the old key has been correctly decrypted, and if it is decrypted by mistake, The newly decrypted data packet is decrypted using the new key.
  • a second implementation manner applying a new key to decrypt the data packet of the bearer from the second device.
  • This implementation is more applicable to situations where the second device has acquired a new key. For example, assume that the second device is a terminal and the first device is a base station. Then, after the terminal receives the RRC message sent by the base station for triggering the change key, the terminal may decrypt the received data packet by using the new key.
  • the examples are merely illustrative of the application and should not be construed as limiting.
  • the second device may determine, according to the indication information, whether a data packet decrypted by applying a new key has been correctly decrypted, and if it is decrypted by mistake, The old decrypted data packet is decrypted using the old key.
  • whether the second device decrypts the data packet firstly whether the new key or the old key is used is not limited to the policies mentioned in the foregoing two implementation manners, and may be different in actual applications. Should not constitute a limit.
  • the second device may first determine whether the data packet is in order, and if so, perform decryption instead of decrypting first. This can reduce unnecessary decryption. It should be noted that, in the present application, after receiving the indication information, the second device may skip “hole”, and encrypt the first data packet encrypted by the new application key and the last data packet encrypted by the old application key. Seen as sequential.
  • Scenario 1 Key update of the serving base station, and the key used by each bearer is updated accordingly. For example, the PDCP COUNT value is flipped, the bearer ID is exhausted, and so on.
  • Scenario 2 Dual-connection or multi-connection scenario, reconfiguration of bearer type.
  • the bearer changes from MCG split bearer to SCG split bearer.
  • Scenario 3 Cell handover scenario (the key of the bearer changes from the key of the source base station to the key of the target base station).
  • FIG. 9 shows a specific implementation of the resource allocation method provided by the present application in scenario 1. It can be understood that, in the downlink transmission process, the base station is the foregoing first device, and the terminal is the foregoing second device. In the uplink transmission process, the terminal is the foregoing first device, and the base station is the foregoing second device.
  • the specific implementation of the resource allocation method provided by the present application in scenario 1 is described below from three stages.
  • Step 1 The terminal enters an RRC connected state, and establishes a bearer with the base station for transmitting data.
  • Step 2 The base station triggers a key update to generate a new key.
  • the trigger condition of the key update of the base station may be that the PDCP COUNT value is reversed, or the bearer ID is exhausted.
  • Step 3 After the base station generates a new key, the base station may send an RRC message to the terminal for triggering the terminal to update the key.
  • the RRC message may be an RRC reconfiguration message.
  • Step 4 After receiving the RRC message, the terminal generates a new key.
  • the RRC message may carry a derived parameter for generating a new key.
  • the derived parameter used to generate a new key may also be sent to the terminal by using a PDCP control PDU.
  • the new key does not immediately replace the old key, but the old and new keys are used for a period of time at the same time, so that the data packet decrypted by the old key cannot be decrypted.
  • Step 5 For the bearer that needs to update the key, the base station can set a "hole” and encrypt the downlink data packet after the "hole” with the new key.
  • the key of the base station is updated, and all bearer keys between the base station and the terminal need to be updated.
  • the "hole” is the sequence number of the interval between the sequence number of the first packet to which the new key is applied and the sequence number of the packet to which the last old key is encrypted.
  • Step 6 The base station sends a PDCP Control PDU carrying the indication information to the terminal.
  • the indication information is used to indicate the serial number corresponding to the “hole”.
  • the indication information may also be carried in the RRC message in step 3. That is, the base station may set a “hole” before the step 3, and then deliver the indication information by using the RRC message. The base station can no longer perform step 6.
  • the base station may send the PDCP control PDU carrying the indication information to the terminal after the RRC message is sent in the step 3, or may send the PDCP control PDU after the RRC message is sent. No restrictions.
  • Step 7 After receiving the indication information, the terminal may skip the “hole” according to the indication information, decrypt the downlink data packet before the “hole” using the old key, and the downlink data packet after the “hole” Decrypt using the new key.
  • the terminal may skip the “hole” according to the indication information, decrypt the downlink data packet before the “hole” using the old key, and the downlink data packet after the “hole” Decrypt using the new key.
  • step 8-10 In the uplink transmission process, the key of the bearer application is updated, refer to step 8-10. among them:
  • Step 8 For the bearer whose key is updated, the terminal may set a "hole” and encrypt the uplink packet after the "hole” with the new key.
  • the definitions and descriptions of "holes” in this application can be referred to the foregoing, and are not described herein.
  • Step 9 The terminal sends a PDCP Control PDU carrying the indication information to the base station.
  • the indication information is used to indicate the serial number corresponding to the “hole”.
  • the indication information may be carried in an RRC response message sent by the terminal to the base station.
  • Step 10 the base station may skip the “hole” according to the indication information, decrypt the uplink data packet before the “hole” using the old key, and the uplink data packet after the “hole” Decrypt using the new key.
  • the base station may skip the “hole” according to the indication information, decrypt the uplink data packet before the “hole” using the old key, and the uplink data packet after the “hole” Decrypt using the new key.
  • the data transmission between the base station and the terminal is not interrupted during the process of updating the bearer key. That is, in the process of replacing the old and new keys of the bearer, the old key is used to encrypt the data packet before the "hole” and the encrypted data packet is sent; the data packet after the "hole” is encrypted with the new key, and sent Encrypted packets. That is to say, the data transmission can be completely unaffected by the bearer key update.
  • step 4 may occur after step 6.
  • steps 3-4 may occur after step 6.
  • the terminal can wait for the new key to be generated, and then decrypt the data packet after the "hole" according to the indication information.
  • a timer may be set, and the received data packet that needs to be encrypted by using the new key is cached first. If the terminal receives the RRC message before the timer expires, a new key is generated to decrypt the data packet. Otherwise, the failure result may be returned to the base station.
  • the uplink transmission process may occur earlier than the downlink transmission process, and the uplink transmission process and the downlink transmission process may also occur simultaneously.
  • the key of the base station when the key of the base station is updated, the key may not be updated by the cell handover, but the RRC connection reconfiguration process is used to update the key, and the PDCP entity is not re-established. This will not cause an interruption in data transmission.
  • FIG. 10 shows a specific implementation of the resource allocation method provided by the present application in scenario 2.
  • the terminal is connected to two serving base stations, where the base station 1 is a primary station (such as MeNB in LTE), and the base station 2 is a secondary station (such as SeNB in LTE).
  • the base station 1 is a primary station (such as MeNB in LTE)
  • the base station 2 is a secondary station (such as SeNB in LTE).
  • the base station 1 is a primary station (such as MeNB in LTE)
  • SeNB SeNB in LTE
  • the terminal is the foregoing second device.
  • the terminal is the foregoing first device
  • one or more serving base stations are the foregoing second device.
  • the embodiment of FIG. 10 illustrates the communication method provided by the present application by taking the bearer reconfiguration in the dual connectivity scenario as an example. Assume that the type carried before reconfiguration is MCG split bear, and the type carried after reconfiguration is SCG split bearer. The description is expanded below.
  • Step 1 The terminal and the base station 1 perform data transmission based on the bearer (such as an MCG split bearer).
  • the carried data packet is encrypted using the key of the base station 1.
  • Step 2 The base station 1 sends an RRC reconfiguration message to the terminal, which is used to trigger reconfiguration of the bearer and update the bearer type.
  • the RRC reconfiguration message may carry information of a new bearer type (such as an SCG split bearer).
  • the RRC reconfiguration message may further carry the identifier of the base station 2, and is used to indicate that the bearer PDCP entity migrates to the base station 2, and the terminal may transmit data through the serving cell of the base station 2.
  • the RRC reconfiguration message may further carry a derivative parameter of the key of the base station 2.
  • the terminal may generate a new key (ie, the key of the base station 2). It should be understood that when the base station 1 adds the base station 2 as the secondary station, the base station 1 can also send the derived parameter of the key of the base station 2 to the terminal, so that when the PDCP entity of the bearer migrates to the base station 2, the base station 1 can no longer need to The derived parameter is sent to the terminal.
  • step 3-8 In the downlink transmission process, update the bearer key, refer to step 3-8. among them:
  • Step 3 Base station 1 (master station) sets "hole”. For the "hole”, refer to the foregoing content, and details are not described herein again.
  • Step 4 The base station 1 sends a PDCP control PDU carrying the indication information to the terminal, and is used to indicate the sequence number corresponding to the “hole”.
  • a PDCP control PDU carrying the indication information to the terminal, and is used to indicate the sequence number corresponding to the “hole”.
  • Step 5 The base station 1 sends a start number to the base station 2 for instructing the base station 2 to number the data packets starting from the start number.
  • the starting number is the first serial number after the "hole". For example, suppose that the sequence number of the last data packet encrypted using the key of the base station 1 is 100, and the sequence number corresponding to the "hole" is 101, then the start number is 102.
  • the examples are merely illustrative of the application and should not be construed as limiting.
  • Step 6-7 The base station 2 encrypts the downlink data packet using the base station 2 key, and numbers the downlink data packet from the start number.
  • the base station 2 transmits a downlink data packet encrypted with the key of the base station 2 to the terminal.
  • Step 8 The terminal may skip the “hole” according to the indication information, and decrypt the received downlink data packet.
  • the downlink data packet received by the terminal may include a downlink data packet encrypted by using the key of the base station 2, and may also include a downlink data packet encrypted by using the key of the base station 1.
  • the terminal can use the key of the base station 1 to decrypt the data packet before the "hole”, and use the key of the base station 2 to decrypt the data packet after the "hole", so that the downlink data packet can be correctly decrypted.
  • Step 9 The terminal can set "hole”.
  • the terminal may send a PDCP control PDU carrying the indication information to the base station 1 and the base station 2, respectively, for indicating the sequence number corresponding to the “hole”.
  • the base station 1 and the base station 2 respectively judge whether the received uplink data packet is encrypted by using the key of the base station 1 or the key of the base station 2 according to the indication information received by the base station 1 and the base station 2, respectively.
  • data of the MCG split bearer or the SCG split bearer can be transmitted through the serving cell under the primary station (ie, base station 1) and the secondary station (ie, base station 2). .
  • Step 11 The terminal may encrypt the uplink data packet after the "hole” using the new key (ie, the key of the base station 2), and may encrypt the uplink data packet before the "hole” using the old key (ie, the key of the base station 1).
  • the new key ie, the key of the base station 2
  • the old key ie, the key of the base station 1.
  • Steps 12a-12b The terminal may send an uplink data packet to the base station 2, or may send an uplink data packet to the base station 1.
  • the uplink data packet sent by the terminal to the base station 2 may include a data packet encrypted by using the key of the base station 1.
  • the uplink data packet sent by the terminal to the base station 1 may include a data packet encrypted by using the key of the base station 2.
  • Steps 13a-13b The base station 2 may skip the "hole” according to the indication information, and decrypt the data packet after the "hole” by using the key of the base station 2, and refer to step 13a.
  • the base station 1 can skip the "hole” according to the indication information, and decrypt the data packet before the "hole” by using the self key, and can refer to step 13b.
  • Steps 14a-14b if the uplink data packet received by the base station 2 includes an uplink data packet encrypted by using the key of the base station 1, the uplink data packet encrypted by using the key of the base station 1 is forwarded to the base station 1. Refer to step 14a. Optionally, if the uplink data packet received by the base station 1 includes an uplink data packet encrypted by using the key of the base station 2, the uplink data packet encrypted by using the key of the base station 2 is forwarded to the base station 2. Referring to step 14b. Here, the forwarding of the encrypted data packet does not change the sequence number of the data packet.
  • Step 15a-15b the base station 1 can use the key of the base station 1 to decrypt the uplink data packet forwarded by the base station 2.
  • the base station 2 may use the key of the base station 2 to decrypt the uplink data packet forwarded by the base station 1, and may refer to step 15b.
  • steps 3-4 above may also be performed by base station 2. That is, the hole is set by the base station 2 (secondary station), and the "hole" is instructed.
  • the embodiment of FIG. 10 can also be applied to other types of bearer reconfiguration scenarios with bearer type changes.
  • the embodiment of FIG. 10 can also be applied to other forms of bearer reconfiguration scenarios, as long as the bearer PDCP entity migrates to the new base station.
  • the bearer reconfiguration scenario in the embodiment of FIG. 10 is that the bearer type is changed from MCG bearer to SCG bearer. Because the data packet of the MCG bearer can only be transmitted through the serving cell under the primary base station, the data packet of the SCG bearer can only be transmitted through the serving cell under the secondary base station. Therefore, in the uplink transmission process, the terminal side may not need to perform the "hole" setting, and may directly send the uplink data packet encrypted by the key of the base station 1 to the base station 1, and directly directly use the uplink data encrypted by the key of the base station 2. After the packet is sent to the base station 2, the uplink transmission after the bearer key update can be completed.
  • step 2 may occur after step 4.
  • the terminal can wait for the new key to be generated, and then decrypt the data packet according to the indication information.
  • a timer may be set, and the received data packet that needs to be encrypted by using the new key is cached first. If the terminal receives the RRC reconfiguration message before the timer expires, a new key is generated to decrypt the data packet. Otherwise, the failure result may be returned to the base station.
  • the uplink transmission process may occur earlier than the downlink transmission process, and the uplink transmission process and the downlink transmission process may also occur simultaneously.
  • FIG. 11 shows a specific implementation of the resource allocation method provided by the present application in scenario 3.
  • the terminal switches from the serving cell of the base station 1 (source base station) to the serving cell of the base station 2 (target base station), that is, the cell handover between the base stations.
  • the PDCP entity responsible for the data packet encryption and decryption of the bearer also migrates from the base station 1 to the base station 2.
  • the target base station or the source base station is the foregoing first device
  • the terminal is the foregoing second device.
  • the terminal is the foregoing first device
  • the target base station or the source base station is the foregoing second device.
  • the description is expanded below.
  • Step 1 Before the handover, the terminal performs data transmission with the base station 1.
  • the data packet transmitted between the terminal and the base station 1 is encrypted by the key of the base station 1.
  • Step 2 The base station 1 transmits an RRC message for triggering cell handover to the terminal.
  • the RRC message used to trigger the cell handover may carry the identifier of the target cell and the derived parameter of the key of the base station 2.
  • Step 3 Establish an RRC connection between the terminal and the base station 2.
  • RRC connection establishment process reference may be made to related processes in LTE, and the RRC connection establishment process in the future communication technology may change, but does not affect the implementation of the embodiment.
  • Step 4 After receiving the RRC message for triggering cell handover, the terminal may generate a new key (ie, the key of the base station 2).
  • step 5-10 In the downlink transmission process, update the bearer key, refer to step 5-10. among them:
  • Step 5 Base station 1 sets "hole”. For the "hole”, refer to the foregoing content, and details are not described herein again.
  • Step 6 The base station 1 sends a PDCP control PDU carrying the indication information to the terminal, and is used to indicate the sequence number corresponding to the “hole”.
  • a PDCP control PDU carrying the indication information to the terminal, and is used to indicate the sequence number corresponding to the “hole”.
  • Step 7 The base station 1 sends a start number to the base station 2 for instructing the base station 2 to number the data packets starting from the start number.
  • the starting number is the first serial number after the "hole". For example, suppose that the sequence number of the last data packet encrypted using the key of the base station 1 is 100, and the sequence number corresponding to the "hole" is 101, then the start number is 102.
  • the examples are merely illustrative of the application and should not be construed as limiting.
  • the base station 1 may transmit (partial) downlink data packets or copies of downlink data packets of the base station 1 (using the key of the base station 1) to the base station 2,
  • the base station 2 no longer encrypts these data packets (base station 1 has been encrypted) but sends it directly to the terminal. If it is a copy, these data packets are transmitted both through the base station 1 and through the base station 2, thereby improving the reliability of the transmission.
  • the base station 1 Before the base station 1 is disconnected, the base station 1 transmits the downlink data packet (encrypted by the base station 1) that has not been successfully acknowledged by the terminal to the base station 2, and the base station 2 no longer encrypts the data packets (the base station 1 is already encrypted), but Send directly to the terminal to avoid packet loss.
  • the base station 1 transmits the downlink data packet (encrypted by the base station 1) that has not been successfully acknowledged by the terminal to the base station 2, and the base station 2 no longer encrypts the data packets (the base station 1 is already encrypted), but Send directly to the terminal to avoid packet loss.
  • Step 8 The base station 2 encrypts the downlink data packet received from the serving gateway using the key of the base station 2, and numbers the downlink data packet from the start number.
  • Step 9 The base station 2 transmits a downlink data packet encrypted by the key of the base station 2 to the terminal.
  • Step 10 The terminal may skip the "hole” according to the indication information, decrypt the downlink data packet after the "hole” using the new key (ie, the key of the base station 2), and use the old key (ie, the key of the base station 1). Decrypt the downstream packets before the "hole”.
  • step 11-17 In the uplink transmission process, update the bearer key, refer to step 11-17. among them:
  • Step 11 The terminal can set "hole”.
  • Step 12 The terminal may send a PDCP control PDU carrying the indication information to the base station 1 and the base station 2, respectively, for indicating the sequence number corresponding to the “hole”.
  • Step 13 The terminal may encrypt the uplink data packet after the "hole” using the new key (ie, the key of the base station 2), and may encrypt the uplink data packet before the "hole” using the old key (ie, the key of the base station 1).
  • the terminal may send an uplink data packet to the base station 2.
  • the uplink data packet sent by the terminal to the base station 2 may include an uplink data packet encrypted by using the key of the base station 2, and may include an uplink data packet encrypted by using the key of the base station 1.
  • Step 15 The base station 2 may skip the “hole” according to the indication information, and decrypt the data packet after the "hole” by using the key of the base station 2.
  • Step 16 if the uplink data packet received by the base station 2 includes an uplink data packet encrypted by using the key of the base station 1, the uplink data packet encrypted by using the key of the base station 1 is forwarded to the base station 1 to ensure encryption.
  • the subsequent upstream packets can be decrypted correctly.
  • the forwarding of the encrypted data packet does not change the sequence number of the data packet.
  • the base station 1 may use the key of the base station 1 to decrypt the uplink data packet forwarded by the base station 2.
  • step 4 may occur after step 6.
  • step 2 may occur after step 6.
  • the terminal can wait for the new key to be generated, and then decrypt the data packet according to the indication information.
  • a timer may be set, and the received data packet that needs to be encrypted by using the new key is cached first. If the terminal receives the RRC message for triggering cell handover before the timer expires, a new key is generated to decrypt the data packet. Otherwise, the failure result may be returned to the base station.
  • the uplink transmission process may occur earlier than the downlink transmission process, and the uplink transmission process and the downlink transmission process may also occur simultaneously.
  • FIG. 11 is also applicable to a cell handover scenario in a base station, where the base station 1 and the base station 2 are the same base station.
  • the signaling interaction between the two base stations in Figure 11 is no longer needed.
  • FIG. 12 illustrates a wireless communication system, a terminal, and a network device.
  • the wireless communication system 10 includes a terminal 400 and a network device 500.
  • the terminal 400 may be the terminal 200 in the embodiment of FIG. 5
  • the network device 500 may be the network device 300 in the embodiment of FIG. 6, and the wireless communication system 10 may be the wireless communication system 100 described in FIG. 2 or FIG. Described separately below.
  • the terminal 400 may include a processing unit 401 and a communication unit 403.
  • the communication unit 403 is configured to receive the indication information sent by the network device 500 when the key of the bearer application is updated; the indication information is used to indicate the sequence number and the last of the data packet encrypted by the first application new key of the bearer. a sequence number of the interval between the sequence numbers of the data packets encrypted by the old key; the first sequence number of the data packet encrypted by the first application of the new key and the data encrypted by the last application of the old key The serial number of the package is not continuous;
  • the communication unit 403 is further configured to receive the data packet of the bearer sent by the network device 500.
  • the processing unit 401 is configured to skip the sequence number of the interval according to the indication information, and decrypt the data packet before the sequence number of the interval on the bearer by using the old key, on the bearer.
  • the data packet whose sequence number is after the sequence number of the interval is decrypted using the new key.
  • the communication unit 403 is configured to: when the key of the bearer application is updated, send the indication information to the network device 500; the indication information is used to indicate the sequence number and the last application of the data packet encrypted by the first application new key of the bearer.
  • the sequence number of the interval between the sequence numbers of the data packets encrypted by the old key; the sequence number of the data packet encrypted by the first application new key of the bearer and the sequence number of the data packet encrypted by the last application old key are discontinuous.
  • the terminal 400 can be implemented by the terminal 200 shown in FIG. 5, wherein the communication unit 403 can be implemented by the transmitter 206 and the receiver 205 in the terminal 200, and the processing unit 401 can be implemented by the terminal processor 201 in the terminal 200.
  • the network device 500 may include a communication unit 501 and a processing unit 503.
  • the communication unit 501 is configured to receive the indication information sent by the terminal 400 when the key of the bearer application is updated; the indication information is used to indicate the sequence number and the last one of the data packet encrypted by the first application new key of the bearer.
  • the sequence number of the interval between the sequence numbers of the data packets encrypted by the old key; the sequence number of the data packet encrypted by the first application of the new key and the data packet encrypted by the last application of the old key The serial number is not continuous;
  • the communication unit 501 is further configured to receive the data packet of the bearer sent by the terminal 400.
  • the processing unit 503 is configured to skip the sequence number of the interval according to the indication information, and decrypt the data packet before the sequence number of the interval on the bearer by using the old key, on the bearer.
  • the data packet whose sequence number is after the sequence number of the interval is decrypted using the new key.
  • the communication unit 501 is configured to: when the key of the bearer application is updated, send the indication information to the terminal 400; the indication information is used to indicate the sequence number of the data packet encrypted by the first application new key of the bearer and the last application old.
  • the sequence number of the interval between the sequence numbers of the data packets encrypted by the key; the sequence number of the data packet encrypted by the first application new key of the bearer and the sequence number of the data packet encrypted by the last application old key are discontinuous.
  • the network device 500 can be implemented by the network device 300 shown in FIG. 6, where the communication unit 501 can be implemented by the transmitter 305 and the receiver 306 in the network device 300, and the processing unit 401 can be processed by the network in the network device 300.
  • the device 301 is implemented.
  • the sender uses the characteristics of the PDCP layer to deliver in order, sets a “hole”, and sends indication information to the receiver to indicate the “hole” corresponding. Serial number.
  • the receiver can skip the "hole” according to the indication information, decrypt the data packet after the "hole” using the new key, and decrypt the data packet before the "hole” using the old key. In this way, the correct decryption of the data packet can be realized, the problem of the key confusion period is effectively solved, and the data transmission is not interrupted.
  • the above embodiments it may be implemented in whole or in part by software, hardware, firmware, or any combination thereof.
  • software it may be implemented in whole or in part in the form of a computer program product.
  • the computer program product includes one or more computer instructions.
  • the computer program instructions When the computer program instructions are loaded and executed on a computer, the processes or functions described in accordance with embodiments of the present invention are generated in whole or in part.
  • the computer can be a general purpose computer, a special purpose computer, a computer network, or other programmable device.
  • the computer instructions can be stored in a computer readable storage medium or transferred from one computer readable storage medium to another computer readable storage medium, for example, the computer instructions can be from a website site, computer, server or data center Transfer to another website site, computer, server, or data center by wire (eg, coaxial cable, fiber optic, digital subscriber line (DSL), or wireless (eg, infrared, wireless, microwave, etc.).
  • the computer readable storage medium can be any available media that can be accessed by a computer or a data storage device such as a server, data center, or the like that includes one or more available media.
  • the usable medium may be a magnetic medium (eg, a floppy disk, a hard disk, a magnetic tape), an optical medium (eg, a DVD), or a semiconductor medium (such as a solid state disk (SSD)).
  • the program can be stored in a computer readable storage medium, when the program is executed
  • the flow of the method embodiments as described above may be included.
  • the foregoing storage medium includes various media that can store program codes, such as a ROM or a random access memory RAM, a magnetic disk, or an optical disk.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本申请公开了一种通信方法，可包括：接收方接收第一设备发送的指示信息；所述指示信息用于指示所述承载的第一个应用新密钥加密的数据包的序号和最后一个应用旧密钥加密的数据包的序号之间间隔的序号；所述承载的第一个应用所述新密钥加密的数据包的序号和所述最后一个应用所述旧密钥加密的数据包的序号不连续；接收所述第一设备发送的所述承载的数据包；根据所述指示信息，跳过所述间隔的序号，对所述承载上的序号为所述间隔的序号之前的数据包使用所述旧密钥解密，对所述承载上的序号为所述间隔的序号之后的数据包使用所述新密钥解密。上述方案可实现数据包的正确解密，有效解决了密钥混淆期的问题，并保证数据传输不中断。

Description

通信方法、装置及*** 技术领域
本申请涉及无线通信技术领域，尤其涉及通信方法、装置及***。
背景技术
在移动通信***中，为了数据传输的保密性，在无线空口传输的数据需要进行安全保护，包括加密、完整性保护等操作。在4G和正在制定的5G通信技术中，安全保护功能在包数据汇聚协议(Packet Data Convergence Protocol，PDCP)层进行。空口的每个承载对应一个PDCP层的实体。如图1所示，在4G中，PDCP层的功能如下：
对于发送方，PDCP层从上层接收到一个数据包后，先分配一个PDCP序号，然后进行加密。对于无线资源控制(Radio Resource Control，RRC)信令，在加密之前还进行完整性保护。再对加密之后的数据包增加PDCP包头生成PDCP层协议数据单元(Protocol Data Unit，PDU)。最后，将PDCP PDU递交给下层从空口发送出去。
对于接收方，PDCP层从下层收到一个PDCP PDU后，首先去除包头，然后进行解密。对于RRC信令，解密之后还进行完整性检查。为了保证数据包的按序递交，如果数据包是按序的(即当前数据包的PDCP序号是上一个递交的数据包的PDCP序号加1)，则直接将数据包递交给上层，否则，等待直到数据包是按序的才递交给上层。例如，接收方将序号为100的数据包递交给上层后，当收到序号为102的数据包时，由于数据包102不是数据包100的下一个数据包，则数据包102不递交，等待直达收到数据包101后，才将数据包101和数据包102递交给上层。
应理解的，发送方使用哪个密钥进行加密，接收方需要使用相同的密钥进行解密。当一个承载的密钥发生更新时，接收方并不清楚发送方从哪个序号开始使用新的密钥(即密钥混淆期问题)。在LTE***里，小区切换会更新密钥，密钥更新也总是通过小区切换过程来实现的。即在小区切换过程中，数据传输中断，终端在收到切换命令后就应用新的密钥，在切换完成后，数据传输总是使用新的密钥，从而发送方和接收方能使用一致的密钥来加解密数据包。也即是说，LTE***是通过传输中断的方式来解决密钥混淆期问题。
发明内容
本申请提供了一种通信方法、装置及***，可实现数据包的正确解密，有效解决了密钥混淆期的问题，并保证数据传输不中断。
第一方面，本申请提供了一种通信方法，应用于发送方，该方法可包括：针对需要更新密钥的承载，可以将所述承载上的第一个应用新密钥加密的数据包的序号和最后一个应用旧密钥加密的数据包的序号设置成不连续。然后，向第二设备(即接收方)发送指示信息。这里，所述指示信息可用于确定所述承载的第一个应用新密钥加密的数据包的序号和最后一个应用旧密钥加密的数据包的序号之间间隔的序号。
第二方面，本申请提供了一种通信方法，应用于接收方，该方法可包括：接收第一设备(即发送方)发送的所述指示信息，并根据所述指示信息，跳过所述间隔的序号，对所 述承载上的序号为所述间隔的序号之前的数据包使用所述旧密钥解密，对所述承载上的序号为所述间隔的序号之后的数据包使用所述新密钥解密。
本申请中，所述承载包括以下至少一项：数据承载，或者信令承载。
本申请中，可以将第一个应用新密钥加密的数据包的序号和最后一个应用旧密钥加密的数据包的序号之间间隔的序号称为“空洞”。也即是说，在接收方接收到发送方发送的指示信息后，接收方可以跳过“空洞”，并且对“空洞”之后的数据包使用新密钥解密，对“空洞”之前的数据包使用旧密钥解密。
可以理解的，通过实施第一方面和第二方面描述的通信方法，可实现数据包的正确解密，有效的解决了密钥混淆期的问题，并保证数据传输不中断。
本申请中，跳过“空洞”是指接收方在收到所述指示信息的前提下，将第一个应用新密钥加密的数据包作为最后一个应用旧密钥加密的数据包的下一个数据包在解密后递交上层，即使所述第一个使用新密钥加密的数据包的序号并不等于所述最后一个使用旧密钥加密的数据包的序号不连续。
结合第一方面或第二方面，下面介绍本申请中所述指示信息的内容实现以及所述指示信息的传输方式：
(一)所述指示信息的内容实现以及跳过的“空洞”的具体实现
第一种实现方式，所述指示信息可以包括所述第一个应用所述新密钥加密的数据包的序号。为了便于说明，可以用序号y来表示所述第一个使用所述新密钥加密的数据包的序号。
具体的，在所述第一种实现方式中，接收方跳过的“空洞”对应序号y-1至序号y-n。接收方可以对序号大于或等于y的数据包使用新密钥解密，对序号小于或等于y-n-1的数据包使用旧密钥解密。其中，y、n是正整数。典型地，n可以为1。
第二种实现方式，所述指示信息可以包括所述最后一个应用旧密钥加密的数据包的序号。为了便于说明，可以用序号x来表示所述最后一个应用旧密钥加密的数据包的序号。
具体的，在所述第二种实现方式中，接收方跳过的“空洞”对应序号x+1至序号x+n。接收方可以对序号大于或等于x+n+1的数据包使用所述新密钥解密，对序号小于或等于x的数据包使用所述旧密钥解密。其中，x、n是正整数。典型地，n可以为1。
第三种实现方式，所述指示信息可以包括“空洞”对应的序号信息，即所述第一个应用新密钥的数据包的序号与所述最后一个应用旧密钥加密的数据包的序号之间间隔的序号信息。
在所述第三种实现方式中，“空洞”对应的序号信息可以是所述间隔的序号的范围[a,b]。这样，接收方跳过的“空洞”对应序号a至序号b。接收方可以对序号大于b的数据包使用所述新密钥解密，对序号小于a的数据包使用所述旧密钥解密。可选的，“空洞”对应的序号信息还可以是所述间隔的序号。其中，a、b是正整数。
在一些可选实施例中，所述指示信息还可以进一步的包括：所述间隔的序号所包括的序号个数。可选的，所述间隔的序号所包括的序号个数也可以是预先定义的数值。
(二)所述指示信息的传输方式
在一些可选的实施例中，所述指示信息可以携带在RRC层信令中或者PDCP控制PDU (PDCP control PDU)中。例如，在小区切换的场景下，基站可以在发送给终端的用于触发小区切换的RRC消息中携带所述指示信息。示例仅仅是本申请的一种实现方式，不应构成限定。
在一种可能的场景中，需要更新密钥的承载是多个。具体的，针对多个承载的所述指示信息可以是承载级的。
在一种实现方式中，针对所述多个承载，可以在一个信令(可为RRC层信令或PDCP控制PDU)里携带所述多个承载各自对应的所述指示信息和承载标识。
在另一种实现方式中，针对所述多个承载，可以为每个承载单独发送一个信令，即发送多个信令，所述多个信令可分别携带有所述多个承载各自对应的所述指示信息。例如，发送方通过各个承载分别发送PDCP控制PDU。一个承载上发送的PDCP控制PDU可携带有该承载对应的所述指示信息。而且，一个承载上发送的PDCP控制PDU携带有该承载的标识信息。这样，接收方接收到PDCP控制PDU后，直接可以知道该PDCP控制PDU携带的所述指示信息所对应的承载，无需额外指示所述指示信息对应的承载，可减少信令开销。
可选的，在小区切换场景下，所述指示信息可以通过源基站发送给终端，也可以通过目标基站发送给终端，还可以通过源基站和目标基站都发送给终端。
可选的，在双连接或多连接场景下，所述指示信息可以通过多个服务基站(如MeNB和SeNB)发送给终端，可以保证终端尽早接收到所述指示信息。
结合第一方面或第二方面，在一些可选实施例中，针对接收到的数据包，接收方(即第二设备)可以先进行解密。在接收到所述指示信息后，接收方再判断之前对数据包进行解密所使用的密钥是否正确，如果不正确，则重新使用正确的密钥进行解密。这样可以避免大量的数据包同时需要解密的情况。一些可能的实现方式可包括：
第一种实现方式：应用旧密钥对来自所述第二设备的所述承载的数据包进行解密。这种实现方式更加适用第二设备还未获取到新密钥的情况。例如，假设第二设备是终端，第一设备是基站。那么，当终端还没有接收到基站发送的用于触发更改密钥的RRC消息时，终端可以利用旧密钥对接收到的数据包进行解密。
在所述第一种实现方式中，在接收到所述指示信息后，第二设备可以根据所述指示信息，判断应用旧密钥解密的数据包是否已经被正确解密，如果被错误解密，则重新利用新密钥对所述被错误解密的数据包进行解密。
第二种实现方式：应用新密钥对来自所述第二设备的所述承载的数据包进行解密。这种实现方式更加适用第二设备已经获取到新密钥的情况。例如，假设第二设备是终端，第一设备是基站。那么，在终端接收到基站发送的用于触发更改密钥的RRC消息后，终端可以利用新密钥对接收到的数据包进行解密。示例仅仅用于解释本申请，不应构成限定。
在所述第二种实现方式中，在接收到所述指示信息后，第二设备可以根据所述指示信息，判断应用新密钥解密的数据包是否已经被正确解密，如果被错误解密，则重新利用旧密钥对所述被错误解密的数据包进行解密。
需要说明的，在上述两种实现方式中，第二设备对数据包先进行解密是使用新密钥还是旧密钥不限于上述两种实现方式中提及的策略，实际应用中还可以不同，不应构成限定。
结合第一方面或第二方面，在一些可选实施例中，第二设备在接收到数据包之后，可 以先判断数据包是否是按序的，如果按序，才进行解密，而不是先解密。这样可以减少不必要的解密。需要说明的，本申请中，在接收到所述指示信息后，第二设备可以跳过“空洞”，将第一个应用新密钥加密的数据包和最后一个应用旧密钥加密的数据包看作是按序的。
结合第一方面或第二方面，在一些可选实施例中，触发承载密钥更新的触发条件可包括以下至少一项：所述承载对应的服务基站的密钥发生改变，或者，所述承载对应的小区发生切换，或者，所述承载重配置。不限于这些触发条件，实际应用中，还可以存在其他能够触发承载密钥更新的触发条件。具体的，一旦这些触发条件发生，发送方(即所述第一设备)可以向接收方(所述第二设备)发送所述指示信息，用于指示接收方跳过“空洞”，并且对“空洞”之后的数据包使用新密钥解密，对“空洞”之前的数据包使用旧密钥解密。
第三方面，本申请提供了一种通信装置，该装置可包括多个功能模块，用于相应的执行第一方面所提供的方法，或者第一方面可能的实施方式中的任意一种所提供的方法。
第四方面，本申请提供了一种通信装置，该装置可包括多个功能模块，用于相应的执行第二方面所提供的方法，或者第二方面可能的实施方式中的任意一种所提供的方法、
第五方面，本申请提供了一种通信装置，用于执行第一方面描述的方法。所述通信装置可包括：存储器以及与所述存储器耦合的处理器、收发器，其中：所述收发器用于与其他通信设备通信。所述存储器用于存储第一方面描述的方法的实现代码，所述处理器用于执行所述存储器中存储的程序代码，即执行第一方面所提供的方法，或者第一方面可能的实施方式中的任意一种所提供的方法。
第六方面，本申请提供了一种通信装置，用于执行第二方面描述的方法。所述通信装置可包括：存储器以及与所述存储器耦合的处理器、收发器，其中：所述收发器用于与其他通信设备通信。所述存储器用于存储第二方面描述的方法的实现代码，所述处理器用于执行所述存储器中存储的程序代码，即执行第二方面所提供的方法，或者第二方面可能的实施方式中的任意一种所提供的方法。
第七方面，本申请提供了一种无线通信***，包括第一设备和第二设备，其中：所述第一设备可用于执行第一方面所提供的通信方法，或者第一方面可能的实施方式中的任意一种所提供的通信方法。所述第二设备可用于执行第二方面所提供的通信方法，或者第二方面可能的实施方式中的任意一种所提供的通信方法。
第八方面，提供了一种计算机可读存储介质，所述可读存储介质上存储有指令，当所述指令运行时，所述计算机可实现第一方面所提供的通信方法，或者第一方面可能的实施方式中的任意一种所提供的通信方法。
第九方面，提供了一种计算机可读存储介质，所述可读存储介质上存储有指令，当所述指令运行时，所述计算机可实现第二方面所提供的通信方法，或者第二方面可能的实施方式中的任意一种所提供的通信方法。
附图说明
为了更清楚地说明本申请实施例或背景技术中的技术方案，下面将对本申请实施例或背景技术中所需要使用的附图进行说明。
图1是LTE中收发两端的PDCP层的功能框图；
图2是本申请涉及的一种无线通信***的组网示意图；
图3是本申请涉及的另一种无线通信***的组网示意图；
图4是本申请涉及的双连接场景中的承载的示意图；
图5是本申请的一个实施例提供的终端的硬件架构示意图；
图6是本申请的一个实施例提供的基站的硬件架构示意图；
图7A-7B是本申请中的两种关于“空洞”的接收时序的示意图；
图8是本申请提供的通信方法的总体流程示意图；
图9是本申请提供的通信方法在基站密钥更新场景中实施的流程示意图；
图10是本申请提供的通信方法在承载重配置场景中实施的流程示意图；
图11是本申请提供的通信方法在小区切换场景中实施的流程示意图；
图12是本申请提供的无线通信***、终端和网络设备的功能框图。
具体实施方式
本申请的实施方式部分使用的术语仅用于对本申请的具体实施例进行解释，而非旨在限定本申请。
图2示出了本申请涉及的无线通信***。所述无线通信***可以是未来演进的第五代移动通信(the 5th Generation，5G)***、新空口(NR)***，也可以是长期演进(Long Term Evolution，LTE)***，还可以是机器与机器通信(Machine to Machine，M2M)***等。如图2所示，无线通信***100可包括：一个或多个终端101，一个或多个网络设备102，以及核心网103。其中：
终端101可以分布在整个无线通信***100中，可以是静止的，也可以是移动的。具体的，终端101可以是移动设备、移动台(mobile station)、移动单元(mobile unit)、M2M终端、无线单元，远程单元、用户代理、移动客户端等等。
网络设备102可以为基站，可用于与一个或多个终端进行通信，也可以用于与一个或多个具有部分终端功能的基站进行通信(比如宏基站与微基站，如接入点，之间的通信)。网络设备102可以是未来5G***、新空口(NR)***中的基站(gNB)，也可以是LTE***中的演进型基站(Evolutional Node B，eNB)，还可以是时分同步码分多址(Time Division Synchronous Code Division Multiple Access，TD-SCDMA)***中的基站收发台(Base Transceiver Station，BTS)等。另外，网络设备102还可以为接入点(Access Point，AP)、传输节点(Trans TRP)、中心单元(Central Unit，CU)或其他网络实体，并且可以包括以上网络实体的功能中的一些或所有功能。
核心网103可以是未来5G***、新空口(NR)***中的核心网(NextGen core)，也可以是LTE***中的演进分组核心网(Evolved Packet Core，EPC)，还可以是TD-SCDMA***中的核心网等。
如图2所示，网络设备102可以是新空口(NR)***中的基站(gNB)，核心网103可以是新空口(NR)***中的核心网(NextGen core)。终端101可以通过基站(gNB)访问核心网(NextGen core)。可选的，在无线通信***100中，网络设备102还可以是LTE***中的基站(eNB)，核心网103还可以是新空口(NR)***中的核心网(NextGen core)。也即是 说，终端101可以通过LTE***中的基站(eNB)访问新空口(NR)***中的核心网(NextGen core)。
需要说明的，除了图2所示的应用于单链接场景中的组网模式，无线通信***100还可以是应用于双链接(Dual Connectivity，DC)场景中的组网模式，例如未来5G非独立(non-standalone)组网模式，可参考图3。
如图3所示，无线通信***100可以是5G non-standalone组网模式，可包括终端101，LTE通信***中的网络设备104和核心网105，以及未来新空口(NR)通信***中的网络设备102和核心网103。其中，终端101和网络设备102、网络设备104均相连。这两个网络设备分别作为终端101的主基站(Master eNB，MeNB)、辅基站(Secondary eNB，SeNB)。主基站(MeNB)承担更多的控制功能。
如图4所示，由于存在主基站和辅基站，图3所示的无线通信***100中的承载类型可包括：
1.主小区组承载(master cell group bearer，MCG bearer)：承载的数据只能通过主基站下的小区进行传输，在主基站进行加解密，并通过主基站传输数据至核心网或通过主基站接收核心网下发的数据。
2.辅小区组承载(secondary cell group bearer，SCG bearer)：承载的数据只能通过辅基站下的小区进行传输，在辅基站进行加解密，并通过辅基站传输数据至核心网或通过辅基站接收核心网下发的数据。
3.主小区组分叉承载(MCG Split bearer)：承载的数据能通过主基站和辅基站下的服务小区进行传输，但是只能在主基站进行加解密，通过主基站传输数据至核心网或通过主基站接收核心网下发的数据。
4.辅小区组分叉承载(SCG Split bearer)：承载的数据能通过主基站和辅基站下的服务小区进行传输，但是只能在辅基站进行加解密，通过辅基站传输数据至核心网或通过辅基站接收核心网下发的数据。
可以理解的，当承载的类型发生变化，承载对应的负责加密的PDCP层实体迁移至新基站时，需要应用新基站的密钥来加密数据。例如，如图4所示，如果MCG bearer和SCG bearer替换，则MCG bearer对应的PDCP层实体会从原MeNB移至原SeNB，所应用的密钥需要更新为原SeNB的密钥。同理，SCG bearer对应的PDCP层实体会从原SeNB移至原MeNB，所应用的密钥需要更新为原MeNB的密钥。示例仅仅用于解释本申请，不应构成限定。
需要说明的，不限于图3所示的应用于双链接场景的non-standalone组网模式，无线通信***100还可以是LTE通信***中由宏基站(macro eNB)和微型基站(pico eNB)构成的应用于双链接场景的组网模式。不限于应用于双链接场景，无线通信***100还可以是应用于多连接场景的组网模式。本申请对无线通信***的组网模式不作限制。
参考图5，图5示出了本申请的一些实施例提供的终端200。本申请中，终端200可以是发送方(上行传输中)，也可以是接收方(下行传输中)。如图5所示，终端200可包括：一个或多个终端处理器201、存储器202、通信接口203、接收器205、发射器206、耦合器207、天线208、用户接口202，以及输入输出模块(包括音频输入输出模块210、按键 输入模块211以及显示器212等)。这些部件可通过总线204或者其他方式连接，图5以通过总线连接为例。其中：
通信接口203可用于终端200与其他通信设备，例如网络设备，进行通信。具体的，所述网络设备可以是图3所示的网络设备300。具体的，通信接口203可以是长期演进(LTE)(4G)通信接口，也可以是5G或者未来新空口的通信接口。不限于无线通信接口，终端200还可以配置有有线的通信接口203，例如局域接入网(Local Access Network，LAN)接口。
发射器206可用于对终端处理器201输出的信号进行发射处理，例如信号调制。接收器205可用于对天线208接收的移动通信信号进行接收处理，例如信号解调。在本申请的一些实施例中，发射器206和接收器205可看作一个无线调制解调器。在终端200中，发射器206和接收器205的数量均可以是一个或者多个。天线208可用于将传输线中的电磁能转换成自由空间中的电磁波，或者将自由空间中的电磁波转换成传输线中的电磁能。耦合器207用于将天线208接收到的移动通信信号分成多路，分配给多个的接收器205。
除了图5所示的发射器206和接收器205，终端200还可包括其他通信部件，例如GPS模块、蓝牙(Bluetooth)模块、无线高保真(Wireless Fidelity，Wi-Fi)模块等。不限于上述表述的无线通信信号，终端200还可以支持其他无线通信信号，例如卫星信号、短波信号等等。不限于无线通信，终端200还可以配置有有线网络接口(如LAN接口)来支持有线通信。
所述输入输出模块可用于实现终端200和用户/外部环境之间的交互，可主要包括包括音频输入输出模块210、按键输入模块211以及显示器212等。具体的，所述输入输出模块还可包括：摄像头、触摸屏以及传感器等等。其中，所述输入输出模块均通过用户接口209与终端处理器201进行通信。
存储器202与终端处理器201耦合，用于存储各种软件程序和/或多组指令。具体的，存储器202可包括高速随机存取的存储器，并且也可包括非易失性存储器，例如一个或多个磁盘存储设备、闪存设备或其他非易失性固态存储设备。存储器202可以存储操作***(下述简称***)，例如ANDROID，IOS，WINDOWS，或者LINUX等嵌入式操作***。存储器202还可以存储网络通信程序，该网络通信程序可用于与一个或多个附加设备，一个或多个终端设备，一个或多个网络设备进行通信。存储器202还可以存储用户接口程序，该用户接口程序可以通过图形化的操作界面将应用程序的内容形象逼真的显示出来，并通过菜单、对话框以及按键等输入控件接收用户对应用程序的控制操作。
在本申请的一些实施例中，存储器202可用于存储本申请的一个或多个实施例提供的资源分配方法在终端200侧的实现程序。关于本申请的一个或多个实施例提供的通信方法的实现，请参考后续实施例。
终端处理器201可用于读取和执行计算机可读指令。具体的，终端处理器201可用于调用存储于存储器212中的程序，例如本申请的一个或多个实施例提供的通信方法在终端200侧的实现程序，并执行该程序包含的指令。
可以理解的，终端200可以是图2或图3示出的无线通信***100中的终端101，可实施为移动设备，移动台(mobile station)，移动单元(mobile unit)，无线单元，远程 单元，用户代理，移动客户端等等。
需要说明的，图5所示的终端200仅仅是本申请实施例的一种实现方式，实际应用中，终端200还可以包括更多或更少的部件，这里不作限制。
参考图6，图6示出了本申请的一些实施例提供的网络设备300。本申请中，网络设备300可以是发送方(下行传输中)，也可以是接收方(上行传输中)。如图6所示，网络设备300可包括：一个或多个网络设备处理器301、存储器302、通信接口303、发射器305、接收器306、耦合器307和天线308。这些部件可通过总线304或者其他式连接，图6以通过总线连接为例。其中：
通信接口303可用于网络设备300与其他通信设备，例如终端设备或其他网络设备，进行通信。具体的，所述终端设备可以是图2所示的终端200。具体的，通信接口303通信接口203可以是长期演进(LTE)(4G)通信接口，也可以是5G或者未来新空口的通信接口。不限于无线通信接口，网络设备300还可以配置有有线的通信接口303来支持有线通信，例如一个网络设备300与其他网络设备300之间的回程链接可以是有线通信连接。
发射器305可用于对网络设备处理器301输出的信号进行发射处理，例如信号调制。接收器306可用于对天线308接收的移动通信信号进行接收处理。例如信号解调。在本申请的一些实施例中，发射器305和接收器306可看作一个无线调制解调器。在网络设备300中，发射器305和接收器306的数量均可以是一个或者多个。天线308可用于将传输线中的电磁能转换成自由空间中的电磁波，或者将自由空间中的电磁波转换成传输线中的电磁能。耦合器307可用于将移动通信号分成多路，分配给多个的接收器306。
存储器302与网络设备处理器301耦合，用于存储各种软件程序和/或多组指令。具体的，存储器302可包括高速随机存取的存储器，并且也可包括非易失性存储器，例如一个或多个磁盘存储设备、闪存设备或其他非易失性固态存储设备。存储器302可以存储操作***(下述简称***)，例如uCOS、VxWorks、RTLinux等嵌入式操作***。存储器302还可以存储网络通信程序，该网络通信程序可用于与一个或多个附加设备，一个或多个终端设备，一个或多个网络设备进行通信。
网络设备处理器301可用于进行无线信道管理、实施呼叫和通信链路的建立和拆除，并为本控制区内的用户提供小区切换控制等。具体的，网络设备处理器301可包括：管理/通信模块(Administration Module/Communication Module，AM/CM)(用于话路交换和信息交换的中心)、基本模块(Basic Module，BM)(用于完成呼叫处理、信令处理、无线资源管理、无线链路的管理和电路维护功能)、码变换及子复用单元(Transcoder and SubMultiplexer，TCSM)(用于完成复用解复用及码变换功能)等等。
本申请实施例中，网络设备处理器301可用于读取和执行计算机可读指令。具体的，网络设备处理器301可用于调用存储于存储器302中的程序，例如本申请的一个或多个实施例提供的通信方法在网络设备300侧的实现程序，并执行该程序包含的指令。
可以理解的，网络设备300可以是图2或图3示出的无线通信***100中的网络设备102或网络设备104，可实施为基站收发台，无线收发器，一个基本服务集(BSS)，一个扩展服务集(ESS)，NodeB，eNodeB，接入点或TRP等等。
需要说明的，图6所示的网络设备300仅仅是本申请实施例的一种实现方式，实际应用中，网络设备300还可以包括更多或更少的部件，这里不作限制。
本申请实施例提供了一种通信方法，该通信方法可以适用于基于前述无线通信***100、终端200以及网络设备300分别对应的实施例。
本申请提供的通信方法，利用PDCP层按序递交的特性，通过设置“空洞”的方式来解决更新承载密钥时发生的密钥混淆期的问题。具体的，发送方将所述承载的第一个使用新密钥加密的数据包的序号与最后一个使用旧密钥加密的数据包的序号设置成不连续，故意制造序号间隔(即“空洞”)。并且，发送方向接收方发送指示信息，用于确定“空洞”对应的序号。相应的，在接收方接收到发送方发送的指示信息后，接收方可以跳过“空洞”，并且对“空洞”之后的数据包使用新密钥解密，对“空洞”之前的数据包使用旧密钥解密。这样，可实现数据包的正确解密，并保证数据传输不中断。
本申请中，当承载对应的PDCP层实体所处的基站的密钥更新(对应后面提及的场景1)时，所述承载的密钥相应需要更新。当承载对应的PDCP层实体迁移至新的基站(对应后面提及的场景2和3)时，所述承载的密钥也相应需要更新。这里，这些场景可以称为承载密钥更新的触发条件。不限于这些触发条件，实际应用中，还可以存在其他能够触发承载密钥更新的触发条件，本申请提供的技术方均适用。
本申请中，所述承载可以是数据承载DRB，也可以是信令承载SRB。
本申请中，“空洞”即第一个应用新密钥加密的数据包的序号和最后一个应用旧密钥加密的数据包的序号之间间隔的(一个或多个)序号。
本申请中，跳过“空洞”是指接收方在收到所述指示信息的前提下，将第一个应用新密钥加密的数据包作为最后一个应用旧密钥加密的数据包的下一个数据包在解密后递交上层，即使所述第一个使用新密钥加密的数据包的序号并不等于所述最后一个使用旧密钥加密的数据包的序号加1。也就是说，本申请中，可以认为最后一个使用旧密钥加密的数据包的下一个数据包是第一个使用新密钥加密的数据包，即使两者之间有“空洞”。
可以理解的，由于“空洞”的存在，因此，使得使用新密钥加密的数据包即使在所述指示信息之前到达接收方，也不会被递交给上层，从而避免数据错误。
举例说明，如图7A-7B所示，在发送方，最后一个采用旧密钥加密的数据包的序号x与第一个采用新密钥加密的数据包的序号y之间不连续，即y大于x+1。也即是说，x与y之间存在“空洞”。这里，x、y均是正整数。
在一种可能的情况下，如图7A所示，所述指示信息早于数据包y到达接收方。针对这种情况，接收方可根据所述指示信息跳过x与y之间的“空洞”，在使用新密钥解密数据包y之后，在向上层递交解密后的数据包x之后向上层递交解密后的数据包y。
在另一种可能的情况下，如图7B所示，所述指示信息晚于数据包y到达接收方。针对这种情况，由于“空洞”的存在，数据包y并不会被递交上层。直到接收方接收到所述指示信息，接收方才跳过“空洞”，使用新密钥解密数据包y，并在向上层递交解密后的数据包x之后紧接着向上层递交解密后的数据包y。
需要说明的，图7所示的示例仅仅用于解释本申请，不应构成限定。
需要说明的是，本申请的序号可以是PDCP PDU里的PDCP序号，也可以是PDCP COUNT值。
需要说明的，信令承载的数据会进行完整性保护，在未来5G、新空口(NR)等***中，对于数据承载的数据可能也需要进行完整性保护，也涉及密钥更新的问题。本申请提供的通信方法也可以适用完整性保护的场景。
同样的，当本申请提供的通信方法应用在完整性保护场景中时，可以利用PDCP层按序递交的特性，通过设置“空洞”的方式来更新承载密钥。具体的，发送方可以将承载的第一个使用新密钥进行完整性保护的数据包的序号与最后一个使用旧密钥进行完整性保护的数据包的序号设置成不连续，故意制造序号间隔(即“空洞”)。并且，发送方向接收方发送指示信息，用于确定“空洞”对应的序号。相应的，在接收方接收到发送方发送的指示信息后，接收方可以跳过“空洞”，并且对“空洞”之后的数据包使用新密钥进行完整性检查，对“空洞”之前的数据包使用旧密钥进行完整性检查。后面图8实施例示出的总体方案，以及图9-11实施例示出的3大场景下的具体实施例也同样适用数据包的完整性保护，可以简单的将各个实施例中的“加密”替换成“完整性保护(或生产完整性消息鉴权码)”，可以将解密”替换成“完整性检查”。为了说明书的简洁，这里不重复赘述。这样，可实现对数据包进行正确的完整性检查，并保证数据传输不中断。
下面介绍本申请中所述指示信息的内容实现以及所述指示信息的传输方式。
(一)所述指示信息的内容实现以及跳过的“空洞”的具体实现
第一种实现方式，所述指示信息可以包括所述第一个应用所述新密钥加密的数据包的序号。为了便于说明，可以用序号y来表示所述第一个使用所述新密钥加密的数据包的序号。
具体的，在所述第一种实现方式中，接收方跳过的“空洞”对应序号y-1至序号y-n。接收方可以对序号大于或等于y的数据包使用新密钥解密，对序号小于或等于y-n-1的数据包使用旧密钥解密。其中，y、n是正整数。典型地，n可以为1。
第二种实现方式，所述指示信息可以包括所述最后一个应用旧密钥加密的数据包的序号。为了便于说明，可以用序号x来表示所述最后一个应用旧密钥加密的数据包的序号。
具体的，在所述第二种实现方式中，接收方跳过的“空洞”对应序号x+1至序号x+n。接收方可以对序号大于或等于x+n+1的数据包使用所述新密钥解密，对序号小于或等于x的数据包使用所述旧密钥解密。其中，x、n是正整数。典型地，n可以为1。
第三种实现方式，所述指示信息可以包括“空洞”对应的序号信息，即所述第一个应用新密钥的数据包的序号与所述最后一个应用旧密钥加密的数据包的序号之间间隔的序号信息。
在所述第三种实现方式中，“空洞”对应的序号信息可以是所述间隔的序号的范围[a,b]。这样，接收方跳过的“空洞”对应序号a至序号b。接收方可以对序号大于b的数据包使用所述新密钥解密，对序号小于a的数据包使用所述旧密钥解密。可选的，“空洞”对应的序号信息还可以是所述间隔的序号。其中，a、b是正整数。
在一些可选实施例中，所述指示信息还可以进一步的包括：所述间隔的序号所包括的序号个数。可选的，所述间隔的序号所包括的序号个数也可以是预先定义的数值。
例如，假设所述间隔的序号包括1个序号(通过协议预定义或者通过所述指示信息指示)。即所述第一个使用所述新密钥加密的数据包的序号y＝所述最后一个使用旧密钥加密的数据包的序号x+2，序号(x+1)即所述间隔的序号。当所述指示信息包括所述最后一个使用旧密钥加密的数据包的序号x时，所述指示信息用于指示接收方跳过x的后一个序号，即x+1。当所述指示信息包括所述第一个使用所述新密钥加密的数据包的序号y时，所述指示信息用于指示接收方跳过y的前一个序号，即y-1。
(二)所述指示信息的传输方式
在一些可选的实施例中，所述指示信息可以携带在RRC层信令中或者PDCP控制PDU(PDCP control PDU)中。例如，在小区切换的场景下，基站可以在发送给终端的用于触发小区切换的RRC消息中携带所述指示信息。示例仅仅是本申请的一种实现方式，不应构成限定。
在一种可能的场景中，需要更新密钥的承载是多个。具体的，针对多个承载的所述指示信息可以是承载级的。
在一种实现方式中，针对所述多个承载，可以在一个信令(可为RRC层信令或PDCP控制PDU)里携带所述多个承载各自对应的所述指示信息和承载标识。
在另一种实现方式中，针对所述多个承载，可以为每个承载单独发送一个信令，即发送多个信令，所述多个信令可分别携带有所述多个承载各自对应的所述指示信息。例如，发送方通过各个承载分别发送PDCP控制PDU。一个承载上发送的PDCP控制PDU可携带有该承载对应的所述指示信息。而且，一个承载上发送的PDCP控制PDU携带有该承载的标识信息。这样，接收方接收到PDCP控制PDU后，直接可以知道该PDCP控制PDU携带的所述指示信息所对应的承载，无需额外指示所述指示信息对应的承载，可减少信令开销。
在小区切换场景下，所述指示信息可以通过源基站发送给终端，也可以通过目标基站发送给终端，还可以通过源基站和目标基站都发送给终端。
在双连接或多连接场景下，所述指示信息可以通过多个服务基站(如MeNB和SeNB)发送给终端，可以保证终端尽早接收到所述指示信息。
图8示出了本申请提供的通信方法的总体流程。在图8所示的通信方法中，第一设备即发送方，第二设备即接收方。在上行传输过程中，第一设备可以是终端，第二设备可以是网络设备。在下行传输过程中，第一设备可以是网络设备，第二设备可以是终端。如图8所示，所述通信方法可展开为：
S102，对于需要更新密钥的承载，第一设备可以设置“空洞”，应用新密钥加密所述承载的数据包。这里，“空洞”即第一个应用新密钥加密的数据包的序号和最后一个应用旧密钥加密的数据包的序号之间间隔的序号。关于“空洞”在本申请中的定义和说明可参考前述内容，这里不赘述。关于承载密钥需要更新的触发条件可以参考前述内容，这里不赘述。
S103，第一设备向第二设备发送指示信息，用于指示“空洞”对应的序号。
S104，第一设备向第二设备发送采用新密钥加密的数据包。应理解的，在所述承载应用的密钥发生更新之前，第一设备可以使用旧密钥加密所述承载的数据包，并向第二设备发送采用旧密钥加密的数据包，可参考S101。
具体的，关于所述指示信息的内容实现和传输方式，可参考前述内容，这里不赘述。
S105，相应的，第二设备接收到第一设备发送的所述指示信息以及数据包。并且，第二设备可以根据所述指示信息，跳过“空洞”，对“空洞”之前的数据包使用所述旧密钥解密，对“空洞”之后的数据包使用所述新密钥解密。关于根据所述指示信息如何跳过“空洞”，可参考前述内容，这里不再赘述。
可以理解的，由于移动通信的空口的传输特性，因此，采用旧密钥加密的数据包、所述指示信息，以及采用新密钥加密的数据包可能会乱序到达第二设备。由于“空洞”的存在以及PDCP层按序递交的特性，因此，无论所述指示信息是先于还是晚于第一个采用新密钥加密的数据包到达，第二设备都能根据所述指示信息完成对数据包的正确解密，具体可参考图7A-7B的相关说明，这里不再赘述。
可以理解的，如图8所示，本申请提供的通信方法可以在承载应用的密钥发生更新时，在确保数据传输不中断的前提下，对分别采用新、旧密钥加密的数据包进行正确解密，完全解决了密钥混淆期问题。
需要说明的，不限于图8所示的时序，这里不限制第一设备先设置“空洞”再应用新密钥加密数据包，第一设备也可以先应用新密钥加密所述承载的数据包，并向第二设备发送采用新密钥加密的数据包。也即是说，图中S104也可以发生在S103之前。
在本申请的一些可选实施例中，针对接收到的数据包，第二设备可以先进行解密。在接收到所述指示信息后，再判断之前对数据包进行解密所使用的密钥是否正确，如果不正确，则重新使用正确的密钥进行解密。这样可以避免大量的数据包同时需要解密的情况。这种实施例比较适用图7B所示的场景，即所述指示信息晚于所述第一个采用新密钥加密的数据包到达的场景。一些可能的实现方式可包括：
第一种实现方式：应用旧密钥对来自所述第二设备的所述承载的数据包进行解密。这种实现方式更加适用第二设备还未获取到新密钥的情况。例如，假设第二设备是终端，第一设备是基站。那么，当终端还没有接收到基站发送的用于触发更改密钥的RRC消息时，终端可以利用旧密钥对接收到的数据包进行解密。
在所述第一种实现方式中，在接收到所述指示信息后，第二设备可以根据所述指示信息，判断应用旧密钥解密的数据包是否已经被正确解密，如果被错误解密，则重新利用新密钥对所述被错误解密的数据包进行解密。
第二种实现方式：应用新密钥对来自所述第二设备的所述承载的数据包进行解密。这种实现方式更加适用第二设备已经获取到新密钥的情况。例如，假设第二设备是终端，第一设备是基站。那么，在终端接收到基站发送的用于触发更改密钥的RRC消息后，终端可以利用新密钥对接收到的数据包进行解密。示例仅仅用于解释本申请，不应构成限定。
在所述第二种实现方式中，在接收到所述指示信息后，第二设备可以根据所述指示信息，判断应用新密钥解密的数据包是否已经被正确解密，如果被错误解密，则重新利用旧密钥对所述被错误解密的数据包进行解密。
需要说明的，在上述两种实现方式中，第二设备对数据包先进行解密是使用新密钥还是旧密钥不限于上述两种实现方式中提及的策略，实际应用中还可以不同，不应构成限定。
在本申请的一些可选实施例中，第二设备在接收到数据包之后，可以先判断数据包是否是按序的，如果按序，才进行解密，而不是先解密。这样可以减少不必要的解密。需要 说明的，本申请中，在接收到所述指示信息后，第二设备可以跳过“空洞”，将第一个应用新密钥加密的数据包和最后一个应用旧密钥加密的数据包看作是按序的。
本申请提供的技术方案至少可以适用于以下(承载的密钥更新)场景(不限于这些场景)：
场景1：服务基站的密钥更新，每个承载使用的密钥随之更新。例如，PDCP COUNT值发生翻转，承载ID耗尽等。
场景2：双连接或多连接场景，承载类型的重配置。例如，承载从MCG split bearer变为SCG split bearer。
场景3：小区切换场景(承载的密钥从源基站的密钥变成目标基站的密钥)。
下面分别在上述3大场景中详细描述本申请提供的技术方案。
图9示出了本申请提供的资源分配方法在场景1中的具体实施。可以理解的，在下行传输过程中，基站即前述第一设备，终端即前述第二设备。在上行传输过程中，终端即前述第一设备，基站即前述第二设备。下面分别从三个阶段来描述本申请提供的资源分配方法在场景1中的具体实施。
(1)新密钥生成阶段，可参考步骤2-4。其中：
步骤1.终端进入RRC连接态，与基站建立承载，用于传输数据。
步骤2.基站触发密钥更新，生成新密钥。具体的，基站的密钥更新的触发条件可以是PDCP COUNT值发生翻转，或者承载ID耗尽等。
步骤3.在基站生成新密钥之后，基站可以向终端发送RRC消息，用于触发终端更新密钥。这里，该RRC消息可以是RRC重配置消息。
步骤4.终端在接收到该RRC消息后，生成新密钥。可选的，该RRC消息可携带用于生成新密钥的衍生参数。可选的，所述用于生成新密钥的衍生参数也可以通过PDCP控制PDU发送给终端。
可选的，在基站侧和终端侧，新密钥并不立即替换旧密钥，而是新旧密钥同时使用一段时间，可以避免无法解密延迟到达的采用旧密钥解密的数据包。
(2)在下行传输过程中，更新承载的密钥，可参考步骤5-7。其中：
步骤5.针对需要更新密钥的承载，基站可以设置“空洞”，使用新密钥加密“空洞”之后的下行数据包。应理解的，在场景1中，基站的密钥发生更新，该基站与终端之间的所有承载的密钥都需要更新。这里，“空洞”即第一个应用新密钥加密的数据包的序号和最后一个应用旧密钥加密的数据包的序号之间间隔的序号。关于“空洞”在本申请中的定义和说明可参考前述内容，这里不赘述。
步骤6.基站向终端发送携带有指示信息的PDCP控制PDU。所述指示信息用于指示“空洞”对应的序号。
可选的，所述指示信息还可以携带在步骤3中的所述RRC消息中。即基站可以在步骤3之前设置“空洞”，然后通过所述RRC消息下发所述指示信息。基站可以不再执行步骤6。
关于所述指示信息的内容实现和传输方式，可参考前述内容，这里不赘述。
具体实现时，基站可以在步骤3中的RRC消息发送之后就向终端发送携带所述指示信 息的PDCP控制PDU，也可以在发送完该RRC消息之后等一段时间再发送该PDCP控制PDU，本申请不作限制。
步骤7.在接收到所述指示信息之后，终端可以根据所述指示信息，跳过“空洞”，对“空洞”之前的下行数据包使用旧密钥解密，对“空洞”之后的下行数据包使用新密钥解密。关于根据所述指示信息如何跳过“空洞”，可参考前述内容，这里不再赘述。
(3)在上行传输过程中，承载应用的密钥发生更新，可参考步骤8-10。其中：
步骤8.对于密钥发生更新的承载，终端可以设置“空洞”，并使用新密钥加密“空洞”之后的上行数据包。关于“空洞”在本申请中的定义和说明可参考前述内容，这里不赘述。
步骤9.终端向基站发送携带有指示信息的PDCP控制PDU。所述指示信息用于指示“空洞”对应的序号。可选的，所述指示信息可以携带在终端向基站发送的RRC响应消息中。关于所述指示信息的内容实现和传输方式，可参考前述内容，这里不赘述。
步骤10.在接收到所述指示信息之后，基站可以根据所述指示信息，跳过“空洞”，对“空洞”之前的上行数据包使用旧密钥解密，对“空洞”之后的上行数据包使用新密钥解密。关于根据所述指示信息如何跳过“空洞”，可参考前述内容，这里不再赘述。
需要说明的，在更新承载密钥的整个过程中，基站与终端之间的数据传输并不中断。即，在承载的新旧密钥发生更替的过程中，使用旧密钥加密“空洞”之前的数据包，并发送加密后的数据包；使用新密钥加密“空洞”之后的数据包，并发送加密后的数据包。也即是说，数据传输完全可以不受承载密钥更新的影响。
需要说明的，不限于图9示出的时序，当所述指示信息到达终端时，终端可能还未生成新密钥。即步骤4可能发生在步骤6之后。甚至，当所述指示信息到达终端时，所述用于触发生成新密钥的RRC消息可能还未到达终端。即步骤3-4都可能发生在步骤6之后。针对这两种情况，终端可以等待新密钥生成之后，再根据所述指示信息解密“空洞”之后的数据包。
可选的，当所述指示信息比所述用于触发生成新密钥的RRC消息先到达终端时，可以设置一个定时器，并先缓存接收到的需要使用新密钥加密的数据包。如果在定时器超时前终端接收到了该RRC消息，则生成新密钥来解密数据包，否则，可以按失败处理，向基站返回失败结果。
需要说明的，不限于图9示出的时序，上行传输过程可以早于下行传输过程发生，上行传输过程和下行传输过程也可以同时发生。
可以理解的，在场景1中，当基站的密钥发生更新时，通过发送方设置“空洞”，并指示出“空洞”对应的序号，可以实现到达接收方的数据包能够被接收方正确解密，又能保证数据的持续传输，不中断。
可以理解的，采用本实施例的方法，当基站的密钥发生更新时，可以不再通过小区切换来更新密钥，而是使用RRC连接重配置过程来更新密钥，不重建立PDCP实体，从而不会导致数据传输中断。
图10示出了本申请提供的资源分配方法在场景2中的具体实施。图10实施例中，以终端连接至2个服务基站为例进行说明，其中，基站1是主站(如LTE中的MeNB)，基站2 是辅站(如LTE中的SeNB)。可以理解的，在下行传输过程中，一个或多个服务基站即前述第一设备，终端即前述第二设备。在上行传输过程中，终端即前述第一设备，一个或多个服务基站即前述第二设备。图10实施例以双连接场景中的承载重配置为例，描述了本申请提供的通信方法。假设，在重配置之前承载的类型为MCG split bear，在重配置之后承载的类型是SCG split bearer。下面展开描述。
(1)承载重配置，可参考步骤1-2。其中：
步骤1.终端与基站1基于承载(如MCG split bearer)进行数据传输。这里，承载的数据包采用基站1的密钥加密。
步骤2.基站1向终端发送RRC重配置消息(RRC Reconfiguration Message)，用于触发承载的重配置，更新承载类型。具体的，所述RRC重配置消息可携带新的承载类型(如SCG split bearer)的信息。在多连接场景下，所述RRC重配置消息还可携带基站2的标识，用于指示承载的PDCP实体迁移至基站2，终端可以经过基站2的服务小区传输数据。
可选的，所述RRC重配置消息还可携带基站2的密钥的衍生参数。可选的，在接收到所述RRC重配置消息之后，终端可以生成新密钥(即基站2的密钥)。应理解的，在基站1添加基站2为辅站时，基站1也可以向终端下发基站2的密钥的衍生参数，这样，在承载的PDCP实体迁移至基站2时，基站1可以不必再向终端发送所述衍生参数。
(2)在下行传输过程中，更新承载密钥，可参考步骤3-8。其中:
步骤3.基站1(主站)设置“空洞”。关于“空洞”可参考前述内容，这里不再赘述。
步骤4.基站1向终端发送携带指示信息的PDCP控制PDU，用于指示“空洞”对应的序号。关于所述指示信息的实现可参考前述内容，这里不再赘述。
步骤5.基站1向基站2发送起始编号，用于指示基站2从所述起始编号开始对数据包进行编号。
这里，所述起始编号为“空洞”后的第一个序号。例如，假设最后一个使用基站1的密钥加密的数据包的序号是100，“空洞”对应的序号为101，那么，所述起始编号为102。示例仅仅用于解释本申请，不应构成限定。
步骤6-7.基站2使用基站2密钥加密下行数据包，并从所述起始编号开始对下行数据包进行编号。基站2向终端发送采用基站2的密钥加密的下行数据包。
步骤8.终端可根据所述指示信息跳过“空洞”，并对接收到的下行数据包进行解密。
这里，终端接收到的下行数据包可包括采用基站2的密钥加密的下行数据包，还可能包括采用基站1的密钥加密的下行数据包。
具体的，终端可以使用基站1的密钥解密“空洞”之前的数据包，使用基站2的密钥解密“空洞”之后的数据包，可实现下行数据包的正确解密。
(3)在上行传输过程中，更新承载密钥，可参考步骤9-18。其中:
步骤9.终端可以设置“空洞”。
步骤10a-10b.终端可以分别向基站1、基站2发送携带指示信息的PDCP控制PDU，用于指示“空洞”对应的序号。基站1和基站2分别根据各自收到的指示信息判断接收到的上行数据包是采用基站1的密钥加密的，还是采用基站2的密钥加密的。
应理解的，根据MCG split bearer和SCG split bearer各自的功能可知，MCG split  bearer或SCG split bearer的数据都可以通过主站(即基站1)和辅站(即基站2)下的服务小区进行传输。
步骤11.终端可以使用新密钥(即基站2的密钥)加密“空洞”之后的上行数据包，可以使用旧密钥(即基站1的密钥)加密“空洞”之前的上行数据包。
步骤12a-12b.终端可以向基站2发送上行数据包，也可以向基站1发送上行数据包。
应理解的，由于MCG split bearer或SCG split bearer的数据都可以通过主站(即基站1)和辅站(即基站2)下的服务小区进行传输。因此，终端发送给基站2上行数据包可能包括采用基站1的密钥加密的数据包。同样的，终端发送给基站1上行数据包可能包括采用基站2的密钥加密的数据包。
步骤13a-13b.基站2可以根据所述指示信息跳过“空洞”，并利用基站2的密钥解密“空洞”之后的数据包，可参考步骤13a。基站1可以根据所述指示信息跳过“空洞”，并利用自身密钥解密“空洞”之前的数据包，可参考步骤13b。
步骤14a-14b.可选的，如果基站2接收到的上行数据包包括采用基站1的密钥加密的上行数据包，则将采用基站1的密钥加密的上行数据包转发至基站1，可参考步骤14a。可选的，如果基站1接收到的上行数据包包括采用基站2的密钥加密的上行数据包，则将采用基站2的密钥加密的上行数据包转发至基站2，可参考步骤14b。这里，加密数据包的转发并不改变数据包的序号。
步骤15a-15b.可选的，基站1可以使用基站1的密钥对基站2转发过来的上行数据包进行解密，可参考步骤15a。可选的，基站2可以使用基站2的密钥对基站1转发过来的上行数据包进行解密，可参考步骤15b。
在一些可选实施例中，上述步骤3-4也可以由基站2执行。即由基站2(辅站)来设置空洞，并对“空洞”进行指示。
需要说明的，不限于MCG split bearer到SCG split bearer这种承载类型变化的承载重配置场景，图10实施例也可适用其他形式的承载类型变化的承载重配置场景。图10实施例还可适用其他形式的承载重配置场景，只要承载的PDCP实体迁移至新的基站即可。
假设，图10实施例中的承载重配置场景是承载类型从MCG bearer变化为SCG bearer。由于，MCG bearer的数据包只能通过主基站下的服务小区进行传输，SCG bearer的数据包只能通过辅基站下的服务小区进行传输。因此，在上行传输过程中，终端侧可以不必再进行“空洞”设置，可以直接将采用基站1的密钥加密的上行数据包发送给基站1，直接将采用基站2的密钥加密的上行数据包发送给基站2，便可以完成承载密钥更新后的上行传输。
需要说明的，不限于图10示出的时序，当所述指示信息到达终端时，终端可能还未生成新密钥。甚至，当所述指示信息到达终端时，所述RRC重配置消息可能还未到达终端。即步骤2都可能发生在步骤4之后。针对这两种情况，终端可以等待新密钥生成之后，再根据所述指示信息解密数据包。
可选的，当所述指示信息比所述RRC重配置消息先到达终端时，可以设置一个定时器，并先缓存接收到的需要使用新密钥加密的数据包。如果在定时器超时前终端接收到了所述RRC重配置消息，则生成新密钥来解密数据包，否则，可以按失败处理，向基站返回失败 结果。
需要说明的，不限于图10示出的时序，上行传输过程可以早于下行传输过程发生，上行传输过程和下行传输过程也可以同时发生。
可以理解的，在场景2中，当发生承载重配置时，通过发送方设置“空洞”，并指示出“空洞”对应的序号，可以实现到达接收方的数据包能够被接收方正确解密，又能保证数据的持续传输，不中断。
图11示出了本申请提供的资源分配方法在场景3中的具体实施。图11实施例中，终端从基站1(源基站)的服务小区切换至基站2(目标基站)的服务小区，即基站间的小区切换。相应的，负责承载的数据包加解密的PDCP实体也从基站1迁移至基站2。可以理解的，在下行传输过程中，目标基站或源基站即前述第一设备，终端即前述第二设备。在上行传输过程中，终端即前述第一设备，目标基站或源基站即前述第二设备。下面展开描述。
(1)基站间的小区切换，可参考步骤1-4。其中：
步骤1.切换前，终端与基站1进行数据传输。终端与基站1之间传输的数据包采用基站1的密钥加密。
步骤2.基站1向终端发送用于触发小区切换的RRC消息。具体的，所述用于触发小区切换的RRC消息可携带目标小区的标识，以及基站2的密钥的衍生参数。
步骤3.终端与基站2之间建立RRC连接。关于RRC连接建立过程可参考LTE中的相关流程，未来通信技术中的RRC连接建立过程可能发生变化，但不影响本实施例的实施。
步骤4.在接收到所述用于触发小区切换的RRC消息之后，终端可以生成新密钥(即基站2的密钥)。
(2)在下行传输过程中，更新承载密钥，可参考步骤5-10。其中:
步骤5.基站1设置“空洞”。关于“空洞”可参考前述内容，这里不再赘述。
步骤6.基站1向终端发送携带指示信息的PDCP控制PDU，用于指示“空洞”对应的序号。关于所述指示信息的实现可参考前述内容，这里不再赘述。
步骤7.基站1向基站2发送起始编号，用于指示基站2从所述起始编号开始对数据包进行编号。
这里，所述起始编号为“空洞”后的第一个序号。例如，假设最后一个使用基站1的密钥加密的数据包的序号是100，“空洞”对应的序号为101，那么，所述起始编号为102。示例仅仅用于解释本申请，不应构成限定。
为了保证空口传输的不中断，在步骤5之前和/或之后，基站1可以将基站1加密(使用基站1的密钥)的(部分)下行数据包或下行数据包的副本发送给基站2，基站2对这些数据包不再进行加密(基站1已经加密)，而是直接发送给终端。如果是副本，则这些数据包既通过基站1发送，也通过基站2发送，从而提高传输的可靠性。在基站1断开之前，基站1将未被终端确认成功接收的(基站1加密的)下行数据包发送给基站2，基站2对这些数据包不再进行加密(基站1已经加密)，而是直接发送给终端，从而避免数据包的丢失。
步骤8.基站2使用基站2的密钥加密从服务网关接收到的下行数据包，并从所述起 始编号开始对下行数据包进行编号。
步骤9.基站2向终端发送采用基站2的密钥加密的下行数据包。
步骤10.终端可根据所述指示信息跳过“空洞”，使用新密钥(即基站2的密钥)解密“空洞”之后的下行数据包，使用旧密钥(即基站1的密钥)解密“空洞”之前的下行数据包。
(3)在上行传输过程中，更新承载密钥，可参考步骤11-17。其中:
步骤11.终端可以设置“空洞”。
步骤12.终端可以分别向基站1、基站2发送携带指示信息的PDCP控制PDU，用于指示“空洞”对应的序号。
步骤13.终端可以使用新密钥(即基站2的密钥)加密“空洞”之后的上行数据包，可以使用旧密钥(即基站1的密钥)加密“空洞”之前的上行数据包。
步骤14.终端可以向基站2发送上行数据包。具体的，终端向基站2发送的上行数据包可包括采用基站2的密钥加密的上行数据包，有可能包括采用基站1的密钥加密的上行数据包。
步骤15.基站2可以根据所述指示信息跳过“空洞”，并利用基站2的密钥解密“空洞”之后的数据包。
步骤16.可选的，如果基站2接收到的上行数据包包括采用基站1的密钥加密的上行数据包，则将采用基站1的密钥加密的上行数据包转发至基站1，可确保加密后的上行数据包都能被正确解密。这里，加密数据包的转发并不改变数据包的序号。
步骤17.可选的，基站1可以使用基站1的密钥对基站2转发过来的上行数据包进行解密。
需要说明的，不限于图11示出的时序，当所述指示信息到达终端时，终端可能还未生成新密钥。即步骤4可能发生在步骤6之后。甚至，当所述指示信息到达终端时，所述用于触发小区切换的RRC消息可能还未到达终端。即步骤2都可能发生在步骤6之后。针对这两种情况，终端可以等待新密钥生成之后，再根据所述指示信息解密数据包。
可选的，当所述指示信息比所述用于触发小区切换的RRC消息先到达终端时，可以设置一个定时器，并先缓存接收到的需要使用新密钥加密的数据包。如果在定时器超时前终端接收到了所述用于触发小区切换的RRC消息，则生成新密钥来解密数据包，否则，可以按失败处理，向基站返回失败结果。
需要说明的，不限于图11示出的时序，上行传输过程可以早于下行传输过程发生，上行传输过程和下行传输过程也可以同时发生。
需要说明的，图11实施例也适用于基站内的小区切换场景，此时基站1和基站2是同一个基站。相应的，图11中两个基站之间的信令交互不再需要。
可以理解的，在场景3中，当发生小区切换时，通过发送方设置“空洞”，并指示出“空洞”对应的序号，可以实现到达接收方的数据包能够被接收方正确解密，又能保证数据的持续传输，不中断。
参见图12，图12示出了本申请提供一种无线通信***、终端及网络设备。无线通信 ***10包括：终端400和网络设备500。其中，终端400可以为图5实施例中的终端200，网络设备500可以为图6实施例中的网络设备300，无线通信***10可以是图2或图3描述的无线通信***100。下面分别描述。
如图12所示，终端400可包括：处理单元401和通信单元403。
其中，当承载应用的密钥发生更新是发生在下行传输过程中：
通信单元403可用于当承载应用的密钥发生更新时，接收网络设备500发送的指示信息；所述指示信息用于指示所述承载的第一个应用新密钥加密的数据包的序号和最后一个应用旧密钥加密的数据包的序号之间间隔的序号；所述承载的第一个应用所述新密钥加密的数据包的序号和所述最后一个应用所述旧密钥加密的数据包的序号不连续；
通信单元403还可用于接收网络设备500发送的所述承载的数据包；
处理单元401可用于根据所述指示信息，跳过所述间隔的序号，对所述承载上的序号为所述间隔的序号之前的数据包使用所述旧密钥解密，对所述承载上的序号为所述间隔的序号之后的数据包使用所述新密钥解密。
当承载应用的密钥发生更新是发生在上行传输过程中：
通信单元403可用于当承载应用的密钥更新时，向网络设备500发送指示信息；所述指示信息用于指示所述承载的第一个应用新密钥加密的数据包的序号和最后一个应用旧密钥加密的数据包的序号之间间隔的序号；所述承载的第一个应用新密钥加密的数据包的序号和最后一个应用旧密钥加密的数据包的序号不连续。
关于“空洞”的定义和说明、所述指示信息以及跳过“空洞”的具体实现可参考前述方法实施例，这里不再赘述。
具体的，终端400可以通过图5所示的终端200实现，其中，通信单元403可以通过终端200中的发射器206和接收器205实现，处理单元401可以通过终端200中终端处理器201实现。
可以理解的，关于终端400包括的各个功能单元的具体实现可参考前述各个方法实施例，这里不再赘述。
如图9所示，网络设备500可包括：通信单元501和处理单元503。
其中，当承载应用的密钥发生更新是发生在上行传输过程中：
通信单元501可用于当承载应用的密钥发生更新时，接收终端400发送的指示信息；所述指示信息用于指示所述承载的第一个应用新密钥加密的数据包的序号和最后一个应用旧密钥加密的数据包的序号之间间隔的序号；所述承载的第一个应用所述新密钥加密的数据包的序号和所述最后一个应用所述旧密钥加密的数据包的序号不连续；
通信单元501还可用于接收终端400发送的所述承载的数据包；
处理单元503可用于根据所述指示信息，跳过所述间隔的序号，对所述承载上的序号为所述间隔的序号之前的数据包使用所述旧密钥解密，对所述承载上的序号为所述间隔的序号之后的数据包使用所述新密钥解密。
其中，当承载应用的密钥发生更新是发生在下行传输过程中：
通信单元501可用于当承载应用的密钥更新时，向终端400发送指示信息；所述指示 信息用于指示所述承载的第一个应用新密钥加密的数据包的序号和最后一个应用旧密钥加密的数据包的序号之间间隔的序号；所述承载的第一个应用新密钥加密的数据包的序号和最后一个应用旧密钥加密的数据包的序号不连续。
关于“空洞”的定义和说明、所述指示信息以及跳过“空洞”的具体实现可参考前述方法实施例，这里不再赘述。
具体的，网络设备500可以通过图6所示的网络设备300实现，其中，通信单元501可以通过网络设备300中的发射器305和接收器306实现，处理单元401可以通过网络设备300中网络处理器301实现。
可以理解的，关于网络设备500包括的各个功能单元的具体实现可参考前述各个实施例，这里不再赘述。
综上，实施本申请实施例，当承载应用的密钥发生更新时，发送方利用PDCP层按序递交的特性，设置“空洞”，并向接收方发送指示信息，用于指示“空洞”对应的序号。这样，接收方可以根据所述指示信息跳过“空洞”，对“空洞”之后的数据包使用新密钥解密，对“空洞”之前的数据包使用旧密钥解密。这样，可实现数据包的正确解密，有效解决了密钥混淆期的问题，并保证数据传输不中断。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。所述计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行所述计算机程序指令时，全部或部分地产生按照本发明实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线(DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质，(例如，软盘、硬盘、磁带)、光介质(例如，DVD)、或者半导体介质(例如固态硬盘Solid State Disk(SSD))等。
本领域普通技术人员可以理解实现上述实施例方法中的全部或部分流程，该流程可以由计算机程序来指令相关的硬件完成，该程序可存储于计算机可读取存储介质中，该程序在执行时，可包括如上述各方法实施例的流程。而前述的存储介质包括：ROM或随机存储记忆体RAM、磁碟或者光盘等各种可存储程序代码的介质。

Claims (30)

  1. 一种通信方法，其特征在于，包括：
    接收第一设备发送的指示信息，其中，所述指示信息用于确定承载上的第一个应用新密钥加密的数据包的序号和最后一个应用旧密钥加密的数据包的序号之间间隔的序号，所述承载上的第一个应用所述新密钥加密的数据包的序号和所述最后一个应用所述旧密钥加密的数据包的序号不连续；
    根据所述指示信息，跳过所述间隔的序号，对所述承载上的序号为所述间隔的序号之前的数据包使用所述旧密钥解密，对所述承载上的序号为所述间隔的序号之后的数据包使用所述新密钥解密。
  2. 如权利要求1所述的方法，其特征在于，所述根据所述指示信息，跳过所述间隔的序号，使用所述旧密钥解密所述承载上的序号为所述间隔的序号之前的数据包，使用所述新密钥解密所述承载上的序号为所述间隔的序号之后的数据包，具体包括：
    如果所述指示信息包括所述第一个使用所述新密钥加密的数据包的序号y，则跳过序号y-1至序号y-n，对序号大于或等于y的数据包使用所述新密钥解密，对序号小于或等于y-n-1的数据包使用所述旧密钥解密；或者，
    如果所述指示信息包括所述最后一个使用旧密钥加密的数据包的序号x，则跳过序号x+1至序号x+n，对序号大于或等于x+n+1的数据包使用所述新密钥解密，对序号小于或等于x的数据包使用所述旧密钥解密；或者，
    如果所述指示信息包括所述间隔的序号的范围[a,b]，则跳过所述范围[a,b]，对序号大于b的数据包使用所述新密钥解密，对序号小于a的数据包使用所述旧密钥解密；
    其中，n是所述间隔的序号所包括的序号个数，n大于或等于1；x，y，a，b是正整数。
  3. 如权利要求1或2所述的方法，其特征在于，所述跳过所述间隔的序号，具体包括：
    将所述第一个应用新密钥加密的数据包作为所述最后一个应用旧密钥加密的数据包的下一个数据包在解密后递交上层。
  4. 如权利要求1-3中任一项所述的方法，其特征在于，还包括：应用新密钥对来自所述第一设备的所述承载的数据包进行解密；
    所述使用所述旧密钥解密序号为所述间隔的序号之前的数据包，使用所述新密钥解密所述间隔的序号之后的数据包，具体包括：
    根据所述指示信息，判断应用所述新密钥解密的数据包是否已经被正确解密，如果被错误解密，则重新利用所述旧密钥对所述被错误解密的数据包进行解密。
  5. 如权利要求1-3中任一项所述的方法，其特征在于，还包括：应用所述旧密钥对来自所述第一设备的所述承载的数据包进行解密；
    所述使用所述旧密钥解密所述承载上的序号为所述间隔的序号之前的数据包，使用所 述新密钥解密所述承载上的序号为所述间隔的序号之后的数据包，具体包括：
    根据所述指示信息，判断应用所述旧密钥解密的数据包是否已经被正确解密，如果被错误解密，则重新利用所述新密钥对所述被错误解密的数据包进行解密。
  6. 如权利要求1-5中任一项所述的方法，其特征在于，所述承载包括密钥发生更新的多个承载；所述接收第一设备发送的指示信息，具体包括：
    接收第一设备发送的一个信令，所述一个信令携带有所述多个承载各自对应的所述指示信息和承载标识；或者，接收第一设备发送的多个信令，所述多个信令分别携带有所述多个承载各自对应的所述指示信息。
  7. 如权利要求1-6中任一项所述的方法，其特征在于，所述接收第一设备发送的指示信息，具体包括：当所述承载对应的服务基站的密钥发生改变时，接收第一设备发送的所述指示信息；或者，当所述承载对应的小区发生切换时，接收第一设备发送的所述指示信息；或者，当所述承载重配置时，接收第一设备发送的所述指示信息。
  8. 一种通信方法，其特征在于，包括：
    将承载上的第一个应用新密钥加密的数据包的序号和最后一个应用旧密钥加密的数据包的序号设置成不连续；
    向第二设备发送指示信息；所述指示信息用于确定所述承载的第一个应用新密钥加密的数据包的序号和最后一个应用旧密钥加密的数据包的序号之间间隔的序号。
  9. 如权利要求8所述的方法，其特征在于，所述承载包括密钥发生更新的多个承载；所述向第二设备发送指示信息，具体包括：向所述第二设备发送一个信令，所述一个信令携带有所述多个承载各自对应的所述指示信息和承载标识；或者，向所述第二设备发送多个信令，所述多个信令分别携带有所述多个承载各自对应的所述指示信息。
  10. 如权利要求8-9中任一项所述的方法，其特征在于，所述向第二设备发送指示信息，具体包括：当所述承载对应的服务基站的密钥发生改变时，向第二设备发送所述指示信息；或者，当所述承载对应的小区发生切换时，向第二设备发送所述指示信息；或者，当所述承载重配置时，向第二设备发送所述指示信息。
  11. 如权利要求1-10中任一项所述的方法，其特征在于，所述指示信息包括以下至少一项：
    第一个应用所述新密钥加密的数据包的序号；或者，所述最后一个应用旧密钥加密的数据包的序号；或者，所述第一个应用新密钥的数据包的序号与所述最后一个应用旧密钥加密的数据包的序号之间的序号信息。
  12. 如权利要求11所述的方法，其特征在于，所述指示信息还包括：所述间隔的序号 所包括的序号个数。
  13. 如权利要求1-12中任一项所述的方法，其特征在于，所述指示信息携带在：RRC信令或者PDCP控制协议数据单元中。
  14. 如权利要求1-13中任一项所述的方法，其特征在于，所述承载包括以下至少一项：数据承载，或者信令承载。
  15. 一种通信装置，其特征在于，包括：
    通信单元，用于接收第一设备发送的指示信息，其中，所述指示信息用于确定承载上的第一个应用新密钥加密的数据包的序号和最后一个应用旧密钥加密的数据包的序号之间间隔的序号，所述承载上的第一个应用所述新密钥加密的数据包的序号和所述最后一个应用所述旧密钥加密的数据包的序号不连续；
    处理单元，用于根据所述指示信息，跳过所述间隔的序号，对所述承载上的序号为所述间隔的序号之前的数据包使用所述旧密钥解密，对所述承载上的序号为所述间隔的序号之后的数据包使用所述新密钥解密。
  16. 如权利要求15所述的通信装置，其特征在于，所述处理单元具体用于：
    如果所述指示息信包括所述第一个使用所述新密钥加密的数据包的序号y，则跳过序号y-1至序号y-n，对序号大于或等于y的数据包使用所述新密钥解密，对序号小于或等于y-n-1的数据包使用所述旧密钥解密；或者，
    如果所述指示信息包括所述最后一个使用旧密钥加密的数据包的序号x，则跳过序号x+1至序号x+n，对序号大于或等于x+n+1的数据包使用所述新密钥解密，对序号小于或等于x的数据包使用所述旧密钥解密；或者，
    如果所述指示信息包括所述间隔的序号的范围[a,b]，则跳过所述范围[a,b]，对序号大于b的数据包使用所述新密钥解密，对序号小于a的数据包使用所述旧密钥解密；
    其中，n是所述间隔的序号所包括的序号个数，n大于或等于1；x，y，a，b是正整数。
  17. 如权利要求15或16所述的通信装置，其特征在于，所述处理单元具体用于：将所述第一个应用新密钥加密的数据包作为所述最后一个应用旧密钥加密的数据包的下一个数据包在解密后递交上层。
  18. 如权利要求15-17中任一项所述的通信装置，其特征在于，所述处理单元还用于应用新密钥对来自所述第一设备的所述承载的数据包进行解密；并根据所述指示信息，判断应用所述新密钥解密的数据包是否已经被正确解密，如果被错误解密，则重新利用所述旧密钥对所述被错误解密的数据包进行解密。
  19. 如权利要求15-17中任一项所述的通信装置，其特征在于，所述处理单元还用于 应用所述旧密钥对来自所述第一设备的所述承载的数据包进行解密；并根据所述指示信息，判断应用所述旧密钥解密的数据包是否已经被正确解密，如果被错误解密，则重新利用所述新密钥对所述被错误解密的数据包进行解密。
  20. 如权利要求15-19中任一项所述的通信装置，其特征在于，所述承载包括密钥发生更新的多个承载；所述通信单元具体用于接收第一设备发送的一个信令，所述一个信令携带有所述多个承载各自对应的所述指示信息和承载标识；或者，接收第一设备发送的多个信令，所述多个信令分别携带有所述多个承载各自对应的所述指示信息。
  21. 如权利要求15-20中任一项所述的通信装置，其特征在于，所述通信单元具体用于：当所述承载对应的服务基站的密钥发生改变时，接收第一设备发送的所述指示信息；或者，当所述承载对应的小区发生切换时，接收第一设备发送的所述指示信息；或者，当所述承载重配置时，接收第一设备发送的所述指示信息。
  22. 一种通信装置，其特征在于，包括：
    处理单元，用于将承载上的第一个应用新密钥加密的数据包的序号和最后一个应用旧密钥加密的数据包的序号设置成不连续；
    通信单元，用于向第二设备发送指示信息；所述指示信息用于确定所述承载的第一个应用新密钥加密的数据包的序号和最后一个应用旧密钥加密的数据包的序号之间间隔的序号。
  23. 如权利要求22的通信装置，其特征在于，所述承载包括密钥发生更新的多个承载；所述通信单元具体用于：向所述第二设备发送一个信令，所述一个信令携带有所述多个承载各自对应的所述指示信息和承载标识；或者，向所述第二设备发送多个信令，所述多个信令分别携带有所述多个承载各自对应的所述指示信息。
  24. 如权利要求22-23中任一项的通信装置，其特征在于，所述通信单元具体用于：当所述承载对应的服务基站的密钥发生改变时，向第二设备发送所述指示信息；或者，当所述承载对应的小区发生切换时，向第二设备发送所述指示信息；或者，当所述承载重配置时，向第二设备发送所述指示信息。
  25. 一种通信装置，其特征在于，包括：收发器、存储器以及耦合与所述存储器的处理器，其中：
    所述收发器用于接收第一设备发送的指示信息，其中，所述指示信息用于确定承载上的第一个应用新密钥加密的数据包的序号和最后一个应用旧密钥加密的数据包的序号之间间隔的序号，所述承载上的第一个应用所述新密钥加密的数据包的序号和所述最后一个应用所述旧密钥加密的数据包的序号不连续；
    所述处理器用于根据所述指示信息，跳过所述间隔的序号，对所述承载上的序号为所 述间隔的序号之前的数据包使用所述旧密钥解密，对所述承载上的序号为所述间隔的序号之后的数据包使用所述新密钥解密。
  26. 一种通信装置，其特征在于，包括：收发器、存储器以及耦合与所述存储器的处理器，其中：
    所述处理器用于将承载上的第一个应用新密钥加密的数据包的序号和最后一个应用旧密钥加密的数据包的序号设置成不连续；
    所述收发器用于向第二设备发送指示信息；所述指示信息用于确定所述承载的第一个应用新密钥加密的数据包的序号和最后一个应用旧密钥加密的数据包的序号之间间隔的序号。
  27. 如权利要求15-26中任一项的通信装置，其特征在于，所述指示信息包括以下至少一项：
    第一个应用所述新密钥加密的数据包的序号；或者，所述最后一个应用旧密钥加密的数据包的序号；或者，所述第一个应用新密钥的数据包的序号与所述最后一个应用旧密钥加密的数据包的序号之间的序号信息。
  28. 如权利要求27的通信装置，其特征在于，所述指示信息还包括：所述间隔的序号所包括的序号个数。
  29. 如权利要求15-28中任一项的通信装置，其特征在于，所述指示信息携带在：RRC信令或者PDCP控制协议数据单元中。
  30. 如权利要求15-29中任一项的通信装置，其特征在于，所述承载包括以下至少一项：数据承载，或者信令承载。
PCT/CN2018/085608 2017-05-05 2018-05-04 通信方法、装置及*** WO2018202131A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP18794037.4A EP3609163B1 (en) 2017-05-05 2018-05-04 Communication method, device and system
US16/673,313 US11399280B2 (en) 2017-05-05 2019-11-04 Communication of numbered sequence packets using old and new cipher keys

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201710323433.4 2017-05-05
CN201710323433.4A CN108810889B (zh) 2017-05-05 2017-05-05 通信方法、装置及***

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US16/673,313 Continuation US11399280B2 (en) 2017-05-05 2019-11-04 Communication of numbered sequence packets using old and new cipher keys

Publications (1)

Publication Number Publication Date
WO2018202131A1 true WO2018202131A1 (zh) 2018-11-08

Family

ID=64015979

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/085608 WO2018202131A1 (zh) 2017-05-05 2018-05-04 通信方法、装置及***

Country Status (4)

Country Link
US (1) US11399280B2 (zh)
EP (1) EP3609163B1 (zh)
CN (1) CN108810889B (zh)
WO (1) WO2018202131A1 (zh)

Families Citing this family (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2018236261A1 (en) * 2017-06-22 2018-12-27 Telefonaktiebolaget Lm Ericsson (Publ) METHOD AND NETWORK NODE FOR ESTABLISHING A WIRELESS CONNECTION
US20210127273A1 (en) * 2019-12-10 2021-04-29 Ido Ouzieli Enhanced beacon protection rekeying and attack detection for wireless communications
CN115694599B (zh) * 2021-07-31 2024-06-18 华为技术有限公司 一种传输方法、***及相关装置
CN116319092B (zh) * 2023-05-18 2023-08-18 北京智芯微电子科技有限公司 数据的加解密方法、装置、***及计算机可读存储介质

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2008148681A1 (en) * 2007-06-08 2008-12-11 Nokia Siemens Networks Oy Methods, devices, system and related computer product for key change
CN102281535A (zh) * 2010-06-10 2011-12-14 华为技术有限公司 一种密钥更新方法与装置
CN106537882A (zh) * 2014-08-07 2017-03-22 Lg 电子株式会社 在双连接***中在用户设备处处理分组数据汇聚协议分组数据单元的方法及其设备
CN107438274A (zh) * 2016-05-27 2017-12-05 中兴通讯股份有限公司 一种指示安全密钥更新的方法及装置

Family Cites Families (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2007062689A1 (en) * 2005-12-01 2007-06-07 Telefonaktiebolaget Lm Ericsson (Publ) Method and apparatus for distributing keying information
DE602009000944D1 (de) * 2008-04-11 2011-05-05 Innovative Sonic Ltd Verfahren und Vorrichtung zur Handhabung des Weiterleitungsverfahrens
JP5301034B2 (ja) * 2010-05-19 2013-09-25 三洋電機株式会社 車載器
US9237475B2 (en) 2012-03-09 2016-01-12 Samsung Electronics Co., Ltd. Channel quality information and beam index reporting
CN106470052B (zh) 2015-08-14 2019-10-25 财团法人工业技术研究院 动态波束形成方法和使用所述方法的基站和用户设备
CN106559780A (zh) * 2015-09-25 2017-04-05 展讯通信（上海）有限公司 移动终端及其lte和wlan汇聚时数据传输控制方法
WO2018137828A1 (en) * 2017-01-27 2018-08-02 Telefonaktiebolaget Lm Ericsson (Publ) Key change procedure

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2008148681A1 (en) * 2007-06-08 2008-12-11 Nokia Siemens Networks Oy Methods, devices, system and related computer product for key change
CN102281535A (zh) * 2010-06-10 2011-12-14 华为技术有限公司 一种密钥更新方法与装置
CN106537882A (zh) * 2014-08-07 2017-03-22 Lg 电子株式会社 在双连接***中在用户设备处处理分组数据汇聚协议分组数据单元的方法及其设备
CN107438274A (zh) * 2016-05-27 2017-12-05 中兴通讯股份有限公司 一种指示安全密钥更新的方法及装置

Also Published As

Publication number Publication date
CN108810889A (zh) 2018-11-13
CN108810889B (zh) 2020-12-04
US20200068407A1 (en) 2020-02-27
EP3609163A4 (en) 2020-04-15
US11399280B2 (en) 2022-07-26
EP3609163A1 (en) 2020-02-12
EP3609163B1 (en) 2021-06-16

Similar Documents

Publication Publication Date Title
US10750414B2 (en) System and method for handovers in a dual connectivity communications system
EP3496448A1 (en) Cell configuration method and device
US8228871B2 (en) Wireless handover optimization
JP7147883B2 (ja) ｇＮＢ－ＣＵ－ＵＰにおける完全性保護のハンドリング
US11399280B2 (en) Communication of numbered sequence packets using old and new cipher keys
US9232454B2 (en) Data offloading method
AU2017424739A1 (en) Switching method, access network device and terminal device
US9357580B2 (en) Method for switching communication connection mode, communication system, base station, transmitter and receiver
WO2019095840A1 (zh) 一种层2处理方法、cu及du
CN110972215B (zh) 一种切换方法及基站
JP2021114800A (ja) 基地局、無線通信システムおよび通信方法
EP3534626B1 (en) Processing method in data replication and related device
EP3614746B1 (en) Data duplication control method and related device
US20230354136A1 (en) Integrated access and backhaul communication method and apparatus
WO2014111049A1 (zh) 小区优化方法及装置
EP4304247A1 (en) Communication method and communication apparatus
WO2012142875A1 (zh) 一种确定设备类型的方法、***和设备
WO2021203318A1 (en) Methods, devices, and computer readable medium for communication
WO2019140634A1 (zh) 参数调整方法及相关设备
WO2018058390A1 (zh) 数据传输方法及装置
JP2016066966A (ja) ユーザ装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18794037

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2018794037

Country of ref document: EP

Effective date: 20191107