WO2019029691A1 - 数据完整性保护方法和装置 - Google Patents
数据完整性保护方法和装置 Download PDFInfo
- Publication number
- WO2019029691A1 WO2019029691A1 PCT/CN2018/099916 CN2018099916W WO2019029691A1 WO 2019029691 A1 WO2019029691 A1 WO 2019029691A1 CN 2018099916 W CN2018099916 W CN 2018099916W WO 2019029691 A1 WO2019029691 A1 WO 2019029691A1
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- integrity protection
- session
- message
- identifier
- indication
- Prior art date
Links
- 238000000034 method Methods 0.000 title claims abstract description 93
- 230000006870 function Effects 0.000 claims description 42
- 238000004891 communication Methods 0.000 claims description 26
- 230000011664 signaling Effects 0.000 claims description 21
- 230000002776 aggregation Effects 0.000 claims description 7
- 238000004220 aggregation Methods 0.000 claims description 7
- 102100022734 Acyl carrier protein, mitochondrial Human genes 0.000 claims 20
- 101000678845 Homo sapiens Acyl carrier protein, mitochondrial Proteins 0.000 claims 20
- 238000013507 mapping Methods 0.000 claims 4
- 238000010586 diagram Methods 0.000 description 22
- 238000004590 computer program Methods 0.000 description 18
- XHSQDZXAVJRBMX-UHFFFAOYSA-N 2-(5,6-dichlorobenzimidazol-1-yl)-5-(hydroxymethyl)oxolane-3,4-diol Chemical compound OC1C(O)C(CO)OC1N1C2=CC(Cl)=C(Cl)C=C2N=C1 XHSQDZXAVJRBMX-UHFFFAOYSA-N 0.000 description 11
- 238000012545 processing Methods 0.000 description 8
- 230000005540 biological transmission Effects 0.000 description 6
- 230000000694 effects Effects 0.000 description 5
- 230000007774 longterm Effects 0.000 description 4
- DJGAAPFSPWAYTJ-UHFFFAOYSA-M metamizole sodium Chemical compound [Na+].O=C1C(N(CS([O-])(=O)=O)C)=C(C)N(C)N1C1=CC=CC=C1 DJGAAPFSPWAYTJ-UHFFFAOYSA-M 0.000 description 4
- 238000010295 mobile communication Methods 0.000 description 4
- 230000008878 coupling Effects 0.000 description 3
- 238000010168 coupling process Methods 0.000 description 3
- 238000005859 coupling reaction Methods 0.000 description 3
- 238000005516 engineering process Methods 0.000 description 3
- 101100240462 Homo sapiens RASAL2 gene Proteins 0.000 description 2
- 102100035410 Ras GTPase-activating protein nGAP Human genes 0.000 description 2
- 238000012795 verification Methods 0.000 description 2
- 238000013475 authorization Methods 0.000 description 1
- 230000001413 cellular effect Effects 0.000 description 1
- 230000006835 compression Effects 0.000 description 1
- 238000007906 compression Methods 0.000 description 1
- 238000011161 development Methods 0.000 description 1
- 230000009977 dual effect Effects 0.000 description 1
- 230000002093 peripheral effect Effects 0.000 description 1
- 230000001568 sexual effect Effects 0.000 description 1
- 238000012546 transfer Methods 0.000 description 1
- 238000011144 upstream manufacturing Methods 0.000 description 1
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/12—Applying verification of the received information
- H04L63/123—Applying verification of the received information received data contents, e.g. message integrity
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
- H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/10—Integrity
- H04W12/102—Route integrity, e.g. using trusted paths
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/10—Integrity
- H04W12/106—Packet or message integrity
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W8/00—Network data management
- H04W8/02—Processing of mobility data, e.g. registration information at HLR [Home Location Register] or VLR [Visitor Location Register]; Transfer of mobility data, e.g. between HLR, VLR or external networks
- H04W8/08—Mobility data transfer
- H04W8/14—Mobility data transfer between corresponding nodes
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
Definitions
- the present application relates to communication technologies, and in particular, to a data integrity protection method and apparatus.
- the integrity protection function Integrity Protection
- the purpose is to prevent user data from being tampered with. Once the receiving end finds that the integrity check fails, it can trigger the update process of the encryption and decryption key (Key) and protect the user data with the new key.
- the integrity protection function includes integrity protection and integrity check.
- the integrity protection function of LTE is located in the Packet Data Convergence Protocol (PDCP) layer.
- the sender encrypts the PDCP protocol data unit (Protocol Data Unit, before encryption).
- the header and data portion of the PDU) are integrity protected.
- the sending end uses the integrity protection algorithm configured by the upper layer protocol layer, and calculates at least one parameter of the key, the COUNT value, the radio bearer identifier, the DIRECTION, the message itself, and the length of the message as an input parameter, and calculates a 32-bit message.
- the Message Authentication Code for Integrity (MAC-I) is placed in the MAC-I field of the PDCP PDU.
- the receiving end After receiving the message, the receiving end calculates the verification code XMAC-I expected by the message in the same way, and performs integrity check by comparing XMAC-I and MAC-I. If the MAC-I is equal to the XMAC-I, the receiving end determines that the integrity check is successful, otherwise it determines that the integrity check failed.
- the granularity of the integrity protection function in the LTE system is at the terminal device level, that is, the terminal device uses the same integrity protection parameters for all data, making the integrity protection inflexible.
- the present invention provides a data integrity protection method and apparatus, which can perform session granularity or flow granularity integrity protection, thereby making integrity protection more flexible and meeting the security requirements of different services of the same user.
- the first aspect of the present application provides a data integrity protection method, including: acquiring, by a terminal device, an integrity protection algorithm and a key corresponding to a session, and a DRB corresponding to the session, using the integrity protection algorithm and a key pair.
- the data of the DRB is integrity protected.
- Different sessions can use different integrity protection algorithms and keys, which makes the integrity protection more flexible and meets the security requirements of different services of the same user.
- the terminal device acquires an integrity protection algorithm and a key corresponding to the session, and a DRB corresponding to the session, where the terminal device sends a first message, where the first message is used to request to establish a
- the session device receives the second message, where the second message includes an identifier of the session, an integrity protection algorithm and a key corresponding to the session, and an identifier of the DRB corresponding to the session.
- the second message includes a configuration of a SDAP layer, where the configuration of the SDAP layer includes an identifier of the session, an integrity protection algorithm and a key corresponding to the session, and an identifier of the DRB corresponding to the session. ;or,
- the second message includes a configuration of a PDCP layer, and the configuration of the PDCP layer includes an identifier of the session, an integrity protection algorithm and a key corresponding to the session, and an identifier of the DRB corresponding to the session.
- the second aspect of the present application provides a data integrity protection method, including: acquiring, by a terminal device, an integrity protection algorithm and a key corresponding to a flow, and a DRB corresponding to the flow, using the integrity protection algorithm and a key pair
- the DRB data is integrity protected.
- Different flows can also use different integrity protection algorithms and keys, which makes the integrity protection more flexible and meets the security requirements of different services of the same user.
- the terminal device acquires an integrity protection algorithm and a key corresponding to the flow, and a radio data bearer DRB corresponding to the flow, where the terminal device sends a first message, where the first message is used.
- the second message includes a configuration of a SDAP layer, where the configuration of the SDAP layer includes an identifier of the session, an identifier of the flow, an identifier of a DRB corresponding to the flow, and a complete correspondence of the flow Sex protection algorithm and key; or,
- the second message includes a configuration of a PDCP layer, and the configuration of the PDCP layer includes an identifier of the session, an identifier of the flow, an identifier of a DRB corresponding to the flow, and an integrity protection algorithm corresponding to the flow. Key.
- the method further includes: the terminal device acquiring at least one of the following information:
- An indication of an integrity protection location an integrity protection protocol layer location indication, an enable indication of an integrity protection location, and an indication of an integrity protection object
- the indication of the integrity protection location is used to indicate a network element that performs integrity protection
- the integrity protection protocol layer location indication is used to indicate a protocol layer for integrity protection
- the enable indication of the integrity protection location indicates a function for indicating whether integrity protection is turned on
- the indication of the integrity protection object is used to indicate that the object of integrity protection is user plane data, or user plane data and control plane signaling.
- the data of the DRB is: a data packet of a SDAP layer of the DRB; or a data packet of a PDCP layer of the DRB.
- the method further includes: the terminal device marking an identifier of the flow in a data packet of a SDAP layer of the DRB.
- a third aspect of the present disclosure provides a data integrity protection method, including: an access network device receiving a first message sent by a terminal device, where the first message is used to request to establish a session; and the access network device is configured to a core network device.
- Sending a third message where the third message includes the first message
- the access network device receives a fourth message sent by the core network device, where the fourth message includes integrity protection corresponding to the session An algorithm and a key and a DRB corresponding to the session
- the access network device saves an integrity protection algorithm and a key corresponding to the session, and a DRB corresponding to the session
- the access network device to the terminal device Sending a second message, where the second message includes an identifier of the session, an integrity protection algorithm and a key corresponding to the session, and an identifier of the DRB corresponding to the session.
- the second message includes a configuration of a SDAP layer, where the configuration of the SDAP layer includes an identifier of the session, an integrity protection algorithm and a key corresponding to the session, and an identifier of the DRB corresponding to the session.
- the second message includes a configuration of a PDCP layer, where the configuration of the PDCP layer includes an identifier of the session, an integrity protection algorithm and a key corresponding to the session, and an identifier of the DRB corresponding to the session.
- a fourth aspect of the present disclosure provides a data integrity protection method, including: an access network device receiving a first message sent by a terminal device, where the first message is used to request to establish a session; and the access network device is configured to a core network device.
- Sending the third message, the third message includes the first message;
- the access network device receives a fourth message sent by the core network device, where the fourth message includes integrity protection corresponding to the flow An algorithm and a key, and a radio data bearer DRB corresponding to the stream, where the session corresponds to the stream;
- the access network device saves an integrity protection algorithm and a key corresponding to the stream, and a DRB corresponding to the stream
- the access network device sends a second message to the terminal device, where the second message includes: an identifier of the session, an identifier of the flow, an identifier of a DRB corresponding to the flow, and a corresponding The integrity protection algorithm and key.
- the second message includes a configuration of a SDAP layer, where the configuration of the SDAP layer includes an identifier of the session, an identifier of the flow, an identifier of a DRB corresponding to the flow, and a complete correspondence of the flow
- the configuration of the PDCP layer includes an identifier of the session, an identifier of the flow, an identifier of the DRB corresponding to the flow, and a The corresponding integrity protection algorithm and key are described.
- the third message or the second message further includes at least one of the following information:
- An indication of an integrity protection location an integrity protection protocol layer location indication, an enable indication of an integrity protection location, and an indication of an integrity protection object
- the indication of the integrity protection location is used to indicate a network element that performs integrity protection
- the integrity protection protocol layer location indication is used to indicate a protocol layer for integrity protection
- the enable indication of the integrity protection location indicates a function for indicating whether integrity protection is turned on
- the indication of the integrity protection object is used to indicate that the object of integrity protection is user plane data, or user plane data and control plane signaling.
- the method further includes: the access network device performing integrity protection on the data of the DRB by using the integrity protection algorithm and a key.
- the data of the DRB is: a data packet of a SDAP layer of the DRB; or a data packet of a PDCP layer of the DRB.
- the method further includes: the access network device marking the identifier of the flow in a data packet of the SDAP layer of the DRB.
- a fifth aspect of the present disclosure provides a data integrity protection method, including: receiving, by a core network device, a third message sent by an access network device, where the third message includes a first message, where the first message is used to request to establish a session.
- the core network device sends a fourth message to the access network device, where the third message includes an integrity protection algorithm and a key corresponding to the session, and a wireless data bearer DRB corresponding to the session, or includes
- the stream corresponds to an integrity protection algorithm and a key and a DRB corresponding to the stream, the session corresponding to the stream.
- the fourth message further includes at least one of the following information:
- An indication of an integrity protection location an integrity protection protocol layer location indication, an enable indication of an integrity protection location, and an indication of an integrity protection object
- the indication of the integrity protection location is used to indicate a network element that performs integrity protection
- the integrity protection protocol layer location indication is used to indicate a protocol layer for integrity protection
- the enable indication of the integrity protection location indicates a function for indicating whether integrity protection is turned on
- the indication of the integrity protection object is used to indicate that the object of integrity protection is user plane data, or user plane data and control plane signaling.
- the method further includes: the core network device performing integrity protection on the data of the DRB by using the integrity protection algorithm and a key.
- the data of the DRB is: a data packet of a SDAP layer of the DRB; or a data packet of a PDCP layer of the DRB.
- the method further includes: the core network device marking the identifier of the flow in a data packet of the SDAP layer of the DRB.
- the sixth aspect of the present application provides a terminal device, including: an obtaining module, configured to acquire an integrity protection algorithm and a key corresponding to a session, and a wireless data bearer DRB corresponding to the session; and an integrity protection module, configured to use the The integrity protection algorithm and key protect the integrity of the data of the DRB.
- the acquiring module is specifically configured to: send a first message, where the first message is used to request to establish the session; receive a second message, where the second message includes an identifier of the session, The integrity protection algorithm and key corresponding to the session, and the identifier of the DRB corresponding to the session.
- the second message includes a configuration of a SDAP layer, where the configuration of the SDAP layer includes an identifier of the session, an integrity protection algorithm and a key corresponding to the session, and an identifier of the DRB corresponding to the session.
- the second message includes a configuration of a PDCP layer, where the configuration of the PDCP layer includes an identifier of the session, an integrity protection algorithm and a key corresponding to the session, and an identifier of the DRB corresponding to the session.
- the seventh aspect of the present application provides a terminal device, including: an obtaining module, configured to acquire an integrity protection algorithm and a key corresponding to a stream, and a wireless data bearer DRB corresponding to the stream; and an integrity protection module, configured to use the The integrity protection algorithm and the key perform integrity protection on the data of the DRB.
- the acquiring module is specifically configured to: send a first message, where the first message is used to request to establish a session, the session is corresponding to the flow, and the second message is received, where the second message includes: The identifier of the session, the identifier of the stream, the identifier of the DRB corresponding to the stream, and an integrity protection algorithm and a key corresponding to the stream.
- the second message includes a configuration of a SDAP layer, where the configuration of the SDAP layer includes an identifier of the session, an identifier of the flow, an identifier of a DRB corresponding to the flow, and a complete correspondence of the flow
- the configuration of the PDCP layer includes an identifier of the session, an identifier of the flow, an identifier of the DRB corresponding to the flow, and a The corresponding integrity protection algorithm and key are described.
- the acquiring module is further configured to: acquire at least one of the following information:
- An indication of an integrity protection location an integrity protection protocol layer location indication, an enable indication of an integrity protection location, and an indication of an integrity protection object
- the indication of the integrity protection location is used to indicate a network element that performs integrity protection
- the integrity protection protocol layer location indication is used to indicate a protocol layer for integrity protection
- the enable indication of the integrity protection location indicates a function for indicating whether integrity protection is turned on
- the indication of the integrity protection object is used to indicate that the object of integrity protection is user plane data, or user plane data and control plane signaling.
- the data of the DRB is: a data packet of a SDAP layer of the DRB; or a data packet of a PDCP layer of the DRB.
- the method further includes: a marking module, configured to mark the identifier of the flow in a data packet of the SDAP layer of the DRB.
- An eighth aspect of the present disclosure provides an access network device, including:
- a receiving module configured to receive a first message sent by the terminal device, where the first message is used to request to establish a session
- a sending module configured to send a third message to the core network device, where the third message includes the first message
- the receiving module is further configured to receive a fourth message sent by the core network device, where the fourth message includes an integrity protection algorithm and a key corresponding to the session, and a wireless data bearer DRB corresponding to the session;
- a storage module configured to save an integrity protection algorithm and a key corresponding to the session, and a DRB corresponding to the session;
- the sending module is further configured to send a second message to the terminal device, where the second message includes an identifier of the session, an integrity protection algorithm and a key corresponding to the session, and a DRB corresponding to the session. logo.
- the second message includes a configuration of a SDAP layer, where the configuration of the SDAP layer includes an identifier of the session, an integrity protection algorithm and a key corresponding to the session, and an identifier of the DRB corresponding to the session.
- the second message includes a configuration of a PDCP layer, where the configuration of the PDCP layer includes an identifier of the session, an integrity protection algorithm and a key corresponding to the session, and an identifier of the DRB corresponding to the session.
- the ninth aspect of the present application provides an access network device, including:
- a receiving module configured to receive a first message sent by the terminal device, where the first message is used to request to establish a session
- a sending module configured to send the third message to a core network device, where the third message includes the first message
- the receiving module is further configured to receive a fourth message sent by the core network device, where the fourth message includes an integrity protection algorithm and a key corresponding to the stream, and a wireless data bearer DRB corresponding to the stream, where The session corresponds to the stream;
- a storage module configured to save an integrity protection algorithm and a key corresponding to the stream, and a DRB corresponding to the stream;
- the sending module is further configured to send a second message to the terminal device, where the second message includes: an identifier of the session, an identifier of the flow, an identifier of a DRB corresponding to the flow, and the flow Corresponding integrity protection algorithm and key.
- the second message includes a configuration of a SDAP layer, where the configuration of the SDAP layer includes an identifier of the session, an identifier of the flow, an identifier of a DRB corresponding to the flow, and a complete correspondence of the flow Sex protection algorithm and key; or,
- the second message includes a configuration of a PDCP layer, and the configuration of the PDCP layer includes an identifier of the session, an identifier of the flow, an identifier of a DRB corresponding to the flow, and an integrity protection algorithm corresponding to the flow. Key.
- the third message or the second message further includes at least one of the following information:
- An indication of an integrity protection location an integrity protection protocol layer location indication, an enable indication of an integrity protection location, and an indication of an integrity protection object
- the indication of the integrity protection location is used to indicate a network element that performs integrity protection
- the integrity protection protocol layer location indication is used to indicate a protocol layer for integrity protection
- the enable indication of the integrity protection location indicates a function for indicating whether integrity protection is turned on
- the indication of the integrity protection object is used to indicate that the object of integrity protection is user plane data, or user plane data and control plane signaling.
- the access network device further includes: an integrity protection module, configured to perform integrity protection on the data of the DRB by using the integrity protection algorithm and a key.
- an integrity protection module configured to perform integrity protection on the data of the DRB by using the integrity protection algorithm and a key.
- the data of the DRB is: a data packet of a SDAP layer of the DRB; or a data packet of a PDCP layer of the DRB.
- the access network device When the data of the DRB is a data packet of the SDAP layer of the DRB, the access network device further includes: a marking module, configured to mark an identifier of the flow in a data packet of a SDAP layer of the DRB.
- a tenth aspect of the present application provides a core network device, including:
- a receiving module configured to receive a third message sent by the access network device, where the third message includes a first message, where the first message is used to request to establish a session;
- a sending module configured to send a fourth message to the access network device, where the third message includes an integrity protection algorithm and a key corresponding to the session, and a wireless data bearer DRB corresponding to the session, or includes a flow Corresponding integrity protection algorithm and key and DRB corresponding to the stream, the session corresponding to the stream.
- the fourth message further includes at least one of the following information:
- An indication of an integrity protection location an integrity protection protocol layer location indication, an enable indication of an integrity protection location, and an indication of an integrity protection object
- the indication of the integrity protection location is used to indicate a network element that performs integrity protection
- the integrity protection protocol layer location indication is used to indicate a protocol layer for integrity protection
- the enable indication of the integrity protection location indicates a function for indicating whether integrity protection is turned on
- the indication of the integrity protection object is used to indicate that the object of integrity protection is user plane data, or user plane data and control plane signaling.
- the core network device further includes: an integrity protection module, configured to perform integrity protection on the data of the DRB by using the integrity protection algorithm and a key.
- an integrity protection module configured to perform integrity protection on the data of the DRB by using the integrity protection algorithm and a key.
- the data of the DRB is: a data packet of a SDAP layer of the DRB; or a data packet of a PDCP layer of the DRB.
- the core network device further includes: a marking module, configured to mark the identifier of the flow in a data packet of the SDAP layer of the DRB.
- An eleventh aspect of the present application provides a terminal device, including: a processor, a memory, a receiver, and a transmitter, where the memory, the receiver, and the transmitter are connected and communicated with the processor through a bus, where the memory is used for
- the storage computer executes instructions for executing the computer to execute instructions to cause the terminal device to perform the methods provided by the first aspect and the second aspect described above.
- the twelfth aspect of the present application provides an access network device, including: a processor, a memory, a receiver, and a transmitter, where the memory, the receiver, and the transmitter are connected and communicated with the processor through a bus, the memory Storing computer execution instructions, the processor for executing the computer execution instructions to cause the access network device to perform the methods provided by the third and fourth aspects above.
- a thirteenth aspect of the present application provides a core network device, including: a processor, a memory, a receiver, and a transmitter, where the memory, the receiver, and the transmitter are connected and communicated with the processor through a bus, where the memory is used.
- the storage computer executes instructions for executing the computer to execute instructions to cause the core network device to perform the method provided by the fifth aspect above.
- a fourteenth aspect of the present application provides a computer readable medium comprising computer executed instructions for causing a terminal device to perform the methods provided by the first and second aspects of the present application.
- a fifteenth aspect of the present application provides a computer readable medium, the computer readable medium comprising computer executed instructions for causing an access network device to perform the methods provided by the third and fourth aspects of the present application .
- a sixteenth aspect of the present application provides a computer readable medium comprising computer executed instructions for causing a core network device to perform the method provided by the fifth aspect of the present application.
- a seventeenth aspect of the present application provides a system on chip, the system being applicable to a terminal device, the system on chip comprising: at least one communication interface, at least one processor, at least one memory, the communication interface, the memory, and The processors are interconnected by a bus that invokes instructions stored in the memory to perform the methods provided by the first and second aspects of the present application.
- the eighteenth aspect of the present application provides an on-chip system, the system being applicable to an access network device, the system on-chip comprising: at least one communication interface, at least one processor, at least one memory, the communication interface, The memory and processor are interconnected by a bus that invokes instructions stored in the memory to perform the methods provided by the third and fourth aspects of the present application.
- a nineteenth aspect of the present application provides a system on a chip, the system being applicable to a core network device, the system on a chip comprising: at least one communication interface, at least one processor, at least one memory, the communication interface, and a memory And the processor is interconnected by a bus, the processor invoking instructions stored in the memory to perform the method provided by the fifth aspect of the present application.
- a twentieth aspect of the present application provides a program product, the program product comprising a computer program, the computer program being stored in a readable storage medium, the at least one processor of the terminal device executing the computer program to cause the terminal device to implement The method provided by the first and second aspects of the application.
- a twenty-first aspect of the present application provides a program product, the program product comprising a computer program, the computer program being stored in a readable storage medium, the at least one processor of the access network device executing the computer program to cause the The access network device implements the methods provided by the third and fourth aspects of the present application.
- a twenty-second aspect of the present application provides a program product, the program product comprising a computer program, the computer program being stored in a readable storage medium, the at least one processor of the core network device executing the computer program to cause the core
- the network device implements the method provided by the fifth aspect of the present application.
- the present application provides a data integrity protection method and apparatus.
- the terminal device obtains the integrity protection algorithm corresponding to the session and the DRB corresponding to the session, and uses the integrity protection algorithm corresponding to the session and the DRB corresponding to the key pair session.
- the data is integrity-protected, or the terminal device acquires the integrity protection algorithm and the key corresponding to the flow and the DRB corresponding to the flow, and uses the integrity protection algorithm corresponding to the flow and the DRB data corresponding to the key pair to perform integrity protection, one
- the session includes multiple flows. Different sessions can use different integrity protection algorithms and keys. Different flows can also use different integrity protection algorithms and keys, which makes the integrity protection more flexible and meets the security of different services of the same user. demand.
- FIG. 1 is a schematic structural diagram of an application scenario of the present application
- 3 is a schematic diagram of a protocol layer of a 5G system
- FIG. 5 is a schematic diagram of MAC-I when integrity protection is performed in the PDCP layer
- FIG. 6 is a schematic structural diagram of a terminal device according to Embodiment 3 of the present application.
- FIG. 7 is a schematic structural diagram of an access network device according to Embodiment 5 of the present application.
- FIG. 8 is a schematic structural diagram of a core network device according to Embodiment 7 of the present application.
- FIG. 9 is a schematic structural diagram of a terminal device according to Embodiment 8 of the present application.
- FIG. 10 is a schematic structural diagram of an access network device according to Embodiment 9 of the present application.
- FIG. 11 is a schematic structural diagram of a core network device according to Embodiment 10 of the present application.
- the present application provides a data integrity protection method, which can be applied to multiple communication systems, which can be a Universal Mobile Telecommunications System (UMTS), a Code Division Multiple Access (CDMA) system. , Wideband Code Division Multiple Access (WCDMA) system, Wireless Local Area Network (WLAN), Long Term Evolution (LTE) system or 5th-generation mobile communication (5th-Generation, 5G) )system.
- UMTS Universal Mobile Telecommunications System
- CDMA Code Division Multiple Access
- WCDMA Wideband Code Division Multiple Access
- WLAN Wireless Local Area Network
- LTE Long Term Evolution
- 5G 5th-generation mobile communication
- FIG. 1 shows a schematic architectural diagram of an application scenario of the present application.
- the 5G system may include: a (Radio) Access Network (R) AN, a Core Network (CN), and a terminal device.
- the RAN is responsible for the access of the terminal device, and the RAN has a plurality of terminal devices in the coverage area, and the interface between the RAN and the CN is an NG interface, and the interface between the RAN network elements is an Xn interface, and the RAN network element and the terminal device are The interface between the two is empty.
- the RAN network element may be a base station of a UMTS system, a Base Transceiver Station (BTS) of a CDMA system, a base station (NodeB, NB) in a WCDMA system, or an evolved NodeB (evolved NodeB in an LTE system).
- BTS Base Transceiver Station
- NodeB, NB base station
- AP access point
- the eNB or the relay station, or the access point (AP) in the WLAN may also be a base station (such as a gNB or a transmission point (TRP)) in the 5G system, and the 5G system is also called a new wireless communication.
- System new access technology (New Radio) or next-generation mobile communication system.
- QoS flow-based service quality of service
- flow is, for example, QoS flow.
- QoS is divided into non-access stratum (NAS) layer QoS and access stratum (AS) layer QoS, where NAS layer QoS is QoS flow level, and QoS flow is protocol data unit (Protocol Data Unit, PDU)
- PDU Protocol Data Unit
- the CN network element includes an Access and Mobility Management Function (AMF) entity and a User Plane Function (UPF) entity.
- AMF Access and Mobility Management Function
- UPF User Plane Function
- the AMF entity is mainly responsible for services such as mobility management and access management, and is equivalent to the functions of the Mobility Management Entity (MME) in addition to the session management function in the LTE system.
- MME Mobility Management Entity
- the UPF is equivalent to a Packet Data Network Gateway (P-GW) in the LTE system. It is mainly responsible for session and bearer management, Internet Protocol (IP) address allocation, etc.
- IP Internet Protocol
- the UPF generates downlink QoS flow, UE. Generate an upstream QoS flow.
- the CN network element may further include a Session Management Function (SMF) entity, an Authentication Server Function (AUSF) entity, an authentication Credential Repository and a Processing Function (Authentication Credential Repository and Processing Function).
- SMF Session Management Function
- AUSF Authentication Server Function
- ARPF ARPF
- PCF Policy Control Function
- AAA Authentication, Authorization and Accounting
- the SMF entity is primarily responsible for establishing a session, modifying a session, or releasing a session.
- the PCF entity is primarily responsible for providing strategies for the network.
- the AAA server is mainly responsible for authenticating the Subscriber Identification Module (SIM) card, authorizing which services the SIM card can use, and recording the network resources used by the SIM card.
- SIM Subscriber Identification Module
- the AAA server can be provided by the operator or by a third party.
- the AUSF is the endpoint of the authentication request message and interacts with the ARPF entity to obtain a long-term security credential of the terminal device.
- the ARPF entity is mainly responsible for storing long-term security credentials of terminal devices.
- the AMF entity and the SMF entity may be replaced by an MME, and the UPF entity may be replaced by a P-GW and a Serving Gateway (S-GW) in the LTE system, the AUSF entity and the ARPF.
- the entity is replaced by a Home Subscriber Server (HSS), which is used to store subscription information, and the subscription information may be subscription information of the SIM card.
- HSS Home Subscriber Server
- the MME is a signaling management network element, and is responsible for encrypting the NAS signaling, assigning a temporary identity to the terminal device, selecting a CN network element such as the SGW and the PGW, and providing functions such as roaming, tracking, and security; and the SGW is a mobile switching between the eNBs. Sex anchor, and provide legal interception related functions; PGW is responsible for IP address allocation, scheme control and billing rules execution, and legal interception related functions.
- the terminal device referred to in the present application may be a wireless terminal, which may be a device that provides voice and/or data connectivity to the user, a handheld device with wireless connectivity, or other processing device that is connected to the wireless modem.
- the wireless terminal can communicate with the at least one core network via the (R)AN.
- the wireless terminal can be a mobile terminal, such as a mobile phone (or "cellular" phone) and a computer with a mobile terminal, for example, a portable, pocket, handheld, computer built-in or vehicle-mounted mobile device,
- the wireless access network exchanges voice and/or data.
- a wireless terminal may also be called a Subscriber Unit, a Subscriber Station, a Mobile Station, a Mobile Station, a Remote Station, an Access Point, and a remote terminal.
- the terminal (Remote Terminal), the access terminal (Access Terminal), the user terminal (User Terminal), the user equipment (User Equipment, UE), or the user agent (User Agent) are not limited herein.
- the data integrity protection method provided by the present application is to solve the problem of inflexibility of the integrity protection existing in the prior art.
- FIG. 2 is a signaling flowchart of a data integrity protection method according to Embodiment 1 of the present application.
- the method in this embodiment may include the following steps:
- Step S101 The terminal device sends a first message to the access network device.
- the first message is used to request to establish a session, which is also referred to as a PDU session.
- the first message may carry a NAS message, where the NAS message carries session establishment request information, where the session establishment request information includes an identifier of the session to be established.
- the session establishment request message may further include a protocol discriminator for indicating the L3 protocol stack corresponding to the first message. If the session establishment request information is carried by the NAS message, the access network carries the NAS message in the third message and sends the message to the core network device.
- the first message may be a Radio Resource Control (RRC) message, a Media Access Control (MAC) message, or a physical layer message.
- RRC Radio Resource Control
- MAC Media Access Control
- the RRC message is, for example, an RRC connection setup request, an RRC connection re-establishment request, or an RRC connection setup completion.
- the MAC message is, for example, a MAC Control Element (CE)
- CE MAC Control Element
- the physical layer message is, for example, physical layer signaling.
- Step S102 The access network device sends a third message to the core network device, where the third message includes the first message.
- the third message is used to request to establish a session. Specifically, after receiving the first message, the access network device carries the NAS message in the first message in the third message and sends the message to the core network device.
- the third message is RAN and CN. Interface message between.
- Step S103 The core network device sends a fourth message to the access network device, where the fourth message includes an integrity protection algorithm and a key corresponding to the session, and a data resource bearer (DRB) corresponding to the session.
- the fourth message includes an integrity protection algorithm and a key corresponding to the session, and a data resource bearer (DRB) corresponding to the session.
- DRB data resource bearer
- the fourth message is used to request the access network device to prepare resources for the established session, and the fourth message may be a UE initial context setup request message, used to establish a context configuration for the UE; or, the fourth message is a PDU session resource setup request message, Used to configure resources for a session.
- the fourth message carries the session information and the integrity protection configuration corresponding to the session.
- the session information includes the session identifier and the DRB corresponding to the session.
- the fourth message carries the NAS message, and the integrity protection configuration corresponding to the session is carried in the NAS message.
- the integrity protection configuration corresponding to the session may not be carried in the NAS message.
- the fourth message further includes configuration parameters including at least one protocol layer, which is used to establish one or more DRBs for the session to carry the services initiated by the terminal device.
- FIG. 3 is a schematic diagram of a protocol layer of a 5G system. As shown in FIG. 3, the protocol layer of the terminal device and the access network device are: Service Data Aggregation Protocol (SDAP) layer in order from top to bottom. PDCP layer, Radio Link Control (RLC), MAC, and physical layer (Physical, PHY). The SDAP layer is used to add a protocol layer on the LTE system. The SDAP layer is used to process the flow to the DRB.
- a terminal device may establish multiple sessions, and each session includes one or more sessions. Streams, each stream can be mapped to one or more DRBs, such as QoS flows.
- the configuration parameters of the at least one protocol layer include parameters of each layer protocol stack, a transmission mode, a logical channel configuration, and scheduling related parameters.
- the transmission mode may be an RLC transparent transmission mode, an acknowledgment mode or a non-acknowledgement mode
- the logical channel configuration is, for example, a logical channel priority.
- LTE or 5G protocol and details are not described herein again.
- the integrity protection configuration corresponding to the session carried in the fourth message includes the integrity protection algorithm and the key corresponding to the session.
- the fourth message may not carry the integrity protection algorithm corresponding to the session.
- the key, the integrity protection algorithm and the key corresponding to the session are carried by other messages, or the integrity protection algorithm and key corresponding to the session are pre-configured.
- the fourth message may further include at least one of the following: an indication of the integrity protection location, an integrity protection protocol layer location indication, an enable indication of the integrity protection location, and an indication of the integrity protection object.
- one or more of the indication of the integrity protection location, the integrity protection protocol layer location indication, the integrity protection location enable indication, and the integrity protection object indication may also be pre-configured without passing the Four message dynamic indications.
- the indication of the integrity protection location is used to indicate the network element for integrity protection.
- the integrity protection may be located on the RAN side, or on the CN side, or on the RAN and the CN side. Therefore, the integrity protected network element may be an access network device, a core network device, or both at the access network device and the core.
- the network device performs integrity protection.
- the integrity protection location is on the RAN side
- the integrity protection function is performed by the protocol stack on the RAN side, and the corresponding terminal equipment side is performed at the access layer.
- the integrity protection location is on the CN side
- the integrity protection function needs to be performed on the protocol stack on the CN side, and the corresponding terminal equipment side is performed on the non-access layer.
- the integrity protection location is located on the RAN side and the CN side, the integrity protection function needs to be performed on the RAN side and the CN side, and the integrity protection of the user's control plane or data plane needs to be performed twice.
- the integrity protection protocol layer location indication is used to indicate the protocol layer for integrity protection, and the protocol layer of integrity protection may be the SDAP layer, the PDCP layer or the RRC layer.
- the enable indication of the integrity protection location indicates the function to indicate whether integrity protection is turned on.
- the enable indication of the integrity protection location is associated with an indication of the integrity protection location, eg, if the integrity protection location indicated by the indication of the integrity protection location is on the RAN side, the enable indication of the integrity protection location is used to indicate the RAN The side function is turned on or off. If the integrity protection position indicated by the indication of the integrity protection position is on the RAN and the CN side, the enable indication of the integrity protection position is used to indicate that the RAN side and the CN side are respectively turned on or off. .
- the indication of the integrity protection object is used to indicate that the object of integrity protection is User plane (UP) data, or user plane data and Control Plane (CP) signaling.
- UP User plane
- CP Control Plane
- Different sessions may use the same or different integrity protection algorithms and keys, and the integrity protection algorithm and key correspond to the integrity protection location.
- the core network device only indicates an integrity protection location (RAN side or CN side). ), the corresponding integrity protection algorithm and key are only configured in the integrity protection location. If the core network device indicates two integrity protection locations (RAN side and CN side), two integrity protection positions are needed. The integrity protection algorithm and the key are configured separately. The protection algorithm and key corresponding to the two integrity protection locations may be the same or different.
- the key used in different sessions can be calculated by using a root key.
- the keys obtained in different sessions can be different or the same.
- the root key can be the access network device in the SMC. The root key obtained during the process.
- the key used by different sessions can be calculated by using different root keys, for example, indicating the root key used by the session in the fourth message, or transmitting relevant parameters, so that the access network device is based on The root key calculates the key used by the session.
- the integrity protection configuration corresponding to the session may be placed in the PDU Session Resource Setup List in the fourth message, and used to indicate the integrity protection configuration corresponding to the session, or may be separately placed.
- the session identifier corresponding to the integrity protection configuration is added, and the access network device learns the integrity protection configuration corresponding to the session through the fourth message, and then learns the integrity protection configuration of the DRB corresponding to the session.
- Table 1 is a schematic diagram of a structure of a fourth message.
- Table 2 is a schematic diagram of a PDU session information list
- Table 3 is a schematic diagram of a PDU Session Setup Request Transfer.
- Message as shown in Table IV for example, a third generation partnership (3 rd Generation Partnership Project, 3GPP ) next (Next Generation, NG) RAN NG application protocol (NG Application Protocol, NGAP), 0.1.0 protocol version number , 9.2.1.1 chapter PDU session resource establishment request message.
- 3GPP Third Generation Partnership Project
- Next Generation, NG Next Generation
- NGAP Next Generation
- the PDU session information list in Table 2 is, for example, 3GPP NG RAN NGAP, protocol version number is 0.1.0, 9.3.1.5 chapter PDU session resource establishment list message.
- Tables 2 and 3 show the two possible locations of the session-matched integrity protection configuration in the fourth message, respectively.
- the integrity protection configuration corresponding to the session in the second embodiment is carried in the PDU session resource establishment list, and the PDU session resource establishment list includes one or more information elements (IE) of the session resource establishment, wherein each information element protects at least the following A type of information: a session identifier and a single network slice selection assistance information, and the network slice selection assistance information is used to indicate a network slice identifier corresponding to the session.
- IE information elements
- the integrity protection configuration corresponding to the session in Table 3 is carried in the PDU session establishment request transmission, and the PDU session establishment request transmission includes at least one of the following information: maximum aggregate bit rate, transport layer information, session type, corresponding to one or more sessions,
- the QoS flow resource information list and the like, the QoS flow resource information list includes identifiers corresponding to one or more flows, QoS parameters of QoS flow levels, and the like.
- Step S104 The access network device sends a second message to the terminal device, where the second message includes an identifier of the session, an integrity protection algorithm and a key corresponding to the session, and an identifier of the DRB corresponding to the session.
- the access network device After receiving the fourth message, the access network device saves the integrity protection algorithm and the key integrity protection configuration corresponding to the session carried in the fourth message. And establishing a DRB for the terminal device according to the configuration parameter of the at least one protocol layer carried in the fourth message, to carry the service initiated by the terminal device. Then, a second message is generated, and the second message is sent to the terminal device, and the second message may be a NAS message, an RRC message, a MAC layer message, or a physical layer message.
- the second message is an RRC message
- the RRC message does not include the NAS message
- the identifier of the session, the integrity protection algorithm and the key corresponding to the session, and the identifier of the DRB corresponding to the session are all carried in the RRC message
- RRC The message includes the NAS message, and all or part of the above parameters are carried in the NAS message included in the RRC message.
- the second message includes an integrity protection algorithm and a key corresponding to the session.
- the second message may not carry the integrity protection algorithm and the key corresponding to the session, and the integrity protection corresponding to the session.
- the algorithm and the key are carried by other messages, or the integrity protection algorithm and key corresponding to the session are pre-configured.
- the second message includes at least one of the following: an integrity protection algorithm and a key, an indication of an integrity protection location, an integrity protection protocol layer location indication, an enable indication of an integrity protection location, and An indication of the integrity protection object.
- one or more of the indication of the integrity protection location, the integrity protection protocol layer location indication, the integrity protection location enable indication, and the integrity protection object indication may also be pre-configured without passing the Two message dynamic indication.
- the integrity protection configuration carried in the second message and the fourth message may be the same or different.
- the fourth message indicates the root key used by the session, and after receiving the fourth message, the access network device calculates the key used by the session according to the indicated root key, and then carries the key used by the session. In the second message.
- the integrity protection configuration of the session may be carried in the configuration parameter of the SDAP layer of the second message, that is, the integrity protection configuration is configured as a configuration parameter of the SDAP layer, and may also be carried in the configuration parameter of the PDCP layer, that is, complete
- the sexual protection configuration is used as a configuration parameter of the PDCP layer.
- the second message includes the configuration parameters of the at least one protocol layer, and the configuration parameters of the SDAP layer and the configuration parameters of the PDCP layer may be carried in the second message, or one of the configuration parameters may be carried in the second message, and A configuration parameter is carried in other messages than the second message.
- RRC connection reconfiguration message which is an RRC connection reconfiguration message
- RRC connection reconfiguration message for example, the following is the following: 3GPP Evolved Universal Terrestrial Radio Access (E-UTRA) RRC protocol, protocol version number 13.0.0, section 6.2.2 RRC connection reconfiguration message:
- E-UTRA Evolved Universal Terrestrial Radio Access
- the possible location 1 of the integrity protection configuration of the session is the configuration parameter of the SDAP layer
- the possible location 2 of the integrity protection configuration corresponding to the session is the configuration parameter of the PDCP layer.
- the access network device sends a fifth message to the core network device, where the fifth message is used to feed back the processing result of the fourth message sent by the core network device, if the access network device fails to successfully connect to the terminal.
- the context of the device is configured, and the fifth message is used to feedback the configuration failure, and includes a failure cause indication, that is, a cause value.
- the fifth message is also used to carry the air interface resources allocated by the access network device for one or more sessions, for example, including a session information list established by the access network device, a list of QoS flows that cannot be established, and the like.
- Step S105 The terminal device saves the content in the second message.
- the terminal device maintains the integrity protection configuration corresponding to the session carried in the second message, and then performs integrity protection on the data of the DRB corresponding to the session according to the integrity protection configuration corresponding to the saved session.
- the DRB corresponding to the session may be one or Multiple, if the DRB corresponding to the session is multiple, the multiple DRBs corresponding to the session use the same integrity protection configuration.
- the terminal device uses the integrity protection algorithm corresponding to the session and the key to perform integrity protection on the data of the DRB corresponding to the session.
- the data of the DRB is: the data packet of the SDAP layer of the DRB or the data packet of the PDCP layer, that is, the terminal device can perform integrity protection on the data of the DRB at the SDAP layer and the PDCP layer.
- the data packet of the SDAP layer includes a PDU and a Service Data Unit (SDU) service data unit
- the data packet of the PDCP layer also includes a PDU and an SDU.
- SDU Service Data Unit
- the terminal device uses an integrity protection algorithm, such as a key, a COUNT value, a radio bearer identifier, a DIRECTION, a PDCP layer packet itself, and a PDCP layer packet. At least one parameter of the length or the like is used as an input parameter, and a 32-bit MAC-I is calculated and placed in the MAC-I field of the PDCP PDU.
- the receiving end access network device or core network device
- the terminal device may also act as a receiving end.
- the terminal device obtains the integrity algorithm and the key corresponding to the session from the access network device by using the second message, and the terminal device may obtain the integrity algorithm and the key corresponding to the session by using other methods.
- the integrity algorithm and the key corresponding to the session are pre-configured on the terminal device, and the second message only needs to carry the session identifier, and the terminal device searches for the integrity algorithm and the key corresponding to the session according to the session identifier.
- one or more of other integrity protection configurations for the session such as an indication of an integrity protection location, an integrity protection protocol layer location indication, an enable indication of an integrity protection location, and an indication of an integrity protection object.
- the terminal device may be notified by a second message dynamic indication or by a pre-configured manner.
- the terminal device acquires the integrity protection algorithm and the key corresponding to the session and the DRB corresponding to the session, and uses the integrity protection algorithm and the key corresponding to the session to protect the integrity of the data of the DRB, so that different sessions can be used differently.
- the integrity protection algorithm and key make the integrity protection more flexible and meet the security needs of different users of the same service.
- FIG. 4 is a signaling flowchart of a data integrity protection method according to Embodiment 2 of the present application. Different from the first embodiment, the granularity of integrity protection in this embodiment is a flow level. As shown in FIG. 4, this embodiment is shown in FIG. The method mainly includes the following steps:
- Step S201 The terminal device sends a first message to the access network device.
- Step S202 The access network device sends a third message to the core network device, where the third message includes the first message.
- step S201 and step S202 refer to the related description of the first embodiment.
- Step S203 The core network device sends a fourth message to the access network device, where the fourth message includes an integrity protection algorithm corresponding to the flow and a key and a DRB corresponding to the flow.
- the fourth message includes a stream corresponding integrity protection algorithm and a key and a DRB corresponding to the stream, where the stream corresponds to the session established by the first message request, and one session includes multiple A stream, each of which can be mapped to multiple DRBs.
- multiple streams included in the session may use the same or different integrity protection algorithms and keys.
- the fourth message may not carry the integrity protection algorithm and the key corresponding to the flow, and the integrity protection algorithm and the key corresponding to the flow are carried by other messages, or the integrity protection algorithm and the key corresponding to the flow.
- the fourth message may further include at least one of the following information: an indication of the integrity protection location, an integrity protection protocol layer location indication, an enable indication of the integrity protection location, and an indication of the integrity protection object.
- the indication of the integrity protection location, the integrity protection protocol layer location indication, the integrity protection location enable indication, and the integrity protection object indication may also be pre-configured without passing the Four message dynamic indications.
- the flow integrity protection configuration may be placed in the QoS flow resource information list in the fourth message, and used to indicate the integrity protection configuration corresponding to the flow, or may be separately placed in the fourth message and added.
- the flow identifier corresponding to the integrity protection configuration is, for example, placed in the PDU session resource information list, and the access network device learns the integrity protection configuration of the flow through the fourth message.
- the PDU session information list refers to Table 2 above.
- Table 4 is a schematic diagram of the QoS flow resource information list.
- the integrity protection configuration corresponding to the flow is carried in the QoS flow resource information list, and the QoS flow resource information list further includes identifiers corresponding to one or more flows, QoS parameters of the QoS flow level, and the like.
- Step S204 The access network device sends a second message to the terminal device, where the second message includes an identifier of the session, an identifier of the flow, an integrity protection algorithm and a key corresponding to the flow, and an identifier of the DRB corresponding to the flow.
- the access network device After receiving the fourth message, the access network device saves the identifier of the session carried in the fourth message, the identifier of the flow, the integrity protection algorithm and the key corresponding to the flow, and the identifier of the DRB corresponding to the flow. And establishing a DRB for the terminal device according to the configuration parameter of the at least one protocol layer carried in the fourth message, to carry the service initiated by the terminal device, and determining the DRB corresponding to each flow. Then, a second message is generated, and the second message is sent to the terminal device, and the second message may be a NAS message, an RRC message, a MAC layer message, or a physical layer message.
- the second message is an RRC message
- the RRC message does not include the NAS message
- the identifier of the session, the identifier of the flow, the integrity protection algorithm and the key corresponding to the flow, and the identifier of the DRB corresponding to the flow are all carried in the RRC message.
- the RRC message includes the NAS message, all or part of the above parameters are carried in the NAS message included in the RRC message.
- the second message includes an integrity protection algorithm and a key corresponding to the flow.
- the second message may not carry the integrity protection algorithm and the key corresponding to the flow, and the integrity protection corresponding to the flow
- the algorithm and key are carried by other messages, or the integrity protection algorithm and key corresponding to the stream are pre-configured.
- the second message includes at least one of the following: an integrity protection algorithm and a key, an indication of an integrity protection location, an integrity protection protocol layer location indication, an enable indication of an integrity protection location, and An indication of the integrity protection object.
- one or more of the indication of the integrity protection location, the integrity protection protocol layer location indication, the integrity protection location enable indication, and the integrity protection object indication may also be pre-configured without passing the Two message dynamic indication.
- the integrity protection configurations corresponding to the flows carried in the second message and the fourth message may be the same or different.
- the root key used by the flow is indicated, and after receiving the fourth message, the access network device calculates the key used by the flow according to the indicated root key, and then carries the key used by the flow. In the second message.
- the integrity protection configuration corresponding to the flow may be carried in the configuration parameter of the SDAP layer of the second message, that is, the integrity protection configuration corresponding to the flow is used as the configuration parameter of the SDAP layer, and may also be carried in the configuration parameter of the PDCP layer.
- the integrity protection configuration corresponding to the flow is used as the configuration parameter of the PDCP layer.
- the second message includes the configuration parameters of the at least one protocol layer, and the configuration parameters of the SDAP layer and the configuration parameters of the PDCP layer may be carried in the second message, or one of the configuration parameters may be carried in the second message, and A configuration parameter is carried in other messages than the second message.
- the access network device sends a fifth message to the core network device, where the fifth message is used to feed back the processing result of the fourth message sent by the core network device, if the access network device fails to successfully connect to the terminal.
- the context of the device is configured, and the fifth message is used to feedback the configuration failure, and includes a failure cause indication, that is, a cause value.
- the fifth message is also used to carry the air interface resources allocated by the access network device for one or more sessions, for example, including a session information list established by the access network device, a list of QoS flows that cannot be established, and the like.
- Step S205 The terminal device saves the content in the second message.
- the terminal device saves the integrity protection configuration corresponding to the flow carried in the second message, and then performs integrity protection on the data corresponding to the DRB according to the integrity protection configuration corresponding to the saved flow, and the DRB corresponding to the flow may be one or more
- the integrity protection algorithm and key corresponding to different streams may be different.
- the terminal device uses the integrity protection algorithm corresponding to the flow and the data of the DRB corresponding to the key pair to perform integrity protection.
- the data of the DRB is: the data packet of the SDAP layer of the DRB or the data packet of the PDCP layer, that is, the terminal device can perform integrity protection on the data of the DRB at the SDAP layer and the PDCP layer.
- the data packets of the SDAP layer include PDUs and SDUs
- the data packets of the PDCP layer also include PDUs and SDUs.
- the SDAP layer needs to mark the flow identifier in the data packet of the SDAP layer, so that the PDCP layer can identify the flow according to the flow. Identify different flows, and then perform integrity protection according to the integrity protection algorithm corresponding to the flow and the data packet corresponding to the key pair.
- the identifier of the stream may be placed in the header of the data packet of the SDAP layer, or may be placed in the specific data content of the data packet of the SDAP layer. The invention does not limit the specific format.
- the terminal device obtains the integrity algorithm and the key corresponding to the flow from the access network device by using the second message, and the terminal device may obtain the integrity algorithm and the key corresponding to the flow by using other methods.
- the integrity algorithm and the key corresponding to the flow are pre-configured on the terminal device, and the second message only needs to carry the session identifier and the flow identifier, and the terminal device searches for the integrity algorithm corresponding to the flow according to the session identifier and the flow identifier. Key.
- one or more of the other integrity protection configurations for the flow such as an indication of the integrity protection location, an integrity protection protocol layer location indication, an enable indication of the integrity protection location, and an indication of the integrity protection object.
- the terminal device may be notified by a second message dynamic indication or by a pre-configured manner.
- the terminal device acquires the integrity protection algorithm corresponding to the flow and the DRB corresponding to the stream, and uses the integrity protection algorithm corresponding to the flow and the DRB data corresponding to the key to perform integrity protection, so that different flows can be Different integrity protection algorithms and keys are used to make integrity protection more flexible and meet the security needs of different users of different services.
- the data integrity protection of the transmitting end may be the same as the receiving end after any part of the sequence number, header compression, encryption, and the like.
- the location and size of the MAC-I can also be flexibly set.
- Figure 5 is a schematic diagram of the MAC-I when the PDCP layer performs integrity protection. As shown in Figure 5, the MAC-I can carry the last few words of the message. Section.
- the receiving end performs integrity check. If a message integrity check fails, any one of the following processes may be performed: (1) notifying the RRC, reestablishing the RRC connection; and (2) discarding The message; (3) discarding the message and reestablishing the RRC connection; (4) reestablishing the RRC connection when the number of integrity check failures reaches a preset value.
- the method of the foregoing embodiment may be applied to a dual connection (DC) scenario or a cell handover scenario.
- a cell handover scenario if the terminal device switches from the source base station to the target base station, the terminal device needs to complete the integrity protection corresponding to the session.
- the integrity protection configuration corresponding to the configuration or the flow is sent to the target base station, so that the target base station performs integrity protection according to the integrity protection configuration corresponding to the session or the integrity protection configuration corresponding to the flow.
- integrity protection can be performed on only one of the sites, or integrity protection can be performed on both sites.
- the master node (MN) needs to send the integrity protection configuration corresponding to the session or flow to the A secondary node (SN), so that the secondary site can perform integrity protection according to the integrity protection configuration corresponding to the session or the integrity protection configuration corresponding to the flow.
- Figure 6 is a schematic structural diagram of a terminal device according to Embodiment 3 of the present application. As shown in Figure 6, the terminal device provided in this embodiment includes:
- the obtaining module 11 is configured to acquire an integrity protection algorithm and a key corresponding to the session, and a wireless data bearer DRB corresponding to the session;
- the integrity protection module 12 is configured to perform integrity protection on the data of the DRB by using the integrity protection algorithm and a key.
- the obtaining module 11 is specifically configured to: send a first message, where the first message is used to request to establish the session, and receive a second message, where the second message includes an identifier of the session, where The integrity protection algorithm and key corresponding to the session, and the identifier of the DRB corresponding to the session.
- the second message includes a configuration of a SDAP layer, where the configuration of the SDAP layer includes an identifier of the session, an integrity protection algorithm and a key corresponding to the session, and an identifier of the DRB corresponding to the session.
- the second message includes a configuration of a PDCP layer, where the configuration of the PDCP layer includes an identifier of the session, an integrity protection algorithm and a key corresponding to the session, and an identifier of the DRB corresponding to the session.
- the obtaining module 11 is further configured to: acquire at least one of the following information:
- An indication of an integrity protection location an integrity protection protocol layer location indication, an enable indication of an integrity protection location, and an indication of an integrity protection object
- the indication of the integrity protection location is used to indicate a network element that performs integrity protection
- the integrity protection protocol layer location indication is used to indicate a protocol layer for integrity protection
- the enable indication of the integrity protection location indicates a function for indicating whether integrity protection is turned on
- the indication of the integrity protection object is used to indicate that the object of integrity protection is user plane data, or user plane data and control plane signaling.
- the data of the DRB is: a data packet of a SDAP layer of the DRB; or a data packet of a PDCP layer of the DRB.
- the terminal device further includes: a marking module, configured to mark the identifier of the stream in a data packet of the SDAP layer of the DRB.
- the terminal device provided in this embodiment may be used to perform the steps performed by the terminal device in the first embodiment.
- the specific implementation manners and technical effects are similar, and details are not described herein again.
- a fourth embodiment of the present application provides a terminal device, and the structure of the terminal device is shown in FIG. 6.
- the obtaining module 11 is configured to acquire an integrity protection algorithm and a key corresponding to the stream, and a radio data bearer DRB corresponding to the stream
- the integrity protection module 12 is configured to use the integrity protection algorithm and The key performs integrity protection on the data of the DRB.
- the obtaining module 11 is specifically configured to: send a first message, where the first message is used to request to establish a session, the session corresponds to the flow, and the second message is received, where the second message includes The identifier of the session, the identifier of the stream, the identifier of the DRB corresponding to the stream, and an integrity protection algorithm and a key corresponding to the stream.
- the second message includes a configuration of a SDAP layer, where the configuration of the SDAP layer includes an identifier of the session, an identifier of the flow, an identifier of a DRB corresponding to the flow, and a complete correspondence of the flow
- the configuration of the PDCP layer includes an identifier of the session, an identifier of the flow, an identifier of the DRB corresponding to the flow, and a The corresponding integrity protection algorithm and key are described.
- the obtaining module 11 is further configured to: acquire at least one of the following information:
- An indication of an integrity protection location an integrity protection protocol layer location indication, an enable indication of an integrity protection location, and an indication of an integrity protection object
- the indication of the integrity protection location is used to indicate a network element that performs integrity protection
- the integrity protection protocol layer location indication is used to indicate a protocol layer for integrity protection
- the enable indication of the integrity protection location indicates a function for indicating whether integrity protection is turned on
- the indication of the integrity protection object is used to indicate that the object of integrity protection is user plane data, or user plane data and control plane signaling.
- the data of the DRB is: a data packet of a SDAP layer of the DRB; or a data packet of a PDCP layer of the DRB.
- the terminal device further includes: a marking module, configured to mark the identifier of the stream in a data packet of the SDAP layer of the DRB.
- the terminal device provided in this embodiment may be used to perform the steps performed by the terminal device in the second embodiment, and the specific implementation manners and technical effects are similar, and details are not described herein again.
- FIG. 7 is a schematic structural diagram of an access network device according to Embodiment 5 of the present application. As shown in FIG. 7, the access network device provided in this embodiment includes:
- the receiving module 21 is configured to receive a first message sent by the terminal device, where the first message is used to request to establish a session;
- the sending module 22 is configured to send a third message to the core network device, where the third message includes the first message;
- the receiving module 21 is further configured to receive a fourth message sent by the core network device, where the fourth message includes an integrity protection algorithm and a key corresponding to the session, and a wireless data bearer DRB corresponding to the session. ;
- a storage module 23 configured to save an integrity protection algorithm and a key corresponding to the session, and a DRB corresponding to the session;
- the sending module 23 is further configured to send a second message to the terminal device, where the second message includes an identifier of the session, an integrity protection algorithm and a key corresponding to the session, and a corresponding session The ID of the DRB.
- the second message includes a configuration of a SDAP layer, where the configuration of the SDAP layer includes an identifier of the session, an integrity protection algorithm and a key corresponding to the session, and an identifier of the DRB corresponding to the session.
- the second message includes a configuration of a PDCP layer, where the configuration of the PDCP layer includes an identifier of the session, an integrity protection algorithm and a key corresponding to the session, and an identifier of the DRB corresponding to the session.
- the third message or the second message further includes at least one of the following information:
- An indication of an integrity protection location an integrity protection protocol layer location indication, an enable indication of an integrity protection location, and an indication of an integrity protection object
- the indication of the integrity protection location is used to indicate a network element that performs integrity protection
- the integrity protection protocol layer location indication is used to indicate a protocol layer for integrity protection
- the enable indication of the integrity protection location indicates a function for indicating whether integrity protection is turned on
- the indication of the integrity protection object is used to indicate that the object of integrity protection is user plane data, or user plane data and control plane signaling.
- the access network device further includes: an integrity protection module 24, configured to perform integrity protection on the data of the DRB by using the integrity protection algorithm and a key.
- an integrity protection module 24 configured to perform integrity protection on the data of the DRB by using the integrity protection algorithm and a key.
- the data of the DRB is: a data packet of a SDAP layer of the DRB; or a data packet of a PDCP layer of the DRB.
- the access network device When the data of the DRB is a data packet of the SDAP layer of the DRB, the access network device further includes: a marking module, configured to mark an identifier of the flow in a data packet of a SDAP layer of the DRB.
- Embodiment 6 of the present application provides an access network device, and the structure of the access network device is shown in FIG. 7.
- FIG. 7 In this embodiment:
- the receiving module 21 is configured to receive a first message sent by the terminal device, where the first message is used to request to establish a session;
- the sending module 22 is configured to send the third message to the core network device, where the third message includes the first message;
- the receiving module 21 is further configured to receive a fourth message sent by the core network device, where the fourth message includes an integrity protection algorithm and a key corresponding to the stream, and a wireless data bearer DRB corresponding to the stream.
- the session corresponds to the stream;
- a storage module 23 configured to save an integrity protection algorithm and a key corresponding to the stream, and a DRB corresponding to the stream;
- the sending module 22 is further configured to send a second message to the terminal device, where the second message includes: an identifier of the session, an identifier of the stream, an identifier of a DRB corresponding to the stream, and the The integrity protection algorithm and key corresponding to the flow.
- the second message includes a configuration of a SDAP layer, where the configuration of the SDAP layer includes an identifier of the session, an identifier of the flow, an identifier of a DRB corresponding to the flow, and a complete correspondence of the flow
- the configuration of the PDCP layer includes an identifier of the session, an identifier of the flow, an identifier of the DRB corresponding to the flow, and a The corresponding integrity protection algorithm and key are described.
- the third message or the second message further includes at least one of the following information:
- An indication of an integrity protection location an integrity protection protocol layer location indication, an enable indication of an integrity protection location, and an indication of an integrity protection object
- the indication of the integrity protection location is used to indicate a network element that performs integrity protection
- the integrity protection protocol layer location indication is used to indicate a protocol layer for integrity protection
- the enable indication of the integrity protection location indicates a function for indicating whether integrity protection is turned on
- the indication of the integrity protection object is used to indicate that the object of integrity protection is user plane data, or user plane data and control plane signaling.
- the integrity protection module 24 is configured to perform integrity protection on the data of the DRB by using the integrity protection algorithm and a key.
- the data of the DRB is: a data packet of a SDAP layer of the DRB; or a data packet of a PDCP layer of the DRB.
- the access network device When the data of the DRB is a data packet of the SDAP layer of the DRB, the access network device further includes: a marking module, configured to mark an identifier of the flow in a data packet of a SDAP layer of the DRB.
- FIG. 8 is a schematic structural diagram of a core network device according to Embodiment 7 of the present application. As shown in FIG. 8 , the core network device provided in this embodiment includes:
- the receiving module 31 is configured to receive a third message sent by the access network device, where the third message includes a first message, where the first message is used to request to establish a session;
- the sending module 32 is configured to send a fourth message to the access network device, where the third message includes an integrity protection algorithm and a key corresponding to the session, and a wireless data bearer DRB corresponding to the session, or includes The stream corresponds to an integrity protection algorithm and a key and a DRB corresponding to the stream, the session corresponding to the stream.
- the fourth message further includes at least one of the following information:
- An indication of an integrity protection location an integrity protection protocol layer location indication, an enable indication of an integrity protection location, and an indication of an integrity protection object
- the indication of the integrity protection location is used to indicate a network element that performs integrity protection
- the integrity protection protocol layer location indication is used to indicate a protocol layer for integrity protection
- the enable indication of the integrity protection location indicates a function for indicating whether integrity protection is turned on
- the indication of the integrity protection object is used to indicate that the object of integrity protection is user plane data, or user plane data and control plane signaling.
- the core network device further includes: an integrity protection module 33, configured to perform integrity protection on the data of the DRB by using the integrity protection algorithm and a key.
- an integrity protection module 33 configured to perform integrity protection on the data of the DRB by using the integrity protection algorithm and a key.
- the data of the DRB is: a data packet of a SDAP layer of the DRB; or a data packet of a PDCP layer of the DRB.
- the core network device When the data of the DRB is a data packet of the SDAP layer of the DRB, the core network device further includes: a marking module, configured to mark an identifier of the flow in a data packet of a SDAP layer of the DRB.
- the receiving module and the sending module may be implemented by one transceiver, or the receiving module is implemented by an independent receiver, and the sending module is implemented by an independent receiver.
- the acquisition module, the integrity protection module, and the marking module in the above embodiments may be implemented by a processor having a data processing function.
- FIG. 9 is a schematic structural diagram of a terminal device according to Embodiment 8 of the present application.
- the terminal device 400 of this embodiment includes: a processor 41, a memory 42, a receiver 43, and a transmitter 44, and the memory 42
- the receiver 43 and the transmitter 44 are connected and communicated to the processor 41 via a bus
- the memory 42 is for storing computer execution instructions
- the processor 41 is configured to execute the computer to execute instructions to cause the terminal
- the device 400 performs the steps performed by the terminal device in the methods provided in the first embodiment and the second embodiment. The specific implementation and technical effects are similar, and are not described here.
- the access network device 500 of the present embodiment includes: a processor 51, a memory 52, a receiver 53, and a transmitter 54,
- the memory 52, the receiver 53 and the transmitter 54 are connected and communicated with the processor 51 via a bus
- the memory 52 is for storing computer execution instructions
- the processor 51 is configured to execute the computer to execute instructions to
- the access network device 500 is configured to perform the steps performed by the access network device in the methods provided in the foregoing Embodiment 1 and Embodiment 2.
- the specific implementation and technical effects are similar, and are not described here.
- the core network device 600 of this embodiment includes: a processor 61, a memory 62, a receiver 63, and a transmitter 64.
- the memory 62, the receiver 63 and the transmitter 64 are connected and communicated to the processor 61 via a bus, the memory 62 is for storing computer execution instructions, and the processor 61 is configured to execute the computer to execute instructions to
- the core network device 600 performs the steps performed by the core network device in the methods provided in the foregoing Embodiment 1 and Embodiment 2. The specific implementation and technical effects are similar, and are not described here.
- the tenth embodiment of the present application provides a computer readable medium, the computer readable medium includes instructions for executing, by the terminal device, the method performed by the terminal device in the first embodiment and the second embodiment of the present application. step.
- the embodiment 11 of the present application provides a computer readable medium, the computer readable medium includes instructions for causing an access network device to perform access in Embodiment 1 and Embodiment 2 of the present application. Method steps performed by the network device.
- the embodiment 12 of the present application provides a computer readable medium, where the computer readable medium includes instructions for causing a core network device to execute a core network device in Embodiment 1 and Embodiment 2 of the present application. Method steps performed.
- Embodiment 13 of the present application provides a system on chip, the system is applicable to a terminal device, where the system on chip includes: at least one communication interface, at least one processor, at least one memory, the communication interface, the memory, and The processor is interconnected by a bus, and the processor invokes the instructions stored in the memory to perform the method steps performed by the terminal device in the first embodiment and the second embodiment of the present application.
- Embodiment 14 of the present application provides a system on chip, the system is applicable to an access network device, where the system on chip includes: at least one communication interface, at least one processor, at least one memory, the communication interface, The memory and the processor are interconnected by a bus, and the processor invokes the instructions stored in the memory to perform the method steps performed by the access network device in the first embodiment and the second embodiment of the present application.
- Embodiment 15 of the present application provides a system on chip, the system is applicable to a core network device, where the system on chip includes: at least one communication interface, at least one processor, at least one memory, the communication interface, and a memory. And the processor is interconnected by a bus, and the processor invokes the instructions stored in the memory to perform the method provided by the core network device in Embodiment 1 and Embodiment 2 of the present application.
- Embodiment 16 of the present application provides a program product, the program product comprising a computer program, the computer program being stored in a readable storage medium, the at least one processor of the terminal device executing the computer program to cause the terminal device to implement The method steps performed by the terminal device in Embodiment 1 and Embodiment 2 of the present application.
- Embodiment 17 of the present application provides a program product, the program product comprising a computer program, the computer program being stored in a readable storage medium, the at least one processor of the access network device executing the computer program to cause the connection
- the network access device implements the method steps performed by the access network device in the first embodiment and the second embodiment of the present application.
- Embodiment 18 of the present application provides a program product, the program product comprising a computer program, the computer program being stored in a readable storage medium, the at least one processor of the core network device executing the computer program to cause the core network
- the device implements the method steps performed by the core network device in Embodiment 1 and Embodiment 2 of the present application.
- the processor described in the present application may be a central processing unit (CPU), a general purpose processor, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable.
- Logic device transistor logic device, hardware component, or any combination thereof. It can be implemented or executed in connection with the various exemplary logical blocks, modules and circuits described herein.
- the processor may also be a combination of computing functions, for example, including one or more microprocessor combinations, a combination of a DSP and a microprocessor, and the like.
- the bus described in this application may be an Industry Standard Architecture (ISA) bus, a Peripheral Component (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus.
- ISA Industry Standard Architecture
- PCI Peripheral Component
- EISA Extended Industry Standard Architecture
- the bus can be divided into an address bus, a data bus, a control bus, and the like.
- the bus in the drawings of the present application is not limited to only one bus or one type of bus.
- the described device embodiments are only schematic.
- the division of the modules is only a logical function division, and the actual implementation may have another division manner.
- multiple modules or components may be combined or integrated into another system, or some features may be omitted or not implemented.
- the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or module, and may be electrical, mechanical or otherwise.
- the units described as separate components may or may not be physically separate, ie may be located in one place, or may be distributed over multiple network elements. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computer Hardware Design (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Databases & Information Systems (AREA)
- Mobile Radio Communication Systems (AREA)
Abstract
Description
Claims (55)
- 一种数据完整性保护方法,其特征在于,包括:终端设备获取会话对应的完整性保护算法和密钥以及所述会话对应的无线数据承载DRB;所述终端设备使用所述完整性保护算法和密钥对所述DRB的数据进行完整性保护。
- 一种数据完整性保护方法,其特征在于,包括:终端设备获取流对应的完整性保护算法和密钥、以及所述流对应的无线数据承载DRB;所述终端设备使用所述完整性保护算法和密钥对所述DRB的数据进行完整性保护。
- 根据权利要求1或2所述的方法,其特征在于,还包括:所述终端设备获取以下信息中的至少一个:完整性保护位置的指示、完整性保护协议层位置指示、完整性保护位置的使能指示和完整性保护对象的指示;其中,所述完整性保护位置的指示用于指示进行完整性保护的网元;所述完整性保护协议层位置指示用于指示进行完整性保护的协议层;所述完整性保护位置的使能指示用于指示是否开启完整性保护的功能;所述完整性保护对象的指示用于指示完整性保护的对象为用户面数据,或者,用户面数据和控制面信令。
- 根据权利要求1所述的方法,其特征在于,所述终端设备获取会话对应的完整性保护算法和密钥,以及所述会话对应的DRB,包括:所述终端设备发送第一消息,所述第一消息用于请求建立所述会话;所述终端设备接收第二消息,所述第二消息包括所述会话的标识,所述会话对应的完整性保护算法和密钥,以及所述会话对应的DRB的标识。
- 根据权利要求2所述的方法,其特征在于,所述终端设备获取流对应的完整性保护算法和密钥、以及所述流对应的DRB,包括:所述终端设备发送第一消息,所述第一消息用于请求建立会话,所述会话与所述流对应;所述终端设备接收第二消息,所述第二消息包括:所述会话的标识,所述流的标识,所述流对应的DRB的标识,以及所述流对应的完整性保护算法和密钥。
- 根据权利要求4所述的方法,其特征在于,所述第二消息包括业务数据聚合SDAP层的配置,所述SDAP层的配置包括所述会话的标识,所述会话对应的完整性保护算法和密钥,以及所述会话对应的DRB的标识;或者,所述第二消息包括分组数据汇聚协议PDCP层的配置,所述PDCP层的配置包括所述会话的标识,所述会话对应的完整性保护算法和密钥,以及所述会话对应的DRB的标识。
- 根据权利要求5所述的方法,其特征在于,所述第二消息包括业务数据聚合SDAP层的配置,所述SDAP层的配置包括所述会话的标识,所述流的标识,所述流对应的DRB的标识,以及所述流对应的完整性保护算法和密钥;或者,所述第二消息包括分组数据汇聚协议PDCP层的配置,所述PDCP层的配置包括所述会话的标识,所述流的标识,所述流对应的DRB的标识,以及所述流对应的完整性保护算法和密钥。
- 一种通信装置,其特征在于,包括:获取模块,用于获取会话对应的完整性保护算法和密钥以及所述会话对应的无线数据承载DRB;完整性保护模块,用于使用所述完整性保护算法和密钥对所述DRB的数据进行完整性保护。
- 一种通信装置,其特征在于,包括:获取模块,用于获取流对应的完整性保护算法和密钥、以及所述流对应的无线数据承载DRB;完整性保护模块,用于使用所述完整性保护算法和密钥对所述DRB的数据进行完整性保护。
- 根据权利要求8或9所述的装置,其特征在于,所述获取模块还用于:获取以下信息中的至少一个:完整性保护位置的指示、完整性保护协议层位置指示、完整性保护位置的使能指示和完整性保护对象的指示;其中,所述完整性保护位置的指示用于指示进行完整性保护的网元;所述完整性保护协议层位置指示用于指示进行完整性保护的协议层;所述完整性保护位置的使能指示用于指示是否开启完整性保护的功能;所述完整性保护对象的指示用于指示完整性保护的对象为用户面数据,或者,用户面数据和控制面信令。
- 根据权利要求8所述的装置,其特征在于,所述获取模块,具体用于:发送第一消息,所述第一消息用于请求建立所述会话;接收第二消息,所述第二消息包括所述会话的标识,所述会话对应的完整性保护算法和密钥,以及所述会话对应的DRB的标识。
- 根据权利要求9所述的装置,其特征在于,所述获取模块,具体用于:发送第一消息,所述第一消息用于请求建立会话,所述会话与所述流对应;接收第二消息,所述第二消息包括:所述会话的标识,所述流的标识,所述流对应的DRB的标识,以及所述流对应的完整性保护算法和密钥。
- 根据权利要求11所述的装置,其特征在于,所述第二消息包括业务数据聚合SDAP层的配置,所述SDAP层的配置包括所述会话的标识,所述会话对应的完整性保护算法和密钥,以及所述会话对应的DRB的标识;或者,所述第二消息包括分组数据汇聚协议PDCP层的配置,所述PDCP层的配置包括所述会话的标识,所述会话对应的完整性保护算法和密钥,以及所述会话对应的DRB的标识。
- 根据权利要求12所述的装置,其特征在于,所述第二消息包括业务数据聚合SDAP层的配置,所述SDAP层的配置包括所述会话的标识,所述流的标识,所述流对应的DRB的标识,以及所述流对应的完整性保护算法和密钥;或者,所述第二消息包括分组数据汇聚协议PDCP层的配置,所述PDCP层的配置包括所述会话的标识,所述流的标识,所述流对应的DRB的标识,以及所述流对应的完整性保护算法和密钥。
- 一种通信装置,其特征在于,包括处理器,与存储器相连,用于读取并执行所述存储器中存储的程序,以实现如权利要求1-8任一项所述的方法。
- 一种终端设备,其特征在于,包括如权利要求9-15任一项所述的装置。
- 一种算机可读存储介质,其特征在于,包括程序,所述程序被处理器调用时用于执行如权利要求1-8任一项所述的方法。
- 一种数据完整性保护方法,其特征在于,包括:终端设备向接入网设备发送第一消息,所述第一消息用于请求建立会话;所述终端设备从所述接入网设备接收第二消息,所述第二消息包括所述会话的标识,所述会话对应的无线数据承载DRB的标识,完整性保护算法和密钥;所述终端设备使用所述完整性保护算法和所述密钥对所述DRB的数据进行完整性保护。
- 根据权利要求18所述的方法,其特征在于,所述第二消息还包括:第一指示,所述第一指示用于指示是否开启完整性保护的功能。
- 根据权利要求19所述的方法,其特征在于,所述第二消息包括分组数据汇聚层协议PDCP层的配置,所述PDCP层的配置包括所述第一指示。
- 根据权利要求18-20任一项所述的方法,其特征在于,所述第二消息还包括:第二指示,所述第二指示用于指示进行完整性保护的协议层。
- 根据权利要求18-21任一项所述的方法,其特征在于,所述完整性保护的对象为用户面数据。
- 根据权利要求18-22任一项所述的方法,其特征在于,所述第二消息包括SDAP层的配置,所述SDAP层的配置包括所述会话的标识,所述SDAP层用于处理流到DRB的映射。
- 根据权利要求18-23任一所述的方法,其特征在于,所述DRB的数据为PDCP层的数据包。
- 一种通信装置,其特征在于,包括:用于向接入网设备发送第一消息的单元或手段,所述第一消息用于请求建立会话;用于从所述接入网设备接收第二消息的单元或手段,所述第二消息包括所述会话的标识,所述会话对应的无线数据承载DRB的标识,完整性保护算法和密钥;用于使用所述完整性保护算法和所述密钥对所述DRB的数据进行完整性保护的 单元或手段。
- 根据权利要求25所述的装置,其特征在于,所述第二消息还包括:第一指示,所述第一指示用于指示是否开启完整性保护的功能。
- 根据权利要求26所述的装置,其特征在于,所述第二消息包括分组数据汇聚层协议PDCP层的配置,所述PDCP层的配置包括所述第一指示。
- 根据权利要求25-27任一项所述的装置,其特征在于,所述第二消息还包括:第二指示,所述第二指示用于指示进行完整性保护的协议层。
- 根据权利要求25-28任一项所述的装置,其特征在于,所述完整性保护的对象为用户面数据。
- 根据权利要求25-29任一项所述的装置,其特征在于,所述第二消息包括SDAP层的配置,所述SDAP层的配置包括所述会话的标识,所述SDAP层用于处理流到DRB的映射。
- 根据权利要求25-30任一所述的装置,其特征在于,所述DRB的数据为PDCP层的数据包。
- 一种通信装置,其特征在于,包括处理器,与存储器相连,用于读取并执行所述存储器中存储的程序,以实现如权利要求18-24任一项所述的方法。
- 一种终端设备,其特征在于,包括如权利要求25-32任一项所述的装置。
- 一种算机可读存储介质,其特征在于,包括程序,所述程序被处理器调用时用于执行如权利要求18-24任一项所述的方法。
- 一种数据完整性保护方法,其特征在于,包括:接入网设备从终端设备接收第一消息,所述第一消息用于请求建立会话;所述接入网设备向所述终端设备发送第二消息,所述第二消息包括所述会话的标识,所述会话对应的无线数据承载DRB的标识,完整性保护算法和密钥,其中,所述完整性保护算法和所述密钥用于对所述DRB的数据进行完整性保护。
- 根据权利要求35所述的方法,其特征在于,所述第二消息还包括:第一指示,所述第一指示用于指示是否开启完整性保护的功能。
- 根据权利要求36所述的方法,其特征在于,还包括:从核心网设备接收所述第一指示。
- 根据权利要求36或37所述的方法,其特征在于,所述第二消息包括分组数据汇聚层协议PDCP层的配置,所述PDCP层的配置包括所述第一指示。
- 根据权利要求35-38任一项所述的方法,其特征在于,所述第二消息还包括:第二指示,所述第二指示用于指示进行完整性保护的协议层。
- 根据权利要求35-39任一项所述的方法,其特征在于,所述完整性保护的对象为用户面数据。
- 根据权利要求35-40任一项所述的方法,其特征在于,所述第二消息包括SDAP层的配置,所述SDAP层的配置包括所述会话的标识,所述SDAP层用于处理流到DRB的映射。
- 一种通信装置,其特征在于,包括:用于从终端设备接收第一消息的单元,所述第一消息用于请求建立会话;用于向所述终端设备发送第二消息的单元,所述第二消息包括所述会话的标识,所述会话对应的无线数据承载DRB的标识,完整性保护算法和密钥,其中,所述完整性保护算法和所述密钥用于对所述DRB的数据进行完整性保护。
- 根据权利要求42所述的装置,其特征在于,所述第二消息还包括:第一指示,所述第一指示用于指示是否开启完整性保护的功能。
- 根据权利要求43所述的装置,其特征在于,还包括:用于从所述核心网设备接收所述第一指示的单元。
- 根据权利要求43或44所述的装置,其特征在于,所述第二消息包括分组数据汇聚层协议PDCP层的配置,所述PDCP层的配置包括所述第一指示。
- 根据权利要求42-45任一项所述的装置,其特征在于,所述第二消息还包括:第二指示,所述第二指示用于指示进行完整性保护的协议层。
- 根据权利要求42-46任一项所述的装置,其特征在于,所述完整性保护的对象为用户面数据。
- 根据权利要求42-47任一项所述的装置,其特征在于,所述第二消息包括SDAP层的配置,所述SDAP层的配置包括所述会话的标识,所述SDAP层用于处理流到DRB的映射。
- 一种通信装置,其特征在于,包括处理器,与存储器相连,用于读取并执行所述存储器中存储的程序,以实现如权利要求35-41任一项所述的方法。
- 一种接入网设备,其特征在于,包括如权利要求42至49任一项所述的装置。
- 一种算机可读存储介质,其特征在于,包括程序,所述程序被处理器调用时用于执行如权利要求35-41任一项所述的方法。
- 一种数据完整性保护方法,其特征在于,包括:核心网设备从接入网设备接收用于请求建立会话的信息;所述核心网设备向所述接入网设备发送用于请求接入网设备为所述会话准备资源的消息,其中该消息包括所述会话的标识和第一指示,所述第一指示用于指示是否开启完整性保护的功能。
- 一种核心网设备,其特征在于,包括:从接入网设备接收用于请求建立会话的信息的单元;用于向所述接入网设备发送用于请求接入网设备为所述会话准备资源的消息的单元,其中该消息包括所述会话的标识和第一指示,所述第一指示用于指示是否开启完整性保护的功能。
- 一种核心网设备,其特征在于,包括处理器,与存储器相连,用于读取并执行所述存储器中存储的程序,以实现如权利要求52所述的方法。
- 一种算机可读存储介质,其特征在于,包括程序,所述程序被处理器调用时用于执行如权利要求52所述的方法。
Priority Applications (10)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
EP21175743.0A EP3934300A1 (en) | 2017-08-11 | 2018-08-10 | Data integrity protection method and apparatus |
RU2020110041A RU2767778C2 (ru) | 2017-08-11 | 2018-08-10 | Способ и устройство защиты целостности данных |
CN201880051984.2A CN110999347A (zh) | 2017-08-11 | 2018-08-10 | 数据完整性保护方法和装置 |
AU2018315349A AU2018315349B2 (en) | 2017-08-11 | 2018-08-10 | Data integrity protection method, communication apparatus, terminal device, access network device, core network device, computer readable medium, and communication system |
KR1020207007086A KR102282122B1 (ko) | 2017-08-11 | 2018-08-10 | 데이터 무결성 보호 방법 및 장치 |
JP2020508031A JP6978586B2 (ja) | 2017-08-11 | 2018-08-10 | データ完全性保護方法および装置 |
EP18844845.0A EP3585082B1 (en) | 2017-08-11 | 2018-08-10 | Data integrity protection method and apparatus |
BR112020002766-9A BR112020002766A2 (pt) | 2017-08-11 | 2018-08-10 | método de proteção de integridade de dados, aparelho de comunicação, dispositivo terminal, dispositivo de rede de acesso, dispositivo de rede principal, mídia legível por computador, e sistema de comunicação |
US16/540,695 US11025645B2 (en) | 2017-08-11 | 2019-08-14 | Data integrity protection method and apparatus |
US17/330,915 US11818139B2 (en) | 2017-08-11 | 2021-05-26 | Data integrity protection method and apparatus |
Applications Claiming Priority (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
CN201710686855.8 | 2017-08-11 | ||
CN201710686855.8A CN109391603B (zh) | 2017-08-11 | 2017-08-11 | 数据完整性保护方法和装置 |
Related Child Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US16/540,695 Continuation US11025645B2 (en) | 2017-08-11 | 2019-08-14 | Data integrity protection method and apparatus |
Publications (1)
Publication Number | Publication Date |
---|---|
WO2019029691A1 true WO2019029691A1 (zh) | 2019-02-14 |
Family
ID=64983156
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
PCT/CN2018/099916 WO2019029691A1 (zh) | 2017-08-11 | 2018-08-10 | 数据完整性保护方法和装置 |
Country Status (9)
Country | Link |
---|---|
US (2) | US11025645B2 (zh) |
EP (2) | EP3934300A1 (zh) |
JP (1) | JP6978586B2 (zh) |
KR (1) | KR102282122B1 (zh) |
CN (3) | CN109218325B (zh) |
AU (1) | AU2018315349B2 (zh) |
BR (1) | BR112020002766A2 (zh) |
RU (1) | RU2767778C2 (zh) |
WO (1) | WO2019029691A1 (zh) |
Cited By (1)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN111163471A (zh) * | 2019-12-26 | 2020-05-15 | 北京微智信业科技有限公司 | 业务数据完整性保护方法、装置、设备及存储介质 |
Families Citing this family (10)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
BR112020008401A2 (pt) * | 2017-11-08 | 2020-11-03 | Guangdong Oppo Mobile Telecommunications Corp., Ltd. | método para controlar uma proteção de integridade, dispositivo de rede e meio de armazenamento para computador |
WO2020173859A1 (en) | 2019-02-28 | 2020-09-03 | Telefonaktiebolaget Lm Ericsson (Publ) | Methods providing management of emergency sessions and related devices and nodes |
CN111669750B (zh) * | 2019-03-07 | 2021-08-03 | 华为技术有限公司 | 一种pdu会话二次验证的方法及装置 |
GB2582827A (en) * | 2019-04-05 | 2020-10-07 | Nec Corp | Communication system |
CN111988782B (zh) * | 2019-05-23 | 2022-04-12 | 华为技术有限公司 | 安全会话方法和装置 |
CN110366049B (zh) * | 2019-08-05 | 2021-03-23 | 杭州当虹科技股份有限公司 | 一种流式视频完整性保护方法 |
CN113038604B (zh) * | 2019-12-24 | 2023-03-21 | 中国电信股份有限公司 | 无线资源配置方法、装置和***、基站 |
CN114930890A (zh) * | 2020-03-30 | 2022-08-19 | Oppo广东移动通信有限公司 | 完整性保护方法和通信设备 |
CN115004634B (zh) * | 2020-04-03 | 2023-12-19 | Oppo广东移动通信有限公司 | 信息处理方法、装置、设备及存储介质 |
CN116158111B (zh) * | 2020-08-10 | 2024-07-19 | 华为技术有限公司 | 一种通信的方法及装置 |
Citations (3)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN102487507A (zh) * | 2010-12-01 | 2012-06-06 | 中兴通讯股份有限公司 | 一种实现完整性保护的方法及*** |
WO2016076628A2 (ko) * | 2014-11-11 | 2016-05-19 | 삼성전자 주식회사 | 이동통신 네트워크를 통한 데이터 서비스 제공 방법 및 장치 |
CN105704753A (zh) * | 2014-11-26 | 2016-06-22 | 电信科学技术研究院 | 一种进行数据传输的方法、***和设备 |
Family Cites Families (31)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20050086477A1 (en) * | 2003-10-16 | 2005-04-21 | Taiwan Semiconductor Manufacturing Co. | Integrate PGP and Lotus Notes to encrypt / decrypt email |
US7477749B2 (en) * | 2004-05-12 | 2009-01-13 | Nokia Corporation | Integrity protection of streamed content |
CN101001252A (zh) * | 2006-06-25 | 2007-07-18 | 华为技术有限公司 | 一种注册方法和一种用户面安全算法的协商方法及装置 |
CN101222322B (zh) | 2008-01-24 | 2010-06-16 | 中兴通讯股份有限公司 | 一种超级移动宽带***中安全能力协商的方法 |
KR101674947B1 (ko) * | 2009-04-21 | 2016-11-10 | 엘지전자 주식회사 | 효율적인 보안 관련 처리 |
CN103188681B (zh) * | 2009-09-28 | 2016-08-10 | 华为技术有限公司 | 数据传输方法、装置及*** |
CN102098676B (zh) * | 2010-01-04 | 2015-08-12 | 电信科学技术研究院 | 一种实现完整性保护的方法、装置和*** |
KR101831448B1 (ko) * | 2010-02-02 | 2018-02-26 | 엘지전자 주식회사 | 이동 통신 시스템에서 pdcp 기능을 선택적으로 적용하는 방법 |
CN101860863A (zh) * | 2010-05-21 | 2010-10-13 | 中国科学院软件研究所 | 一种增强的加密及完整性保护方法 |
JP2012044325A (ja) * | 2010-08-16 | 2012-03-01 | Ntt Docomo Inc | 移動通信方法及び無線基地局 |
WO2012055114A1 (en) * | 2010-10-29 | 2012-05-03 | Nokia Siemens Networks Oy | Security of user plane traffic between relay node and radio access network |
ES2530961T3 (es) * | 2010-12-10 | 2015-03-09 | Ericsson Telefon Ab L M | Habilitación e inhabilitación de la protección de la integridad para portadores de radio de datos |
CN102448058B (zh) * | 2011-01-10 | 2014-04-30 | 华为技术有限公司 | 一种Un接口上的数据保护方法与装置 |
CN102595390B (zh) * | 2011-01-18 | 2019-04-05 | 中兴通讯股份有限公司 | 一种安全模式的配置方法和终端 |
CN108566685B (zh) * | 2012-06-08 | 2021-11-30 | 华为技术有限公司 | 基站、用户设备及通信方法 |
CN104919834B (zh) * | 2013-01-11 | 2018-10-19 | Lg 电子株式会社 | 用于在无线通信***中应用安全信息的方法和设备 |
WO2014201160A1 (en) * | 2013-06-11 | 2014-12-18 | Huawei Technologies Co., Ltd. | System and method for coordinated remote control of network radio nodes and core network elements |
EP2965554B1 (en) * | 2013-09-11 | 2019-07-24 | Samsung Electronics Co., Ltd. | Method and system to enable secure communication for inter-enb transmission |
WO2016159841A1 (en) * | 2015-03-31 | 2016-10-06 | Telefonaktiebolaget Lm Ericsson (Publ) | Service continuity |
US10454686B2 (en) * | 2015-04-08 | 2019-10-22 | Telefonaktiebolaget Lm Ericsson (Publ) | Method, apparatus, and system for providing encryption or integrity protection in a wireless network |
CA2995514C (en) | 2015-08-13 | 2020-04-28 | Huawei Technologies Co., Ltd. | Message protection method, and related device, and system |
WO2017039042A1 (ko) * | 2015-09-04 | 2017-03-09 | 엘지전자(주) | 무선 통신 시스템에서 단말의 데이터 송수신 방법 및 장치 |
CN107027117A (zh) * | 2016-02-02 | 2017-08-08 | 普天信息技术有限公司 | 一种动态生成根密钥的方法 |
US20190075482A1 (en) * | 2016-11-04 | 2019-03-07 | Telefonaktiebolaget Lm Ericsson (Publ) | Reflective mapping of flows to radio bearers |
JP2020503781A (ja) * | 2016-12-29 | 2020-01-30 | エルジー エレクトロニクス インコーポレイティド | Drbを確立する方法及び装置 |
CN115278659A (zh) * | 2017-01-30 | 2022-11-01 | 瑞典爱立信有限公司 | 针对用户平面数据的完整性保护的方法 |
US10123210B2 (en) * | 2017-03-17 | 2018-11-06 | Nokia Of America Corporation | System and method for dynamic activation and deactivation of user plane integrity in wireless networks |
KR102359746B1 (ko) * | 2017-06-05 | 2022-02-10 | 삼성전자 주식회사 | 차세대 이동통신 시스템에서 인액티브 모드 단말이 데이터를 전송하는 방법 및 장치 |
KR102394123B1 (ko) * | 2017-06-16 | 2022-05-04 | 삼성전자 주식회사 | 차세대 이동 통신 시스템에서 복수 개의 스케쥴링 요청을 전송하는 방법 및 장치 |
EP3435700B1 (en) * | 2017-07-24 | 2020-09-16 | ASUSTek Computer Inc. | Method and apparatus for serving quality of service (qos) flow in a wireless communication system |
MX2019000419A (es) * | 2017-08-10 | 2019-06-20 | Lg Electronics Inc | Metodo para realizar un restablecimiento de una entidad pdcp asociada con la entidad um de rlc en un sistema de comunicacion inalambrica y un dispositivo para lo mismo. |
-
2017
- 2017-08-11 CN CN201811179111.8A patent/CN109218325B/zh active Active
- 2017-08-11 CN CN201710686855.8A patent/CN109391603B/zh active Active
-
2018
- 2018-08-10 JP JP2020508031A patent/JP6978586B2/ja active Active
- 2018-08-10 EP EP21175743.0A patent/EP3934300A1/en active Pending
- 2018-08-10 CN CN201880051984.2A patent/CN110999347A/zh active Pending
- 2018-08-10 RU RU2020110041A patent/RU2767778C2/ru active
- 2018-08-10 EP EP18844845.0A patent/EP3585082B1/en active Active
- 2018-08-10 BR BR112020002766-9A patent/BR112020002766A2/pt unknown
- 2018-08-10 WO PCT/CN2018/099916 patent/WO2019029691A1/zh unknown
- 2018-08-10 AU AU2018315349A patent/AU2018315349B2/en active Active
- 2018-08-10 KR KR1020207007086A patent/KR102282122B1/ko active IP Right Grant
-
2019
- 2019-08-14 US US16/540,695 patent/US11025645B2/en active Active
-
2021
- 2021-05-26 US US17/330,915 patent/US11818139B2/en active Active
Patent Citations (3)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN102487507A (zh) * | 2010-12-01 | 2012-06-06 | 中兴通讯股份有限公司 | 一种实现完整性保护的方法及*** |
WO2016076628A2 (ko) * | 2014-11-11 | 2016-05-19 | 삼성전자 주식회사 | 이동통신 네트워크를 통한 데이터 서비스 제공 방법 및 장치 |
CN105704753A (zh) * | 2014-11-26 | 2016-06-22 | 电信科学技术研究院 | 一种进行数据传输的方法、***和设备 |
Non-Patent Citations (1)
Title |
---|
"Consideration on UP integrity configuration", R2-1710314, 3GPP TSG RAN WG2 MEETING #99BIS, 13 October 2017 (2017-10-13), XP051342362 * |
Cited By (2)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN111163471A (zh) * | 2019-12-26 | 2020-05-15 | 北京微智信业科技有限公司 | 业务数据完整性保护方法、装置、设备及存储介质 |
CN111163471B (zh) * | 2019-12-26 | 2021-02-19 | 北京微智信业科技有限公司 | 业务数据完整性保护方法、装置、设备及存储介质 |
Also Published As
Publication number | Publication date |
---|---|
CN109391603A (zh) | 2019-02-26 |
CN110999347A (zh) | 2020-04-10 |
US20210352082A1 (en) | 2021-11-11 |
EP3585082B1 (en) | 2021-05-26 |
KR20200036018A (ko) | 2020-04-06 |
RU2020110041A (ru) | 2021-09-13 |
CN109391603B (zh) | 2021-07-09 |
JP6978586B2 (ja) | 2021-12-08 |
CN109218325A (zh) | 2019-01-15 |
BR112020002766A2 (pt) | 2020-07-28 |
EP3585082A1 (en) | 2019-12-25 |
KR102282122B1 (ko) | 2021-07-26 |
EP3934300A1 (en) | 2022-01-05 |
US20190372995A1 (en) | 2019-12-05 |
JP2020530721A (ja) | 2020-10-22 |
US11818139B2 (en) | 2023-11-14 |
AU2018315349A1 (en) | 2020-03-19 |
AU2018315349B2 (en) | 2021-03-25 |
CN109218325B (zh) | 2020-03-10 |
US11025645B2 (en) | 2021-06-01 |
RU2767778C2 (ru) | 2022-03-21 |
RU2020110041A3 (zh) | 2021-10-15 |
EP3585082A4 (en) | 2020-01-22 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US11818139B2 (en) | Data integrity protection method and apparatus | |
US20230016378A1 (en) | Pdu session management | |
CN108347410B (zh) | 安全实现方法、设备以及*** | |
CN108366369B (zh) | 一种数据安全传输的方法及接入网、终端、核心网设备 | |
WO2015165051A1 (zh) | 数据传输方法及设备 | |
US20200344245A1 (en) | Message sending method and apparatus | |
EP3806529A1 (en) | Data transmission method and apparatus | |
WO2017133021A1 (zh) | 一种安全处理方法及相关设备 | |
WO2021254172A1 (zh) | 一种通信方法以及相关装置 | |
KR102104844B1 (ko) | 데이터 전송 방법, 제1 장치 및 제2 장치 | |
JP2024026229A (ja) | Slユニキャストにおけるセキュリティの改善 | |
WO2020252790A1 (zh) | 一种信息传输方法及装置、网络设备、用户设备 | |
US10455472B2 (en) | Device and method of handling data transmissions in a wireless communication system | |
WO2021073382A1 (zh) | 注册方法及装置 | |
WO2023011263A1 (zh) | 消息传输方法及通信装置 | |
WO2022160275A1 (zh) | 无线通信方法、设备及存储介质 | |
WO2021233358A1 (zh) | 通信方法及装置 | |
EP4376461A1 (en) | Method and device for operating terminal in wireless communication system |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
121 | Ep: the epo has been informed by wipo that ep was designated in this application |
Ref document number: 18844845 Country of ref document: EP Kind code of ref document: A1 |
|
ENP | Entry into the national phase |
Ref document number: 2018844845 Country of ref document: EP Effective date: 20190916 |
|
ENP | Entry into the national phase |
Ref document number: 2020508031 Country of ref document: JP Kind code of ref document: A |
|
NENP | Non-entry into the national phase |
Ref country code: DE |
|
REG | Reference to national code |
Ref country code: BR Ref legal event code: B01A Ref document number: 112020002766 Country of ref document: BR |
|
ENP | Entry into the national phase |
Ref document number: 20207007086 Country of ref document: KR Kind code of ref document: A |
|
ENP | Entry into the national phase |
Ref document number: 2018315349 Country of ref document: AU Date of ref document: 20180810 Kind code of ref document: A |
|
ENP | Entry into the national phase |
Ref document number: 112020002766 Country of ref document: BR Kind code of ref document: A2 Effective date: 20200210 |