WO2019029691A1 - 数据完整性保护方法和装置 - Google Patents

数据完整性保护方法和装置 Download PDF

Info

Publication number
WO2019029691A1
WO2019029691A1 PCT/CN2018/099916 CN2018099916W WO2019029691A1 WO 2019029691 A1 WO2019029691 A1 WO 2019029691A1 CN 2018099916 W CN2018099916 W CN 2018099916W WO 2019029691 A1 WO2019029691 A1 WO 2019029691A1
Authority
WO
WIPO (PCT)
Prior art keywords
integrity protection
session
message
identifier
indication
Prior art date
Application number
PCT/CN2018/099916
Other languages
English (en)
French (fr)
Inventor
娄崇
黄曲芳
刘星
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP21175743.0A priority Critical patent/EP3934300A1/en
Priority to RU2020110041A priority patent/RU2767778C2/ru
Priority to CN201880051984.2A priority patent/CN110999347A/zh
Priority to AU2018315349A priority patent/AU2018315349B2/en
Priority to KR1020207007086A priority patent/KR102282122B1/ko
Priority to JP2020508031A priority patent/JP6978586B2/ja
Priority to EP18844845.0A priority patent/EP3585082B1/en
Priority to BR112020002766-9A priority patent/BR112020002766A2/pt
Publication of WO2019029691A1 publication Critical patent/WO2019029691A1/zh
Priority to US16/540,695 priority patent/US11025645B2/en
Priority to US17/330,915 priority patent/US11818139B2/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/12—Applying verification of the received information
    • H04L63/123—Applying verification of the received information received data contents, e.g. message integrity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/10—Integrity
    • H04W12/102—Route integrity, e.g. using trusted paths
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/10—Integrity
    • H04W12/106—Packet or message integrity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W8/00—Network data management
    • H04W8/02—Processing of mobility data, e.g. registration information at HLR [Home Location Register] or VLR [Visitor Location Register]; Transfer of mobility data, e.g. between HLR, VLR or external networks
    • H04W8/08—Mobility data transfer
    • H04W8/14—Mobility data transfer between corresponding nodes
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]

Definitions

  • the present application relates to communication technologies, and in particular, to a data integrity protection method and apparatus.
  • the integrity protection function Integrity Protection
  • the purpose is to prevent user data from being tampered with. Once the receiving end finds that the integrity check fails, it can trigger the update process of the encryption and decryption key (Key) and protect the user data with the new key.
  • the integrity protection function includes integrity protection and integrity check.
  • the integrity protection function of LTE is located in the Packet Data Convergence Protocol (PDCP) layer.
  • the sender encrypts the PDCP protocol data unit (Protocol Data Unit, before encryption).
  • the header and data portion of the PDU) are integrity protected.
  • the sending end uses the integrity protection algorithm configured by the upper layer protocol layer, and calculates at least one parameter of the key, the COUNT value, the radio bearer identifier, the DIRECTION, the message itself, and the length of the message as an input parameter, and calculates a 32-bit message.
  • the Message Authentication Code for Integrity (MAC-I) is placed in the MAC-I field of the PDCP PDU.
  • the receiving end After receiving the message, the receiving end calculates the verification code XMAC-I expected by the message in the same way, and performs integrity check by comparing XMAC-I and MAC-I. If the MAC-I is equal to the XMAC-I, the receiving end determines that the integrity check is successful, otherwise it determines that the integrity check failed.
  • the granularity of the integrity protection function in the LTE system is at the terminal device level, that is, the terminal device uses the same integrity protection parameters for all data, making the integrity protection inflexible.
  • the present invention provides a data integrity protection method and apparatus, which can perform session granularity or flow granularity integrity protection, thereby making integrity protection more flexible and meeting the security requirements of different services of the same user.
  • the first aspect of the present application provides a data integrity protection method, including: acquiring, by a terminal device, an integrity protection algorithm and a key corresponding to a session, and a DRB corresponding to the session, using the integrity protection algorithm and a key pair.
  • the data of the DRB is integrity protected.
  • Different sessions can use different integrity protection algorithms and keys, which makes the integrity protection more flexible and meets the security requirements of different services of the same user.
  • the terminal device acquires an integrity protection algorithm and a key corresponding to the session, and a DRB corresponding to the session, where the terminal device sends a first message, where the first message is used to request to establish a
  • the session device receives the second message, where the second message includes an identifier of the session, an integrity protection algorithm and a key corresponding to the session, and an identifier of the DRB corresponding to the session.
  • the second message includes a configuration of a SDAP layer, where the configuration of the SDAP layer includes an identifier of the session, an integrity protection algorithm and a key corresponding to the session, and an identifier of the DRB corresponding to the session. ;or,
  • the second message includes a configuration of a PDCP layer, and the configuration of the PDCP layer includes an identifier of the session, an integrity protection algorithm and a key corresponding to the session, and an identifier of the DRB corresponding to the session.
  • the second aspect of the present application provides a data integrity protection method, including: acquiring, by a terminal device, an integrity protection algorithm and a key corresponding to a flow, and a DRB corresponding to the flow, using the integrity protection algorithm and a key pair
  • the DRB data is integrity protected.
  • Different flows can also use different integrity protection algorithms and keys, which makes the integrity protection more flexible and meets the security requirements of different services of the same user.
  • the terminal device acquires an integrity protection algorithm and a key corresponding to the flow, and a radio data bearer DRB corresponding to the flow, where the terminal device sends a first message, where the first message is used.
  • the second message includes a configuration of a SDAP layer, where the configuration of the SDAP layer includes an identifier of the session, an identifier of the flow, an identifier of a DRB corresponding to the flow, and a complete correspondence of the flow Sex protection algorithm and key; or,
  • the second message includes a configuration of a PDCP layer, and the configuration of the PDCP layer includes an identifier of the session, an identifier of the flow, an identifier of a DRB corresponding to the flow, and an integrity protection algorithm corresponding to the flow. Key.
  • the method further includes: the terminal device acquiring at least one of the following information:
  • An indication of an integrity protection location an integrity protection protocol layer location indication, an enable indication of an integrity protection location, and an indication of an integrity protection object
  • the indication of the integrity protection location is used to indicate a network element that performs integrity protection
  • the integrity protection protocol layer location indication is used to indicate a protocol layer for integrity protection
  • the enable indication of the integrity protection location indicates a function for indicating whether integrity protection is turned on
  • the indication of the integrity protection object is used to indicate that the object of integrity protection is user plane data, or user plane data and control plane signaling.
  • the data of the DRB is: a data packet of a SDAP layer of the DRB; or a data packet of a PDCP layer of the DRB.
  • the method further includes: the terminal device marking an identifier of the flow in a data packet of a SDAP layer of the DRB.
  • a third aspect of the present disclosure provides a data integrity protection method, including: an access network device receiving a first message sent by a terminal device, where the first message is used to request to establish a session; and the access network device is configured to a core network device.
  • Sending a third message where the third message includes the first message
  • the access network device receives a fourth message sent by the core network device, where the fourth message includes integrity protection corresponding to the session An algorithm and a key and a DRB corresponding to the session
  • the access network device saves an integrity protection algorithm and a key corresponding to the session, and a DRB corresponding to the session
  • the access network device to the terminal device Sending a second message, where the second message includes an identifier of the session, an integrity protection algorithm and a key corresponding to the session, and an identifier of the DRB corresponding to the session.
  • the second message includes a configuration of a SDAP layer, where the configuration of the SDAP layer includes an identifier of the session, an integrity protection algorithm and a key corresponding to the session, and an identifier of the DRB corresponding to the session.
  • the second message includes a configuration of a PDCP layer, where the configuration of the PDCP layer includes an identifier of the session, an integrity protection algorithm and a key corresponding to the session, and an identifier of the DRB corresponding to the session.
  • a fourth aspect of the present disclosure provides a data integrity protection method, including: an access network device receiving a first message sent by a terminal device, where the first message is used to request to establish a session; and the access network device is configured to a core network device.
  • Sending the third message, the third message includes the first message;
  • the access network device receives a fourth message sent by the core network device, where the fourth message includes integrity protection corresponding to the flow An algorithm and a key, and a radio data bearer DRB corresponding to the stream, where the session corresponds to the stream;
  • the access network device saves an integrity protection algorithm and a key corresponding to the stream, and a DRB corresponding to the stream
  • the access network device sends a second message to the terminal device, where the second message includes: an identifier of the session, an identifier of the flow, an identifier of a DRB corresponding to the flow, and a corresponding The integrity protection algorithm and key.
  • the second message includes a configuration of a SDAP layer, where the configuration of the SDAP layer includes an identifier of the session, an identifier of the flow, an identifier of a DRB corresponding to the flow, and a complete correspondence of the flow
  • the configuration of the PDCP layer includes an identifier of the session, an identifier of the flow, an identifier of the DRB corresponding to the flow, and a The corresponding integrity protection algorithm and key are described.
  • the third message or the second message further includes at least one of the following information:
  • An indication of an integrity protection location an integrity protection protocol layer location indication, an enable indication of an integrity protection location, and an indication of an integrity protection object
  • the indication of the integrity protection location is used to indicate a network element that performs integrity protection
  • the integrity protection protocol layer location indication is used to indicate a protocol layer for integrity protection
  • the enable indication of the integrity protection location indicates a function for indicating whether integrity protection is turned on
  • the indication of the integrity protection object is used to indicate that the object of integrity protection is user plane data, or user plane data and control plane signaling.
  • the method further includes: the access network device performing integrity protection on the data of the DRB by using the integrity protection algorithm and a key.
  • the data of the DRB is: a data packet of a SDAP layer of the DRB; or a data packet of a PDCP layer of the DRB.
  • the method further includes: the access network device marking the identifier of the flow in a data packet of the SDAP layer of the DRB.
  • a fifth aspect of the present disclosure provides a data integrity protection method, including: receiving, by a core network device, a third message sent by an access network device, where the third message includes a first message, where the first message is used to request to establish a session.
  • the core network device sends a fourth message to the access network device, where the third message includes an integrity protection algorithm and a key corresponding to the session, and a wireless data bearer DRB corresponding to the session, or includes
  • the stream corresponds to an integrity protection algorithm and a key and a DRB corresponding to the stream, the session corresponding to the stream.
  • the fourth message further includes at least one of the following information:
  • An indication of an integrity protection location an integrity protection protocol layer location indication, an enable indication of an integrity protection location, and an indication of an integrity protection object
  • the indication of the integrity protection location is used to indicate a network element that performs integrity protection
  • the integrity protection protocol layer location indication is used to indicate a protocol layer for integrity protection
  • the enable indication of the integrity protection location indicates a function for indicating whether integrity protection is turned on
  • the indication of the integrity protection object is used to indicate that the object of integrity protection is user plane data, or user plane data and control plane signaling.
  • the method further includes: the core network device performing integrity protection on the data of the DRB by using the integrity protection algorithm and a key.
  • the data of the DRB is: a data packet of a SDAP layer of the DRB; or a data packet of a PDCP layer of the DRB.
  • the method further includes: the core network device marking the identifier of the flow in a data packet of the SDAP layer of the DRB.
  • the sixth aspect of the present application provides a terminal device, including: an obtaining module, configured to acquire an integrity protection algorithm and a key corresponding to a session, and a wireless data bearer DRB corresponding to the session; and an integrity protection module, configured to use the The integrity protection algorithm and key protect the integrity of the data of the DRB.
  • the acquiring module is specifically configured to: send a first message, where the first message is used to request to establish the session; receive a second message, where the second message includes an identifier of the session, The integrity protection algorithm and key corresponding to the session, and the identifier of the DRB corresponding to the session.
  • the second message includes a configuration of a SDAP layer, where the configuration of the SDAP layer includes an identifier of the session, an integrity protection algorithm and a key corresponding to the session, and an identifier of the DRB corresponding to the session.
  • the second message includes a configuration of a PDCP layer, where the configuration of the PDCP layer includes an identifier of the session, an integrity protection algorithm and a key corresponding to the session, and an identifier of the DRB corresponding to the session.
  • the seventh aspect of the present application provides a terminal device, including: an obtaining module, configured to acquire an integrity protection algorithm and a key corresponding to a stream, and a wireless data bearer DRB corresponding to the stream; and an integrity protection module, configured to use the The integrity protection algorithm and the key perform integrity protection on the data of the DRB.
  • the acquiring module is specifically configured to: send a first message, where the first message is used to request to establish a session, the session is corresponding to the flow, and the second message is received, where the second message includes: The identifier of the session, the identifier of the stream, the identifier of the DRB corresponding to the stream, and an integrity protection algorithm and a key corresponding to the stream.
  • the second message includes a configuration of a SDAP layer, where the configuration of the SDAP layer includes an identifier of the session, an identifier of the flow, an identifier of a DRB corresponding to the flow, and a complete correspondence of the flow
  • the configuration of the PDCP layer includes an identifier of the session, an identifier of the flow, an identifier of the DRB corresponding to the flow, and a The corresponding integrity protection algorithm and key are described.
  • the acquiring module is further configured to: acquire at least one of the following information:
  • An indication of an integrity protection location an integrity protection protocol layer location indication, an enable indication of an integrity protection location, and an indication of an integrity protection object
  • the indication of the integrity protection location is used to indicate a network element that performs integrity protection
  • the integrity protection protocol layer location indication is used to indicate a protocol layer for integrity protection
  • the enable indication of the integrity protection location indicates a function for indicating whether integrity protection is turned on
  • the indication of the integrity protection object is used to indicate that the object of integrity protection is user plane data, or user plane data and control plane signaling.
  • the data of the DRB is: a data packet of a SDAP layer of the DRB; or a data packet of a PDCP layer of the DRB.
  • the method further includes: a marking module, configured to mark the identifier of the flow in a data packet of the SDAP layer of the DRB.
  • An eighth aspect of the present disclosure provides an access network device, including:
  • a receiving module configured to receive a first message sent by the terminal device, where the first message is used to request to establish a session
  • a sending module configured to send a third message to the core network device, where the third message includes the first message
  • the receiving module is further configured to receive a fourth message sent by the core network device, where the fourth message includes an integrity protection algorithm and a key corresponding to the session, and a wireless data bearer DRB corresponding to the session;
  • a storage module configured to save an integrity protection algorithm and a key corresponding to the session, and a DRB corresponding to the session;
  • the sending module is further configured to send a second message to the terminal device, where the second message includes an identifier of the session, an integrity protection algorithm and a key corresponding to the session, and a DRB corresponding to the session. logo.
  • the second message includes a configuration of a SDAP layer, where the configuration of the SDAP layer includes an identifier of the session, an integrity protection algorithm and a key corresponding to the session, and an identifier of the DRB corresponding to the session.
  • the second message includes a configuration of a PDCP layer, where the configuration of the PDCP layer includes an identifier of the session, an integrity protection algorithm and a key corresponding to the session, and an identifier of the DRB corresponding to the session.
  • the ninth aspect of the present application provides an access network device, including:
  • a receiving module configured to receive a first message sent by the terminal device, where the first message is used to request to establish a session
  • a sending module configured to send the third message to a core network device, where the third message includes the first message
  • the receiving module is further configured to receive a fourth message sent by the core network device, where the fourth message includes an integrity protection algorithm and a key corresponding to the stream, and a wireless data bearer DRB corresponding to the stream, where The session corresponds to the stream;
  • a storage module configured to save an integrity protection algorithm and a key corresponding to the stream, and a DRB corresponding to the stream;
  • the sending module is further configured to send a second message to the terminal device, where the second message includes: an identifier of the session, an identifier of the flow, an identifier of a DRB corresponding to the flow, and the flow Corresponding integrity protection algorithm and key.
  • the second message includes a configuration of a SDAP layer, where the configuration of the SDAP layer includes an identifier of the session, an identifier of the flow, an identifier of a DRB corresponding to the flow, and a complete correspondence of the flow Sex protection algorithm and key; or,
  • the second message includes a configuration of a PDCP layer, and the configuration of the PDCP layer includes an identifier of the session, an identifier of the flow, an identifier of a DRB corresponding to the flow, and an integrity protection algorithm corresponding to the flow. Key.
  • the third message or the second message further includes at least one of the following information:
  • An indication of an integrity protection location an integrity protection protocol layer location indication, an enable indication of an integrity protection location, and an indication of an integrity protection object
  • the indication of the integrity protection location is used to indicate a network element that performs integrity protection
  • the integrity protection protocol layer location indication is used to indicate a protocol layer for integrity protection
  • the enable indication of the integrity protection location indicates a function for indicating whether integrity protection is turned on
  • the indication of the integrity protection object is used to indicate that the object of integrity protection is user plane data, or user plane data and control plane signaling.
  • the access network device further includes: an integrity protection module, configured to perform integrity protection on the data of the DRB by using the integrity protection algorithm and a key.
  • an integrity protection module configured to perform integrity protection on the data of the DRB by using the integrity protection algorithm and a key.
  • the data of the DRB is: a data packet of a SDAP layer of the DRB; or a data packet of a PDCP layer of the DRB.
  • the access network device When the data of the DRB is a data packet of the SDAP layer of the DRB, the access network device further includes: a marking module, configured to mark an identifier of the flow in a data packet of a SDAP layer of the DRB.
  • a tenth aspect of the present application provides a core network device, including:
  • a receiving module configured to receive a third message sent by the access network device, where the third message includes a first message, where the first message is used to request to establish a session;
  • a sending module configured to send a fourth message to the access network device, where the third message includes an integrity protection algorithm and a key corresponding to the session, and a wireless data bearer DRB corresponding to the session, or includes a flow Corresponding integrity protection algorithm and key and DRB corresponding to the stream, the session corresponding to the stream.
  • the fourth message further includes at least one of the following information:
  • An indication of an integrity protection location an integrity protection protocol layer location indication, an enable indication of an integrity protection location, and an indication of an integrity protection object
  • the indication of the integrity protection location is used to indicate a network element that performs integrity protection
  • the integrity protection protocol layer location indication is used to indicate a protocol layer for integrity protection
  • the enable indication of the integrity protection location indicates a function for indicating whether integrity protection is turned on
  • the indication of the integrity protection object is used to indicate that the object of integrity protection is user plane data, or user plane data and control plane signaling.
  • the core network device further includes: an integrity protection module, configured to perform integrity protection on the data of the DRB by using the integrity protection algorithm and a key.
  • an integrity protection module configured to perform integrity protection on the data of the DRB by using the integrity protection algorithm and a key.
  • the data of the DRB is: a data packet of a SDAP layer of the DRB; or a data packet of a PDCP layer of the DRB.
  • the core network device further includes: a marking module, configured to mark the identifier of the flow in a data packet of the SDAP layer of the DRB.
  • An eleventh aspect of the present application provides a terminal device, including: a processor, a memory, a receiver, and a transmitter, where the memory, the receiver, and the transmitter are connected and communicated with the processor through a bus, where the memory is used for
  • the storage computer executes instructions for executing the computer to execute instructions to cause the terminal device to perform the methods provided by the first aspect and the second aspect described above.
  • the twelfth aspect of the present application provides an access network device, including: a processor, a memory, a receiver, and a transmitter, where the memory, the receiver, and the transmitter are connected and communicated with the processor through a bus, the memory Storing computer execution instructions, the processor for executing the computer execution instructions to cause the access network device to perform the methods provided by the third and fourth aspects above.
  • a thirteenth aspect of the present application provides a core network device, including: a processor, a memory, a receiver, and a transmitter, where the memory, the receiver, and the transmitter are connected and communicated with the processor through a bus, where the memory is used.
  • the storage computer executes instructions for executing the computer to execute instructions to cause the core network device to perform the method provided by the fifth aspect above.
  • a fourteenth aspect of the present application provides a computer readable medium comprising computer executed instructions for causing a terminal device to perform the methods provided by the first and second aspects of the present application.
  • a fifteenth aspect of the present application provides a computer readable medium, the computer readable medium comprising computer executed instructions for causing an access network device to perform the methods provided by the third and fourth aspects of the present application .
  • a sixteenth aspect of the present application provides a computer readable medium comprising computer executed instructions for causing a core network device to perform the method provided by the fifth aspect of the present application.
  • a seventeenth aspect of the present application provides a system on chip, the system being applicable to a terminal device, the system on chip comprising: at least one communication interface, at least one processor, at least one memory, the communication interface, the memory, and The processors are interconnected by a bus that invokes instructions stored in the memory to perform the methods provided by the first and second aspects of the present application.
  • the eighteenth aspect of the present application provides an on-chip system, the system being applicable to an access network device, the system on-chip comprising: at least one communication interface, at least one processor, at least one memory, the communication interface, The memory and processor are interconnected by a bus that invokes instructions stored in the memory to perform the methods provided by the third and fourth aspects of the present application.
  • a nineteenth aspect of the present application provides a system on a chip, the system being applicable to a core network device, the system on a chip comprising: at least one communication interface, at least one processor, at least one memory, the communication interface, and a memory And the processor is interconnected by a bus, the processor invoking instructions stored in the memory to perform the method provided by the fifth aspect of the present application.
  • a twentieth aspect of the present application provides a program product, the program product comprising a computer program, the computer program being stored in a readable storage medium, the at least one processor of the terminal device executing the computer program to cause the terminal device to implement The method provided by the first and second aspects of the application.
  • a twenty-first aspect of the present application provides a program product, the program product comprising a computer program, the computer program being stored in a readable storage medium, the at least one processor of the access network device executing the computer program to cause the The access network device implements the methods provided by the third and fourth aspects of the present application.
  • a twenty-second aspect of the present application provides a program product, the program product comprising a computer program, the computer program being stored in a readable storage medium, the at least one processor of the core network device executing the computer program to cause the core
  • the network device implements the method provided by the fifth aspect of the present application.
  • the present application provides a data integrity protection method and apparatus.
  • the terminal device obtains the integrity protection algorithm corresponding to the session and the DRB corresponding to the session, and uses the integrity protection algorithm corresponding to the session and the DRB corresponding to the key pair session.
  • the data is integrity-protected, or the terminal device acquires the integrity protection algorithm and the key corresponding to the flow and the DRB corresponding to the flow, and uses the integrity protection algorithm corresponding to the flow and the DRB data corresponding to the key pair to perform integrity protection, one
  • the session includes multiple flows. Different sessions can use different integrity protection algorithms and keys. Different flows can also use different integrity protection algorithms and keys, which makes the integrity protection more flexible and meets the security of different services of the same user. demand.
  • FIG. 1 is a schematic structural diagram of an application scenario of the present application
  • 3 is a schematic diagram of a protocol layer of a 5G system
  • FIG. 5 is a schematic diagram of MAC-I when integrity protection is performed in the PDCP layer
  • FIG. 6 is a schematic structural diagram of a terminal device according to Embodiment 3 of the present application.
  • FIG. 7 is a schematic structural diagram of an access network device according to Embodiment 5 of the present application.
  • FIG. 8 is a schematic structural diagram of a core network device according to Embodiment 7 of the present application.
  • FIG. 9 is a schematic structural diagram of a terminal device according to Embodiment 8 of the present application.
  • FIG. 10 is a schematic structural diagram of an access network device according to Embodiment 9 of the present application.
  • FIG. 11 is a schematic structural diagram of a core network device according to Embodiment 10 of the present application.
  • the present application provides a data integrity protection method, which can be applied to multiple communication systems, which can be a Universal Mobile Telecommunications System (UMTS), a Code Division Multiple Access (CDMA) system. , Wideband Code Division Multiple Access (WCDMA) system, Wireless Local Area Network (WLAN), Long Term Evolution (LTE) system or 5th-generation mobile communication (5th-Generation, 5G) )system.
  • UMTS Universal Mobile Telecommunications System
  • CDMA Code Division Multiple Access
  • WCDMA Wideband Code Division Multiple Access
  • WLAN Wireless Local Area Network
  • LTE Long Term Evolution
  • 5G 5th-generation mobile communication
  • FIG. 1 shows a schematic architectural diagram of an application scenario of the present application.
  • the 5G system may include: a (Radio) Access Network (R) AN, a Core Network (CN), and a terminal device.
  • the RAN is responsible for the access of the terminal device, and the RAN has a plurality of terminal devices in the coverage area, and the interface between the RAN and the CN is an NG interface, and the interface between the RAN network elements is an Xn interface, and the RAN network element and the terminal device are The interface between the two is empty.
  • the RAN network element may be a base station of a UMTS system, a Base Transceiver Station (BTS) of a CDMA system, a base station (NodeB, NB) in a WCDMA system, or an evolved NodeB (evolved NodeB in an LTE system).
  • BTS Base Transceiver Station
  • NodeB, NB base station
  • AP access point
  • the eNB or the relay station, or the access point (AP) in the WLAN may also be a base station (such as a gNB or a transmission point (TRP)) in the 5G system, and the 5G system is also called a new wireless communication.
  • System new access technology (New Radio) or next-generation mobile communication system.
  • QoS flow-based service quality of service
  • flow is, for example, QoS flow.
  • QoS is divided into non-access stratum (NAS) layer QoS and access stratum (AS) layer QoS, where NAS layer QoS is QoS flow level, and QoS flow is protocol data unit (Protocol Data Unit, PDU)
  • PDU Protocol Data Unit
  • the CN network element includes an Access and Mobility Management Function (AMF) entity and a User Plane Function (UPF) entity.
  • AMF Access and Mobility Management Function
  • UPF User Plane Function
  • the AMF entity is mainly responsible for services such as mobility management and access management, and is equivalent to the functions of the Mobility Management Entity (MME) in addition to the session management function in the LTE system.
  • MME Mobility Management Entity
  • the UPF is equivalent to a Packet Data Network Gateway (P-GW) in the LTE system. It is mainly responsible for session and bearer management, Internet Protocol (IP) address allocation, etc.
  • IP Internet Protocol
  • the UPF generates downlink QoS flow, UE. Generate an upstream QoS flow.
  • the CN network element may further include a Session Management Function (SMF) entity, an Authentication Server Function (AUSF) entity, an authentication Credential Repository and a Processing Function (Authentication Credential Repository and Processing Function).
  • SMF Session Management Function
  • AUSF Authentication Server Function
  • ARPF ARPF
  • PCF Policy Control Function
  • AAA Authentication, Authorization and Accounting
  • the SMF entity is primarily responsible for establishing a session, modifying a session, or releasing a session.
  • the PCF entity is primarily responsible for providing strategies for the network.
  • the AAA server is mainly responsible for authenticating the Subscriber Identification Module (SIM) card, authorizing which services the SIM card can use, and recording the network resources used by the SIM card.
  • SIM Subscriber Identification Module
  • the AAA server can be provided by the operator or by a third party.
  • the AUSF is the endpoint of the authentication request message and interacts with the ARPF entity to obtain a long-term security credential of the terminal device.
  • the ARPF entity is mainly responsible for storing long-term security credentials of terminal devices.
  • the AMF entity and the SMF entity may be replaced by an MME, and the UPF entity may be replaced by a P-GW and a Serving Gateway (S-GW) in the LTE system, the AUSF entity and the ARPF.
  • the entity is replaced by a Home Subscriber Server (HSS), which is used to store subscription information, and the subscription information may be subscription information of the SIM card.
  • HSS Home Subscriber Server
  • the MME is a signaling management network element, and is responsible for encrypting the NAS signaling, assigning a temporary identity to the terminal device, selecting a CN network element such as the SGW and the PGW, and providing functions such as roaming, tracking, and security; and the SGW is a mobile switching between the eNBs. Sex anchor, and provide legal interception related functions; PGW is responsible for IP address allocation, scheme control and billing rules execution, and legal interception related functions.
  • the terminal device referred to in the present application may be a wireless terminal, which may be a device that provides voice and/or data connectivity to the user, a handheld device with wireless connectivity, or other processing device that is connected to the wireless modem.
  • the wireless terminal can communicate with the at least one core network via the (R)AN.
  • the wireless terminal can be a mobile terminal, such as a mobile phone (or "cellular" phone) and a computer with a mobile terminal, for example, a portable, pocket, handheld, computer built-in or vehicle-mounted mobile device,
  • the wireless access network exchanges voice and/or data.
  • a wireless terminal may also be called a Subscriber Unit, a Subscriber Station, a Mobile Station, a Mobile Station, a Remote Station, an Access Point, and a remote terminal.
  • the terminal (Remote Terminal), the access terminal (Access Terminal), the user terminal (User Terminal), the user equipment (User Equipment, UE), or the user agent (User Agent) are not limited herein.
  • the data integrity protection method provided by the present application is to solve the problem of inflexibility of the integrity protection existing in the prior art.
  • FIG. 2 is a signaling flowchart of a data integrity protection method according to Embodiment 1 of the present application.
  • the method in this embodiment may include the following steps:
  • Step S101 The terminal device sends a first message to the access network device.
  • the first message is used to request to establish a session, which is also referred to as a PDU session.
  • the first message may carry a NAS message, where the NAS message carries session establishment request information, where the session establishment request information includes an identifier of the session to be established.
  • the session establishment request message may further include a protocol discriminator for indicating the L3 protocol stack corresponding to the first message. If the session establishment request information is carried by the NAS message, the access network carries the NAS message in the third message and sends the message to the core network device.
  • the first message may be a Radio Resource Control (RRC) message, a Media Access Control (MAC) message, or a physical layer message.
  • RRC Radio Resource Control
  • MAC Media Access Control
  • the RRC message is, for example, an RRC connection setup request, an RRC connection re-establishment request, or an RRC connection setup completion.
  • the MAC message is, for example, a MAC Control Element (CE)
  • CE MAC Control Element
  • the physical layer message is, for example, physical layer signaling.
  • Step S102 The access network device sends a third message to the core network device, where the third message includes the first message.
  • the third message is used to request to establish a session. Specifically, after receiving the first message, the access network device carries the NAS message in the first message in the third message and sends the message to the core network device.
  • the third message is RAN and CN. Interface message between.
  • Step S103 The core network device sends a fourth message to the access network device, where the fourth message includes an integrity protection algorithm and a key corresponding to the session, and a data resource bearer (DRB) corresponding to the session.
  • the fourth message includes an integrity protection algorithm and a key corresponding to the session, and a data resource bearer (DRB) corresponding to the session.
  • DRB data resource bearer
  • the fourth message is used to request the access network device to prepare resources for the established session, and the fourth message may be a UE initial context setup request message, used to establish a context configuration for the UE; or, the fourth message is a PDU session resource setup request message, Used to configure resources for a session.
  • the fourth message carries the session information and the integrity protection configuration corresponding to the session.
  • the session information includes the session identifier and the DRB corresponding to the session.
  • the fourth message carries the NAS message, and the integrity protection configuration corresponding to the session is carried in the NAS message.
  • the integrity protection configuration corresponding to the session may not be carried in the NAS message.
  • the fourth message further includes configuration parameters including at least one protocol layer, which is used to establish one or more DRBs for the session to carry the services initiated by the terminal device.
  • FIG. 3 is a schematic diagram of a protocol layer of a 5G system. As shown in FIG. 3, the protocol layer of the terminal device and the access network device are: Service Data Aggregation Protocol (SDAP) layer in order from top to bottom. PDCP layer, Radio Link Control (RLC), MAC, and physical layer (Physical, PHY). The SDAP layer is used to add a protocol layer on the LTE system. The SDAP layer is used to process the flow to the DRB.
  • a terminal device may establish multiple sessions, and each session includes one or more sessions. Streams, each stream can be mapped to one or more DRBs, such as QoS flows.
  • the configuration parameters of the at least one protocol layer include parameters of each layer protocol stack, a transmission mode, a logical channel configuration, and scheduling related parameters.
  • the transmission mode may be an RLC transparent transmission mode, an acknowledgment mode or a non-acknowledgement mode
  • the logical channel configuration is, for example, a logical channel priority.
  • LTE or 5G protocol and details are not described herein again.
  • the integrity protection configuration corresponding to the session carried in the fourth message includes the integrity protection algorithm and the key corresponding to the session.
  • the fourth message may not carry the integrity protection algorithm corresponding to the session.
  • the key, the integrity protection algorithm and the key corresponding to the session are carried by other messages, or the integrity protection algorithm and key corresponding to the session are pre-configured.
  • the fourth message may further include at least one of the following: an indication of the integrity protection location, an integrity protection protocol layer location indication, an enable indication of the integrity protection location, and an indication of the integrity protection object.
  • one or more of the indication of the integrity protection location, the integrity protection protocol layer location indication, the integrity protection location enable indication, and the integrity protection object indication may also be pre-configured without passing the Four message dynamic indications.
  • the indication of the integrity protection location is used to indicate the network element for integrity protection.
  • the integrity protection may be located on the RAN side, or on the CN side, or on the RAN and the CN side. Therefore, the integrity protected network element may be an access network device, a core network device, or both at the access network device and the core.
  • the network device performs integrity protection.
  • the integrity protection location is on the RAN side
  • the integrity protection function is performed by the protocol stack on the RAN side, and the corresponding terminal equipment side is performed at the access layer.
  • the integrity protection location is on the CN side
  • the integrity protection function needs to be performed on the protocol stack on the CN side, and the corresponding terminal equipment side is performed on the non-access layer.
  • the integrity protection location is located on the RAN side and the CN side, the integrity protection function needs to be performed on the RAN side and the CN side, and the integrity protection of the user's control plane or data plane needs to be performed twice.
  • the integrity protection protocol layer location indication is used to indicate the protocol layer for integrity protection, and the protocol layer of integrity protection may be the SDAP layer, the PDCP layer or the RRC layer.
  • the enable indication of the integrity protection location indicates the function to indicate whether integrity protection is turned on.
  • the enable indication of the integrity protection location is associated with an indication of the integrity protection location, eg, if the integrity protection location indicated by the indication of the integrity protection location is on the RAN side, the enable indication of the integrity protection location is used to indicate the RAN The side function is turned on or off. If the integrity protection position indicated by the indication of the integrity protection position is on the RAN and the CN side, the enable indication of the integrity protection position is used to indicate that the RAN side and the CN side are respectively turned on or off. .
  • the indication of the integrity protection object is used to indicate that the object of integrity protection is User plane (UP) data, or user plane data and Control Plane (CP) signaling.
  • UP User plane
  • CP Control Plane
  • Different sessions may use the same or different integrity protection algorithms and keys, and the integrity protection algorithm and key correspond to the integrity protection location.
  • the core network device only indicates an integrity protection location (RAN side or CN side). ), the corresponding integrity protection algorithm and key are only configured in the integrity protection location. If the core network device indicates two integrity protection locations (RAN side and CN side), two integrity protection positions are needed. The integrity protection algorithm and the key are configured separately. The protection algorithm and key corresponding to the two integrity protection locations may be the same or different.
  • the key used in different sessions can be calculated by using a root key.
  • the keys obtained in different sessions can be different or the same.
  • the root key can be the access network device in the SMC. The root key obtained during the process.
  • the key used by different sessions can be calculated by using different root keys, for example, indicating the root key used by the session in the fourth message, or transmitting relevant parameters, so that the access network device is based on The root key calculates the key used by the session.
  • the integrity protection configuration corresponding to the session may be placed in the PDU Session Resource Setup List in the fourth message, and used to indicate the integrity protection configuration corresponding to the session, or may be separately placed.
  • the session identifier corresponding to the integrity protection configuration is added, and the access network device learns the integrity protection configuration corresponding to the session through the fourth message, and then learns the integrity protection configuration of the DRB corresponding to the session.
  • Table 1 is a schematic diagram of a structure of a fourth message.
  • Table 2 is a schematic diagram of a PDU session information list
  • Table 3 is a schematic diagram of a PDU Session Setup Request Transfer.
  • Message as shown in Table IV for example, a third generation partnership (3 rd Generation Partnership Project, 3GPP ) next (Next Generation, NG) RAN NG application protocol (NG Application Protocol, NGAP), 0.1.0 protocol version number , 9.2.1.1 chapter PDU session resource establishment request message.
  • 3GPP Third Generation Partnership Project
  • Next Generation, NG Next Generation
  • NGAP Next Generation
  • the PDU session information list in Table 2 is, for example, 3GPP NG RAN NGAP, protocol version number is 0.1.0, 9.3.1.5 chapter PDU session resource establishment list message.
  • Tables 2 and 3 show the two possible locations of the session-matched integrity protection configuration in the fourth message, respectively.
  • the integrity protection configuration corresponding to the session in the second embodiment is carried in the PDU session resource establishment list, and the PDU session resource establishment list includes one or more information elements (IE) of the session resource establishment, wherein each information element protects at least the following A type of information: a session identifier and a single network slice selection assistance information, and the network slice selection assistance information is used to indicate a network slice identifier corresponding to the session.
  • IE information elements
  • the integrity protection configuration corresponding to the session in Table 3 is carried in the PDU session establishment request transmission, and the PDU session establishment request transmission includes at least one of the following information: maximum aggregate bit rate, transport layer information, session type, corresponding to one or more sessions,
  • the QoS flow resource information list and the like, the QoS flow resource information list includes identifiers corresponding to one or more flows, QoS parameters of QoS flow levels, and the like.
  • Step S104 The access network device sends a second message to the terminal device, where the second message includes an identifier of the session, an integrity protection algorithm and a key corresponding to the session, and an identifier of the DRB corresponding to the session.
  • the access network device After receiving the fourth message, the access network device saves the integrity protection algorithm and the key integrity protection configuration corresponding to the session carried in the fourth message. And establishing a DRB for the terminal device according to the configuration parameter of the at least one protocol layer carried in the fourth message, to carry the service initiated by the terminal device. Then, a second message is generated, and the second message is sent to the terminal device, and the second message may be a NAS message, an RRC message, a MAC layer message, or a physical layer message.
  • the second message is an RRC message
  • the RRC message does not include the NAS message
  • the identifier of the session, the integrity protection algorithm and the key corresponding to the session, and the identifier of the DRB corresponding to the session are all carried in the RRC message
  • RRC The message includes the NAS message, and all or part of the above parameters are carried in the NAS message included in the RRC message.
  • the second message includes an integrity protection algorithm and a key corresponding to the session.
  • the second message may not carry the integrity protection algorithm and the key corresponding to the session, and the integrity protection corresponding to the session.
  • the algorithm and the key are carried by other messages, or the integrity protection algorithm and key corresponding to the session are pre-configured.
  • the second message includes at least one of the following: an integrity protection algorithm and a key, an indication of an integrity protection location, an integrity protection protocol layer location indication, an enable indication of an integrity protection location, and An indication of the integrity protection object.
  • one or more of the indication of the integrity protection location, the integrity protection protocol layer location indication, the integrity protection location enable indication, and the integrity protection object indication may also be pre-configured without passing the Two message dynamic indication.
  • the integrity protection configuration carried in the second message and the fourth message may be the same or different.
  • the fourth message indicates the root key used by the session, and after receiving the fourth message, the access network device calculates the key used by the session according to the indicated root key, and then carries the key used by the session. In the second message.
  • the integrity protection configuration of the session may be carried in the configuration parameter of the SDAP layer of the second message, that is, the integrity protection configuration is configured as a configuration parameter of the SDAP layer, and may also be carried in the configuration parameter of the PDCP layer, that is, complete
  • the sexual protection configuration is used as a configuration parameter of the PDCP layer.
  • the second message includes the configuration parameters of the at least one protocol layer, and the configuration parameters of the SDAP layer and the configuration parameters of the PDCP layer may be carried in the second message, or one of the configuration parameters may be carried in the second message, and A configuration parameter is carried in other messages than the second message.
  • RRC connection reconfiguration message which is an RRC connection reconfiguration message
  • RRC connection reconfiguration message for example, the following is the following: 3GPP Evolved Universal Terrestrial Radio Access (E-UTRA) RRC protocol, protocol version number 13.0.0, section 6.2.2 RRC connection reconfiguration message:
  • E-UTRA Evolved Universal Terrestrial Radio Access
  • the possible location 1 of the integrity protection configuration of the session is the configuration parameter of the SDAP layer
  • the possible location 2 of the integrity protection configuration corresponding to the session is the configuration parameter of the PDCP layer.
  • the access network device sends a fifth message to the core network device, where the fifth message is used to feed back the processing result of the fourth message sent by the core network device, if the access network device fails to successfully connect to the terminal.
  • the context of the device is configured, and the fifth message is used to feedback the configuration failure, and includes a failure cause indication, that is, a cause value.
  • the fifth message is also used to carry the air interface resources allocated by the access network device for one or more sessions, for example, including a session information list established by the access network device, a list of QoS flows that cannot be established, and the like.
  • Step S105 The terminal device saves the content in the second message.
  • the terminal device maintains the integrity protection configuration corresponding to the session carried in the second message, and then performs integrity protection on the data of the DRB corresponding to the session according to the integrity protection configuration corresponding to the saved session.
  • the DRB corresponding to the session may be one or Multiple, if the DRB corresponding to the session is multiple, the multiple DRBs corresponding to the session use the same integrity protection configuration.
  • the terminal device uses the integrity protection algorithm corresponding to the session and the key to perform integrity protection on the data of the DRB corresponding to the session.
  • the data of the DRB is: the data packet of the SDAP layer of the DRB or the data packet of the PDCP layer, that is, the terminal device can perform integrity protection on the data of the DRB at the SDAP layer and the PDCP layer.
  • the data packet of the SDAP layer includes a PDU and a Service Data Unit (SDU) service data unit
  • the data packet of the PDCP layer also includes a PDU and an SDU.
  • SDU Service Data Unit
  • the terminal device uses an integrity protection algorithm, such as a key, a COUNT value, a radio bearer identifier, a DIRECTION, a PDCP layer packet itself, and a PDCP layer packet. At least one parameter of the length or the like is used as an input parameter, and a 32-bit MAC-I is calculated and placed in the MAC-I field of the PDCP PDU.
  • the receiving end access network device or core network device
  • the terminal device may also act as a receiving end.
  • the terminal device obtains the integrity algorithm and the key corresponding to the session from the access network device by using the second message, and the terminal device may obtain the integrity algorithm and the key corresponding to the session by using other methods.
  • the integrity algorithm and the key corresponding to the session are pre-configured on the terminal device, and the second message only needs to carry the session identifier, and the terminal device searches for the integrity algorithm and the key corresponding to the session according to the session identifier.
  • one or more of other integrity protection configurations for the session such as an indication of an integrity protection location, an integrity protection protocol layer location indication, an enable indication of an integrity protection location, and an indication of an integrity protection object.
  • the terminal device may be notified by a second message dynamic indication or by a pre-configured manner.
  • the terminal device acquires the integrity protection algorithm and the key corresponding to the session and the DRB corresponding to the session, and uses the integrity protection algorithm and the key corresponding to the session to protect the integrity of the data of the DRB, so that different sessions can be used differently.
  • the integrity protection algorithm and key make the integrity protection more flexible and meet the security needs of different users of the same service.
  • FIG. 4 is a signaling flowchart of a data integrity protection method according to Embodiment 2 of the present application. Different from the first embodiment, the granularity of integrity protection in this embodiment is a flow level. As shown in FIG. 4, this embodiment is shown in FIG. The method mainly includes the following steps:
  • Step S201 The terminal device sends a first message to the access network device.
  • Step S202 The access network device sends a third message to the core network device, where the third message includes the first message.
  • step S201 and step S202 refer to the related description of the first embodiment.
  • Step S203 The core network device sends a fourth message to the access network device, where the fourth message includes an integrity protection algorithm corresponding to the flow and a key and a DRB corresponding to the flow.
  • the fourth message includes a stream corresponding integrity protection algorithm and a key and a DRB corresponding to the stream, where the stream corresponds to the session established by the first message request, and one session includes multiple A stream, each of which can be mapped to multiple DRBs.
  • multiple streams included in the session may use the same or different integrity protection algorithms and keys.
  • the fourth message may not carry the integrity protection algorithm and the key corresponding to the flow, and the integrity protection algorithm and the key corresponding to the flow are carried by other messages, or the integrity protection algorithm and the key corresponding to the flow.
  • the fourth message may further include at least one of the following information: an indication of the integrity protection location, an integrity protection protocol layer location indication, an enable indication of the integrity protection location, and an indication of the integrity protection object.
  • the indication of the integrity protection location, the integrity protection protocol layer location indication, the integrity protection location enable indication, and the integrity protection object indication may also be pre-configured without passing the Four message dynamic indications.
  • the flow integrity protection configuration may be placed in the QoS flow resource information list in the fourth message, and used to indicate the integrity protection configuration corresponding to the flow, or may be separately placed in the fourth message and added.
  • the flow identifier corresponding to the integrity protection configuration is, for example, placed in the PDU session resource information list, and the access network device learns the integrity protection configuration of the flow through the fourth message.
  • the PDU session information list refers to Table 2 above.
  • Table 4 is a schematic diagram of the QoS flow resource information list.
  • the integrity protection configuration corresponding to the flow is carried in the QoS flow resource information list, and the QoS flow resource information list further includes identifiers corresponding to one or more flows, QoS parameters of the QoS flow level, and the like.
  • Step S204 The access network device sends a second message to the terminal device, where the second message includes an identifier of the session, an identifier of the flow, an integrity protection algorithm and a key corresponding to the flow, and an identifier of the DRB corresponding to the flow.
  • the access network device After receiving the fourth message, the access network device saves the identifier of the session carried in the fourth message, the identifier of the flow, the integrity protection algorithm and the key corresponding to the flow, and the identifier of the DRB corresponding to the flow. And establishing a DRB for the terminal device according to the configuration parameter of the at least one protocol layer carried in the fourth message, to carry the service initiated by the terminal device, and determining the DRB corresponding to each flow. Then, a second message is generated, and the second message is sent to the terminal device, and the second message may be a NAS message, an RRC message, a MAC layer message, or a physical layer message.
  • the second message is an RRC message
  • the RRC message does not include the NAS message
  • the identifier of the session, the identifier of the flow, the integrity protection algorithm and the key corresponding to the flow, and the identifier of the DRB corresponding to the flow are all carried in the RRC message.
  • the RRC message includes the NAS message, all or part of the above parameters are carried in the NAS message included in the RRC message.
  • the second message includes an integrity protection algorithm and a key corresponding to the flow.
  • the second message may not carry the integrity protection algorithm and the key corresponding to the flow, and the integrity protection corresponding to the flow
  • the algorithm and key are carried by other messages, or the integrity protection algorithm and key corresponding to the stream are pre-configured.
  • the second message includes at least one of the following: an integrity protection algorithm and a key, an indication of an integrity protection location, an integrity protection protocol layer location indication, an enable indication of an integrity protection location, and An indication of the integrity protection object.
  • one or more of the indication of the integrity protection location, the integrity protection protocol layer location indication, the integrity protection location enable indication, and the integrity protection object indication may also be pre-configured without passing the Two message dynamic indication.
  • the integrity protection configurations corresponding to the flows carried in the second message and the fourth message may be the same or different.
  • the root key used by the flow is indicated, and after receiving the fourth message, the access network device calculates the key used by the flow according to the indicated root key, and then carries the key used by the flow. In the second message.
  • the integrity protection configuration corresponding to the flow may be carried in the configuration parameter of the SDAP layer of the second message, that is, the integrity protection configuration corresponding to the flow is used as the configuration parameter of the SDAP layer, and may also be carried in the configuration parameter of the PDCP layer.
  • the integrity protection configuration corresponding to the flow is used as the configuration parameter of the PDCP layer.
  • the second message includes the configuration parameters of the at least one protocol layer, and the configuration parameters of the SDAP layer and the configuration parameters of the PDCP layer may be carried in the second message, or one of the configuration parameters may be carried in the second message, and A configuration parameter is carried in other messages than the second message.
  • the access network device sends a fifth message to the core network device, where the fifth message is used to feed back the processing result of the fourth message sent by the core network device, if the access network device fails to successfully connect to the terminal.
  • the context of the device is configured, and the fifth message is used to feedback the configuration failure, and includes a failure cause indication, that is, a cause value.
  • the fifth message is also used to carry the air interface resources allocated by the access network device for one or more sessions, for example, including a session information list established by the access network device, a list of QoS flows that cannot be established, and the like.
  • Step S205 The terminal device saves the content in the second message.
  • the terminal device saves the integrity protection configuration corresponding to the flow carried in the second message, and then performs integrity protection on the data corresponding to the DRB according to the integrity protection configuration corresponding to the saved flow, and the DRB corresponding to the flow may be one or more
  • the integrity protection algorithm and key corresponding to different streams may be different.
  • the terminal device uses the integrity protection algorithm corresponding to the flow and the data of the DRB corresponding to the key pair to perform integrity protection.
  • the data of the DRB is: the data packet of the SDAP layer of the DRB or the data packet of the PDCP layer, that is, the terminal device can perform integrity protection on the data of the DRB at the SDAP layer and the PDCP layer.
  • the data packets of the SDAP layer include PDUs and SDUs
  • the data packets of the PDCP layer also include PDUs and SDUs.
  • the SDAP layer needs to mark the flow identifier in the data packet of the SDAP layer, so that the PDCP layer can identify the flow according to the flow. Identify different flows, and then perform integrity protection according to the integrity protection algorithm corresponding to the flow and the data packet corresponding to the key pair.
  • the identifier of the stream may be placed in the header of the data packet of the SDAP layer, or may be placed in the specific data content of the data packet of the SDAP layer. The invention does not limit the specific format.
  • the terminal device obtains the integrity algorithm and the key corresponding to the flow from the access network device by using the second message, and the terminal device may obtain the integrity algorithm and the key corresponding to the flow by using other methods.
  • the integrity algorithm and the key corresponding to the flow are pre-configured on the terminal device, and the second message only needs to carry the session identifier and the flow identifier, and the terminal device searches for the integrity algorithm corresponding to the flow according to the session identifier and the flow identifier. Key.
  • one or more of the other integrity protection configurations for the flow such as an indication of the integrity protection location, an integrity protection protocol layer location indication, an enable indication of the integrity protection location, and an indication of the integrity protection object.
  • the terminal device may be notified by a second message dynamic indication or by a pre-configured manner.
  • the terminal device acquires the integrity protection algorithm corresponding to the flow and the DRB corresponding to the stream, and uses the integrity protection algorithm corresponding to the flow and the DRB data corresponding to the key to perform integrity protection, so that different flows can be Different integrity protection algorithms and keys are used to make integrity protection more flexible and meet the security needs of different users of different services.
  • the data integrity protection of the transmitting end may be the same as the receiving end after any part of the sequence number, header compression, encryption, and the like.
  • the location and size of the MAC-I can also be flexibly set.
  • Figure 5 is a schematic diagram of the MAC-I when the PDCP layer performs integrity protection. As shown in Figure 5, the MAC-I can carry the last few words of the message. Section.
  • the receiving end performs integrity check. If a message integrity check fails, any one of the following processes may be performed: (1) notifying the RRC, reestablishing the RRC connection; and (2) discarding The message; (3) discarding the message and reestablishing the RRC connection; (4) reestablishing the RRC connection when the number of integrity check failures reaches a preset value.
  • the method of the foregoing embodiment may be applied to a dual connection (DC) scenario or a cell handover scenario.
  • a cell handover scenario if the terminal device switches from the source base station to the target base station, the terminal device needs to complete the integrity protection corresponding to the session.
  • the integrity protection configuration corresponding to the configuration or the flow is sent to the target base station, so that the target base station performs integrity protection according to the integrity protection configuration corresponding to the session or the integrity protection configuration corresponding to the flow.
  • integrity protection can be performed on only one of the sites, or integrity protection can be performed on both sites.
  • the master node (MN) needs to send the integrity protection configuration corresponding to the session or flow to the A secondary node (SN), so that the secondary site can perform integrity protection according to the integrity protection configuration corresponding to the session or the integrity protection configuration corresponding to the flow.
  • Figure 6 is a schematic structural diagram of a terminal device according to Embodiment 3 of the present application. As shown in Figure 6, the terminal device provided in this embodiment includes:
  • the obtaining module 11 is configured to acquire an integrity protection algorithm and a key corresponding to the session, and a wireless data bearer DRB corresponding to the session;
  • the integrity protection module 12 is configured to perform integrity protection on the data of the DRB by using the integrity protection algorithm and a key.
  • the obtaining module 11 is specifically configured to: send a first message, where the first message is used to request to establish the session, and receive a second message, where the second message includes an identifier of the session, where The integrity protection algorithm and key corresponding to the session, and the identifier of the DRB corresponding to the session.
  • the second message includes a configuration of a SDAP layer, where the configuration of the SDAP layer includes an identifier of the session, an integrity protection algorithm and a key corresponding to the session, and an identifier of the DRB corresponding to the session.
  • the second message includes a configuration of a PDCP layer, where the configuration of the PDCP layer includes an identifier of the session, an integrity protection algorithm and a key corresponding to the session, and an identifier of the DRB corresponding to the session.
  • the obtaining module 11 is further configured to: acquire at least one of the following information:
  • An indication of an integrity protection location an integrity protection protocol layer location indication, an enable indication of an integrity protection location, and an indication of an integrity protection object
  • the indication of the integrity protection location is used to indicate a network element that performs integrity protection
  • the integrity protection protocol layer location indication is used to indicate a protocol layer for integrity protection
  • the enable indication of the integrity protection location indicates a function for indicating whether integrity protection is turned on
  • the indication of the integrity protection object is used to indicate that the object of integrity protection is user plane data, or user plane data and control plane signaling.
  • the data of the DRB is: a data packet of a SDAP layer of the DRB; or a data packet of a PDCP layer of the DRB.
  • the terminal device further includes: a marking module, configured to mark the identifier of the stream in a data packet of the SDAP layer of the DRB.
  • the terminal device provided in this embodiment may be used to perform the steps performed by the terminal device in the first embodiment.
  • the specific implementation manners and technical effects are similar, and details are not described herein again.
  • a fourth embodiment of the present application provides a terminal device, and the structure of the terminal device is shown in FIG. 6.
  • the obtaining module 11 is configured to acquire an integrity protection algorithm and a key corresponding to the stream, and a radio data bearer DRB corresponding to the stream
  • the integrity protection module 12 is configured to use the integrity protection algorithm and The key performs integrity protection on the data of the DRB.
  • the obtaining module 11 is specifically configured to: send a first message, where the first message is used to request to establish a session, the session corresponds to the flow, and the second message is received, where the second message includes The identifier of the session, the identifier of the stream, the identifier of the DRB corresponding to the stream, and an integrity protection algorithm and a key corresponding to the stream.
  • the second message includes a configuration of a SDAP layer, where the configuration of the SDAP layer includes an identifier of the session, an identifier of the flow, an identifier of a DRB corresponding to the flow, and a complete correspondence of the flow
  • the configuration of the PDCP layer includes an identifier of the session, an identifier of the flow, an identifier of the DRB corresponding to the flow, and a The corresponding integrity protection algorithm and key are described.
  • the obtaining module 11 is further configured to: acquire at least one of the following information:
  • An indication of an integrity protection location an integrity protection protocol layer location indication, an enable indication of an integrity protection location, and an indication of an integrity protection object
  • the indication of the integrity protection location is used to indicate a network element that performs integrity protection
  • the integrity protection protocol layer location indication is used to indicate a protocol layer for integrity protection
  • the enable indication of the integrity protection location indicates a function for indicating whether integrity protection is turned on
  • the indication of the integrity protection object is used to indicate that the object of integrity protection is user plane data, or user plane data and control plane signaling.
  • the data of the DRB is: a data packet of a SDAP layer of the DRB; or a data packet of a PDCP layer of the DRB.
  • the terminal device further includes: a marking module, configured to mark the identifier of the stream in a data packet of the SDAP layer of the DRB.
  • the terminal device provided in this embodiment may be used to perform the steps performed by the terminal device in the second embodiment, and the specific implementation manners and technical effects are similar, and details are not described herein again.
  • FIG. 7 is a schematic structural diagram of an access network device according to Embodiment 5 of the present application. As shown in FIG. 7, the access network device provided in this embodiment includes:
  • the receiving module 21 is configured to receive a first message sent by the terminal device, where the first message is used to request to establish a session;
  • the sending module 22 is configured to send a third message to the core network device, where the third message includes the first message;
  • the receiving module 21 is further configured to receive a fourth message sent by the core network device, where the fourth message includes an integrity protection algorithm and a key corresponding to the session, and a wireless data bearer DRB corresponding to the session. ;
  • a storage module 23 configured to save an integrity protection algorithm and a key corresponding to the session, and a DRB corresponding to the session;
  • the sending module 23 is further configured to send a second message to the terminal device, where the second message includes an identifier of the session, an integrity protection algorithm and a key corresponding to the session, and a corresponding session The ID of the DRB.
  • the second message includes a configuration of a SDAP layer, where the configuration of the SDAP layer includes an identifier of the session, an integrity protection algorithm and a key corresponding to the session, and an identifier of the DRB corresponding to the session.
  • the second message includes a configuration of a PDCP layer, where the configuration of the PDCP layer includes an identifier of the session, an integrity protection algorithm and a key corresponding to the session, and an identifier of the DRB corresponding to the session.
  • the third message or the second message further includes at least one of the following information:
  • An indication of an integrity protection location an integrity protection protocol layer location indication, an enable indication of an integrity protection location, and an indication of an integrity protection object
  • the indication of the integrity protection location is used to indicate a network element that performs integrity protection
  • the integrity protection protocol layer location indication is used to indicate a protocol layer for integrity protection
  • the enable indication of the integrity protection location indicates a function for indicating whether integrity protection is turned on
  • the indication of the integrity protection object is used to indicate that the object of integrity protection is user plane data, or user plane data and control plane signaling.
  • the access network device further includes: an integrity protection module 24, configured to perform integrity protection on the data of the DRB by using the integrity protection algorithm and a key.
  • an integrity protection module 24 configured to perform integrity protection on the data of the DRB by using the integrity protection algorithm and a key.
  • the data of the DRB is: a data packet of a SDAP layer of the DRB; or a data packet of a PDCP layer of the DRB.
  • the access network device When the data of the DRB is a data packet of the SDAP layer of the DRB, the access network device further includes: a marking module, configured to mark an identifier of the flow in a data packet of a SDAP layer of the DRB.
  • Embodiment 6 of the present application provides an access network device, and the structure of the access network device is shown in FIG. 7.
  • FIG. 7 In this embodiment:
  • the receiving module 21 is configured to receive a first message sent by the terminal device, where the first message is used to request to establish a session;
  • the sending module 22 is configured to send the third message to the core network device, where the third message includes the first message;
  • the receiving module 21 is further configured to receive a fourth message sent by the core network device, where the fourth message includes an integrity protection algorithm and a key corresponding to the stream, and a wireless data bearer DRB corresponding to the stream.
  • the session corresponds to the stream;
  • a storage module 23 configured to save an integrity protection algorithm and a key corresponding to the stream, and a DRB corresponding to the stream;
  • the sending module 22 is further configured to send a second message to the terminal device, where the second message includes: an identifier of the session, an identifier of the stream, an identifier of a DRB corresponding to the stream, and the The integrity protection algorithm and key corresponding to the flow.
  • the second message includes a configuration of a SDAP layer, where the configuration of the SDAP layer includes an identifier of the session, an identifier of the flow, an identifier of a DRB corresponding to the flow, and a complete correspondence of the flow
  • the configuration of the PDCP layer includes an identifier of the session, an identifier of the flow, an identifier of the DRB corresponding to the flow, and a The corresponding integrity protection algorithm and key are described.
  • the third message or the second message further includes at least one of the following information:
  • An indication of an integrity protection location an integrity protection protocol layer location indication, an enable indication of an integrity protection location, and an indication of an integrity protection object
  • the indication of the integrity protection location is used to indicate a network element that performs integrity protection
  • the integrity protection protocol layer location indication is used to indicate a protocol layer for integrity protection
  • the enable indication of the integrity protection location indicates a function for indicating whether integrity protection is turned on
  • the indication of the integrity protection object is used to indicate that the object of integrity protection is user plane data, or user plane data and control plane signaling.
  • the integrity protection module 24 is configured to perform integrity protection on the data of the DRB by using the integrity protection algorithm and a key.
  • the data of the DRB is: a data packet of a SDAP layer of the DRB; or a data packet of a PDCP layer of the DRB.
  • the access network device When the data of the DRB is a data packet of the SDAP layer of the DRB, the access network device further includes: a marking module, configured to mark an identifier of the flow in a data packet of a SDAP layer of the DRB.
  • FIG. 8 is a schematic structural diagram of a core network device according to Embodiment 7 of the present application. As shown in FIG. 8 , the core network device provided in this embodiment includes:
  • the receiving module 31 is configured to receive a third message sent by the access network device, where the third message includes a first message, where the first message is used to request to establish a session;
  • the sending module 32 is configured to send a fourth message to the access network device, where the third message includes an integrity protection algorithm and a key corresponding to the session, and a wireless data bearer DRB corresponding to the session, or includes The stream corresponds to an integrity protection algorithm and a key and a DRB corresponding to the stream, the session corresponding to the stream.
  • the fourth message further includes at least one of the following information:
  • An indication of an integrity protection location an integrity protection protocol layer location indication, an enable indication of an integrity protection location, and an indication of an integrity protection object
  • the indication of the integrity protection location is used to indicate a network element that performs integrity protection
  • the integrity protection protocol layer location indication is used to indicate a protocol layer for integrity protection
  • the enable indication of the integrity protection location indicates a function for indicating whether integrity protection is turned on
  • the indication of the integrity protection object is used to indicate that the object of integrity protection is user plane data, or user plane data and control plane signaling.
  • the core network device further includes: an integrity protection module 33, configured to perform integrity protection on the data of the DRB by using the integrity protection algorithm and a key.
  • an integrity protection module 33 configured to perform integrity protection on the data of the DRB by using the integrity protection algorithm and a key.
  • the data of the DRB is: a data packet of a SDAP layer of the DRB; or a data packet of a PDCP layer of the DRB.
  • the core network device When the data of the DRB is a data packet of the SDAP layer of the DRB, the core network device further includes: a marking module, configured to mark an identifier of the flow in a data packet of a SDAP layer of the DRB.
  • the receiving module and the sending module may be implemented by one transceiver, or the receiving module is implemented by an independent receiver, and the sending module is implemented by an independent receiver.
  • the acquisition module, the integrity protection module, and the marking module in the above embodiments may be implemented by a processor having a data processing function.
  • FIG. 9 is a schematic structural diagram of a terminal device according to Embodiment 8 of the present application.
  • the terminal device 400 of this embodiment includes: a processor 41, a memory 42, a receiver 43, and a transmitter 44, and the memory 42
  • the receiver 43 and the transmitter 44 are connected and communicated to the processor 41 via a bus
  • the memory 42 is for storing computer execution instructions
  • the processor 41 is configured to execute the computer to execute instructions to cause the terminal
  • the device 400 performs the steps performed by the terminal device in the methods provided in the first embodiment and the second embodiment. The specific implementation and technical effects are similar, and are not described here.
  • the access network device 500 of the present embodiment includes: a processor 51, a memory 52, a receiver 53, and a transmitter 54,
  • the memory 52, the receiver 53 and the transmitter 54 are connected and communicated with the processor 51 via a bus
  • the memory 52 is for storing computer execution instructions
  • the processor 51 is configured to execute the computer to execute instructions to
  • the access network device 500 is configured to perform the steps performed by the access network device in the methods provided in the foregoing Embodiment 1 and Embodiment 2.
  • the specific implementation and technical effects are similar, and are not described here.
  • the core network device 600 of this embodiment includes: a processor 61, a memory 62, a receiver 63, and a transmitter 64.
  • the memory 62, the receiver 63 and the transmitter 64 are connected and communicated to the processor 61 via a bus, the memory 62 is for storing computer execution instructions, and the processor 61 is configured to execute the computer to execute instructions to
  • the core network device 600 performs the steps performed by the core network device in the methods provided in the foregoing Embodiment 1 and Embodiment 2. The specific implementation and technical effects are similar, and are not described here.
  • the tenth embodiment of the present application provides a computer readable medium, the computer readable medium includes instructions for executing, by the terminal device, the method performed by the terminal device in the first embodiment and the second embodiment of the present application. step.
  • the embodiment 11 of the present application provides a computer readable medium, the computer readable medium includes instructions for causing an access network device to perform access in Embodiment 1 and Embodiment 2 of the present application. Method steps performed by the network device.
  • the embodiment 12 of the present application provides a computer readable medium, where the computer readable medium includes instructions for causing a core network device to execute a core network device in Embodiment 1 and Embodiment 2 of the present application. Method steps performed.
  • Embodiment 13 of the present application provides a system on chip, the system is applicable to a terminal device, where the system on chip includes: at least one communication interface, at least one processor, at least one memory, the communication interface, the memory, and The processor is interconnected by a bus, and the processor invokes the instructions stored in the memory to perform the method steps performed by the terminal device in the first embodiment and the second embodiment of the present application.
  • Embodiment 14 of the present application provides a system on chip, the system is applicable to an access network device, where the system on chip includes: at least one communication interface, at least one processor, at least one memory, the communication interface, The memory and the processor are interconnected by a bus, and the processor invokes the instructions stored in the memory to perform the method steps performed by the access network device in the first embodiment and the second embodiment of the present application.
  • Embodiment 15 of the present application provides a system on chip, the system is applicable to a core network device, where the system on chip includes: at least one communication interface, at least one processor, at least one memory, the communication interface, and a memory. And the processor is interconnected by a bus, and the processor invokes the instructions stored in the memory to perform the method provided by the core network device in Embodiment 1 and Embodiment 2 of the present application.
  • Embodiment 16 of the present application provides a program product, the program product comprising a computer program, the computer program being stored in a readable storage medium, the at least one processor of the terminal device executing the computer program to cause the terminal device to implement The method steps performed by the terminal device in Embodiment 1 and Embodiment 2 of the present application.
  • Embodiment 17 of the present application provides a program product, the program product comprising a computer program, the computer program being stored in a readable storage medium, the at least one processor of the access network device executing the computer program to cause the connection
  • the network access device implements the method steps performed by the access network device in the first embodiment and the second embodiment of the present application.
  • Embodiment 18 of the present application provides a program product, the program product comprising a computer program, the computer program being stored in a readable storage medium, the at least one processor of the core network device executing the computer program to cause the core network
  • the device implements the method steps performed by the core network device in Embodiment 1 and Embodiment 2 of the present application.
  • the processor described in the present application may be a central processing unit (CPU), a general purpose processor, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable.
  • Logic device transistor logic device, hardware component, or any combination thereof. It can be implemented or executed in connection with the various exemplary logical blocks, modules and circuits described herein.
  • the processor may also be a combination of computing functions, for example, including one or more microprocessor combinations, a combination of a DSP and a microprocessor, and the like.
  • the bus described in this application may be an Industry Standard Architecture (ISA) bus, a Peripheral Component (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus.
  • ISA Industry Standard Architecture
  • PCI Peripheral Component
  • EISA Extended Industry Standard Architecture
  • the bus can be divided into an address bus, a data bus, a control bus, and the like.
  • the bus in the drawings of the present application is not limited to only one bus or one type of bus.
  • the described device embodiments are only schematic.
  • the division of the modules is only a logical function division, and the actual implementation may have another division manner.
  • multiple modules or components may be combined or integrated into another system, or some features may be omitted or not implemented.
  • the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or module, and may be electrical, mechanical or otherwise.
  • the units described as separate components may or may not be physically separate, ie may be located in one place, or may be distributed over multiple network elements. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Databases & Information Systems (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本申请提供一种数据完整性保护方法和装置，终端设备获取会话对应的完整性保护算法和密钥以及会话对应的DRB，使用会话对应的完整性保护算法和密钥对会话对应的DRB的数据进行完整性保护，或者，终端设备获取流对应的完整性保护算法和密钥以及流对应的DRB，使用流对应的完整性保护算法和密钥对流对应的DRB的数据进行完整性保护，一个会话包括多个流，不同会话可以使用不同的完整性保护算法和密钥，不同流也可以使用不同的完整性保护算法和密钥，从而使得完整性保护更加灵活，满足同一用户不同业务的安全需求。

Description

数据完整性保护方法和装置
本申请要求于2017年8月11日提交中国专利局、申请号为201710686855.8、申请名称为“数据完整性保护方法和装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信技术，尤其涉及一种数据完整性保护方法和装置。
背景技术
随着通信技术的快速发展，移动通信***的信息安全问题受到越来越多的关注，以长期演进(Long Term Evolution，LTE)***为例，LTE***中的完整性保护功能(Integrity Protection)的目的是防止用户数据被篡改，一旦接收端发现完整性校验失败，可以触发加解密密钥(Key)的更新过程，使用新密钥对用户数据进行保护。
完整性保护功能包含完整性保护以及完整性校验，LTE的完整性保护功能位于分组数据汇聚协议(Packet Data Convergence Protocol，PDCP)层，发送端在加密之前对PDCP协议数据单元(Protocol Data Unit，PDU)的头部(header)以及数据部分进行完整性保护。具体的，发送端使用上层协议层配置的完整性保护算法，以密钥、COUNT值、无线承载标识、DIRECTION、消息本身以及消息的长度等中的至少一个参数作为输入参数，计算一个32bit的消息验证码(Message Authentication Code for Integrity，MAC-I)，放入PDCP PDU的MAC-I域。接收端在收到消息后，以同样的方法计算该消息所期望的验证码XMAC-I，并通过比较XMAC-I和MAC-I进行完整性校验。如果MAC-I与XMAC-I相等，则接收端确定完整性校验成功，否则确定完整性校验失败。
但是，LTE***中完整性保护功能的粒度是终端设备级别的，即终端设备对于所有数据使用相同的完整性保护参数，使得完整性保护不灵活。
发明内容
本申请提供一种数据完整性保护方法和装置，可以进行会话粒度或者流粒度的完整性保护，从而使得完整性保护更加灵活，满足同一用户不同业务的安全需求。
本申请第一方面提供一种数据完整性保护方法，包括：终端设备获取会话对应的完整性保护算法和密钥以及所述会话对应的DRB，使用所述完整性保护算法和密钥对所述DRB的数据进行完整性保护。不同会话可以使用不同的完整性保护算法和密钥，从而使得完整性保护更加灵活，满足同一用户不同业务的安全需求。
可选的，所述终端设备获取会话对应的完整性保护算法和密钥，以及所述会话对应的DRB，具体为：所述终端设备发送第一消息，所述第一消息用于请求建立所述会话；所述终端设备接收第二消息，所述第二消息包括所述会话的标识，所述会话对应 的完整性保护算法和密钥，以及所述会话对应的DRB的标识。
可选的，所述第二消息包括SDAP层的配置，所述SDAP层的配置包括所述会话的标识，所述会话对应的完整性保护算法和密钥，以及所述会话对应的DRB的标识；或者，
所述第二消息包括PDCP层的配置，所述PDCP层的配置包括所述会话的标识，所述会话对应的完整性保护算法和密钥，以及所述会话对应的DRB的标识。
本申请第二方面提供一种数据完整性保护方法，包括：终端设备获取流对应的完整性保护算法和密钥、以及所述流对应的DRB，使用所述完整性保护算法和密钥对所述DRB的数据进行完整性保护。不同流也可以使用不同的完整性保护算法和密钥，从而使得完整性保护更加灵活，满足同一用户不同业务的安全需求。
可选的，所述终端设备获取流对应的完整性保护算法和密钥、以及所述流对应的无线数据承载DRB，具体为：所述终端设备发送第一消息，所述第一消息用于请求建立会话，所述会话与所述流对应；所述终端设备接收第二消息，所述第二消息包括：所述会话的标识，所述流的标识，所述流对应的DRB的标识，以及所述流对应的完整性保护算法和密钥。
可选的，所述第二消息包括SDAP层的配置，所述SDAP层的配置包括所述会话的标识，所述流的标识，所述流对应的DRB的标识，以及所述流对应的完整性保护算法和密钥；或者，
所述第二消息包括PDCP层的配置，所述PDCP层的配置包括所述会话的标识，所述流的标识，所述流对应的DRB的标识，以及所述流对应的完整性保护算法和密钥。
可选的，在本申请第一方面和第二方面中，所述方法还包括：所述终端设备获取以下信息中的至少一个：
完整性保护位置的指示、完整性保护协议层位置指示、完整性保护位置的使能指示和完整性保护对象的指示；
其中，
所述完整性保护位置的指示用于指示进行完整性保护的网元；
所述完整性保护协议层位置指示用于指示进行完整性保护的协议层；
所述完整性保护位置的使能指示用于指示是否开启完整性保护的功能；
所述完整性保护对象的指示用于指示完整性保护的对象为用户面数据，或者，用户面数据和控制面信令。
可选的，在本申请第一方面和第二方面中，所述DRB的数据为：所述DRB的SDAP层的数据包；或者，所述DRB的PDCP层的数据包。
当所述DRB的数据为所述DRB的SDAP层的数据包时，还包括：所述终端设备在所述DRB的SDAP层的数据包中标记所述流的标识。
本申请第三方面提供一种数据完整性保护方法，包括：接入网设备接收终端设备发送的第一消息，所述第一消息用于请求建立会话；所述接入网设备向核心网设备发送第三消息，所述第三消息包括所述第一消息；所述接入网设备接收所述核心网设备发送的第四消息，所述第四消息中包括所述会话对应的完整性保护算法和密钥以及所述会话对应的DRB；所述接入网设备保存所述会话对应的完整性保护算法和密钥以及 所述会话对应的DRB；所述接入网设备向所述终端设备发送第二消息，所述第二消息包括所述会话的标识，所述会话对应的完整性保护算法和密钥，以及所述会话对应的DRB的标识。
可选的，所述第二消息包括SDAP层的配置，所述SDAP层的配置包括所述会话的标识，所述会话对应的完整性保护算法和密钥，以及所述会话对应的DRB的标识；或者，所述第二消息包括PDCP层的配置，所述PDCP层的配置包括所述会话的标识，所述会话对应的完整性保护算法和密钥，以及所述会话对应的DRB的标识。
本申请第四方面提供一种数据完整性保护方法，包括：接入网设备接收终端设备发送的第一消息，所述第一消息用于请求建立会话；所述接入网设备向核心网设备发送所述第三消息，所述第三消息包括所述第一消息；所述接入网设备接收所述核心网设备发送的第四消息，所述第四消息中包括流对应的完整性保护算法和密钥以及所述流对应的无线数据承载DRB，所述会话与所述流对应；所述接入网设备保存所述流对应的完整性保护算法和密钥以及所述流对应的DRB；所述接入网设备向所述终端设备发送第二消息，所述第二消息包括：所述会话的标识，所述流的标识，所述流对应的DRB的标识，以及所述流对应的完整性保护算法和密钥。
可选的，所述第二消息包括SDAP层的配置，所述SDAP层的配置包括所述会话的标识，所述流的标识，所述流对应的DRB的标识，以及所述流对应的完整性保护算法和密钥；或者，所述第二消息包括PDCP层的配置，所述PDCP层的配置包括所述会话的标识，所述流的标识，所述流对应的DRB的标识，以及所述流对应的完整性保护算法和密钥。
可选的，在本申请第三方面和第四方面中，所述第三消息或所述第二消息中还包括以下信息中的至少一个：
完整性保护位置的指示、完整性保护协议层位置指示、完整性保护位置的使能指示、和完整性保护对象的指示；
其中，
所述完整性保护位置的指示用于指示进行完整性保护的网元；
所述完整性保护协议层位置指示用于指示进行完整性保护的协议层；
所述完整性保护位置的使能指示用于指示是否开启完整性保护的功能；
所述完整性保护对象的指示用于指示完整性保护的对象为用户面数据，或者，用户面数据和控制面信令。
可选的，在本申请第三方面和第四方面中，所述方法还包括：所述接入网设备使用所述完整性保护算法和密钥对所述DRB的数据进行完整性保护。
可选的，在本申请第三方面和第四方面中，所述DRB的数据为：所述DRB的SDAP层的数据包；或者，所述DRB的PDCP层的数据包。
当所述DRB的数据为所述DRB的SDAP层的数据包时，还包括：所述接入网设备在所述DRB的SDAP层的数据包中标记所述流的标识。
本申请第五方面提供一种数据完整性保护方法，包括：核心网设备接收接入网设备发送的第三消息，所述第三消息包括第一消息，所述第一消息用于请求建立会话；所述核心网设备向所述接入网设备发送第四消息，所述第三消息中包括所述会话对应 的完整性保护算法和密钥以及所述会话对应的无线数据承载DRB，或者包括流对应的完整性保护算法和密钥以及所述流对应的DRB，所述会话与所述流对应。
可选的，所述第四消息还包括以下信息中的至少一个：
完整性保护位置的指示、完整性保护协议层位置指示、完整性保护位置的使能指示、和完整性保护对象的指示；
其中，
所述完整性保护位置的指示用于指示进行完整性保护的网元；
所述完整性保护协议层位置指示用于指示进行完整性保护的协议层；
所述完整性保护位置的使能指示用于指示是否开启完整性保护的功能；
所述完整性保护对象的指示用于指示完整性保护的对象为用户面数据，或者，用户面数据和控制面信令。
可选的，所述方法还包括：所述核心网设备使用所述完整性保护算法和密钥对所述DRB的数据进行完整性保护。
可选的，所述DRB的数据为：所述DRB的SDAP层的数据包；或者所述DRB的PDCP层的数据包。
当所述DRB的数据为所述DRB的SDAP层的数据包时，还包括：所述核心网设备在所述DRB的SDAP层的数据包中标记所述流的标识。
本申请第六方面提供一种终端设备，包括：获取模块，用于获取会话对应的完整性保护算法和密钥以及所述会话对应的无线数据承载DRB；完整性保护模块，用于使用所述完整性保护算法和密钥对所述DRB的数据进行完整性保护。
可选的，所述获取模块，具体用于：发送第一消息，所述第一消息用于请求建立所述会话；接收第二消息，所述第二消息包括所述会话的标识，所述会话对应的完整性保护算法和密钥，以及所述会话对应的DRB的标识。
可选的，所述第二消息包括SDAP层的配置，所述SDAP层的配置包括所述会话的标识，所述会话对应的完整性保护算法和密钥，以及所述会话对应的DRB的标识；或者，所述第二消息包括PDCP层的配置，所述PDCP层的配置包括所述会话的标识，所述会话对应的完整性保护算法和密钥，以及所述会话对应的DRB的标识。
本申请第七方面提供一种终端设备，包括：获取模块，用于获取流对应的完整性保护算法和密钥、以及所述流对应的无线数据承载DRB；完整性保护模块，用于使用所述完整性保护算法和密钥对所述DRB的数据进行完整性保护。
可选的，所述获取模块，具体用于：发送第一消息，所述第一消息用于请求建立会话，所述会话与所述流对应；接收第二消息，所述第二消息包括：所述会话的标识，所述流的标识，所述流对应的DRB的标识，以及所述流对应的完整性保护算法和密钥。
可选的，所述第二消息包括SDAP层的配置，所述SDAP层的配置包括所述会话的标识，所述流的标识，所述流对应的DRB的标识，以及所述流对应的完整性保护算法和密钥；或者，所述第二消息包括PDCP层的配置，所述PDCP层的配置包括所述会话的标识，所述流的标识，所述流对应的DRB的标识，以及所述流对应的完整性保护算法和密钥。
可选的，在本申请第六方面和第七方面中，所述获取模块还用于：获取以下信息 中的至少一个：
完整性保护位置的指示、完整性保护协议层位置指示、完整性保护位置的使能指示和完整性保护对象的指示；
其中，
所述完整性保护位置的指示用于指示进行完整性保护的网元；
所述完整性保护协议层位置指示用于指示进行完整性保护的协议层；
所述完整性保护位置的使能指示用于指示是否开启完整性保护的功能；
所述完整性保护对象的指示用于指示完整性保护的对象为用户面数据，或者，用户面数据和控制面信令。
可选的，在本申请第六方面和第七方面中，所述DRB的数据为：所述DRB的SDAP层的数据包；或者所述DRB的PDCP层的数据包。
当所述DRB的数据为所述DRB的SDAP层的数据包时，还包括：标记模块，用于在所述DRB的SDAP层的数据包中标记所述流的标识。
本申请第八方面提供一种接入网设备，包括：
接收模块，用于接收终端设备发送的第一消息，所述第一消息用于请求建立会话；
发送模块，用于向核心网设备发送第三消息，所述第三消息包括所述第一消息；
所述接收模块，还用于接收所述核心网设备发送的第四消息，所述第四消息中包括所述会话对应的完整性保护算法和密钥以及所述会话对应的无线数据承载DRB；
存储模块，用于保存所述会话对应的完整性保护算法和密钥以及所述会话对应的DRB；
所述发送模块，还用于向所述终端设备发送第二消息，所述第二消息包括所述会话的标识，所述会话对应的完整性保护算法和密钥，以及所述会话对应的DRB的标识。
可选的，所述第二消息包括SDAP层的配置，所述SDAP层的配置包括所述会话的标识，所述会话对应的完整性保护算法和密钥，以及所述会话对应的DRB的标识；或者，所述第二消息包括PDCP层的配置，所述PDCP层的配置包括所述会话的标识，所述会话对应的完整性保护算法和密钥，以及所述会话对应的DRB的标识。
本申请第九方面提供一种接入网设备，包括：
接收模块，用于接收终端设备发送的第一消息，所述第一消息用于请求建立会话；
发送模块，用于向核心网设备发送所述第三消息，所述第三消息包括所述第一消息；
所述接收模块，还用于接收所述核心网设备发送的第四消息，所述第四消息中包括流对应的完整性保护算法和密钥以及所述流对应的无线数据承载DRB，所述会话与所述流对应；
存储模块，用于保存所述流对应的完整性保护算法和密钥以及所述流对应的DRB；
所述发送模块，还用于向所述终端设备发送第二消息，所述第二消息包括：所述会话的标识，所述流的标识，所述流对应的DRB的标识，以及所述流对应的完整性保护算法和密钥。
可选的，所述第二消息包括SDAP层的配置，所述SDAP层的配置包括所述会话的标识，所述流的标识，所述流对应的DRB的标识，以及所述流对应的完整性保护算 法和密钥；或者，
所述第二消息包括PDCP层的配置，所述PDCP层的配置包括所述会话的标识，所述流的标识，所述流对应的DRB的标识，以及所述流对应的完整性保护算法和密钥。
在本申请第八方面和第九方面中，所述第三消息或所述第二消息中还包括以下信息中的至少一个：
完整性保护位置的指示、完整性保护协议层位置指示、完整性保护位置的使能指示、和完整性保护对象的指示；
其中，
所述完整性保护位置的指示用于指示进行完整性保护的网元；
所述完整性保护协议层位置指示用于指示进行完整性保护的协议层；
所述完整性保护位置的使能指示用于指示是否开启完整性保护的功能；
所述完整性保护对象的指示用于指示完整性保护的对象为用户面数据，或者，用户面数据和控制面信令。
可选的，所述接入网设备还包括：完整性保护模块，用于使用所述完整性保护算法和密钥对所述DRB的数据进行完整性保护。
可选的，所述DRB的数据为：所述DRB的SDAP层的数据包；或者所述DRB的PDCP层的数据包。
当所述DRB的数据为所述DRB的SDAP层的数据包时，所述接入网设备还包括：标记模块，用于在所述DRB的SDAP层的数据包中标记所述流的标识。
本申请第十方面提供一种核心网设备，包括：
接收模块，用于接收接入网设备发送的第三消息，所述第三消息包括第一消息，所述第一消息用于请求建立会话；
发送模块，用于向所述接入网设备发送第四消息，所述第三消息中包括所述会话对应的完整性保护算法和密钥以及所述会话对应的无线数据承载DRB，或者包括流对应的完整性保护算法和密钥以及所述流对应的DRB，所述会话与所述流对应。
可选的，所述第四消息还包括以下信息中的至少一个：
完整性保护位置的指示、完整性保护协议层位置指示、完整性保护位置的使能指示、和完整性保护对象的指示；
其中，
所述完整性保护位置的指示用于指示进行完整性保护的网元；
所述完整性保护协议层位置指示用于指示进行完整性保护的协议层；
所述完整性保护位置的使能指示用于指示是否开启完整性保护的功能；
所述完整性保护对象的指示用于指示完整性保护的对象为用户面数据，或者，用户面数据和控制面信令。
可选的，所述核心网设备还包括：完整性保护模块，用于使用所述完整性保护算法和密钥对所述DRB的数据进行完整性保护。
可选的，所述DRB的数据为：所述DRB的SDAP层的数据包；或者所述DRB的PDCP层的数据包。
当所述DRB的数据为所述DRB的SDAP层的数据包时，所述核心网设备还包括： 标记模块，用于在所述DRB的SDAP层的数据包中标记所述流的标识。
本申请第十一方面提供一种终端设备，包括：处理器、存储器、接收器和发送器，所述存储器、接收器和发送器通过总线与所述处理器连接并通信，所述存储器用于存储计算机执行指令，所述处理器用于执行所述计算机执行指令，以使所述终端设备执行上述第一方面和第二方面提供的方法。
本申请第十二方面提供一种接入网设备，包括：处理器、存储器、接收器和发送器，所述存储器、接收器和发送器通过总线与所述处理器连接并通信，所述存储器用于存储计算机执行指令，所述处理器用于执行所述计算机执行指令，以使所述接入网设备执行上述第三方面和第四方面提供的方法。
本申请第十三方面提供一种核心网设备，包括：处理器、存储器、接收器和发送器，所述存储器、接收器和发送器通过总线与所述处理器连接并通信，所述存储器用于存储计算机执行指令，所述处理器用于执行所述计算机执行指令，以使所述核心网设备执行上述第五方面提供的方法。
本申请第十四方面提供一种计算机可读介质，所述计算机可读介质包括计算机执行指令，所述计算机执行指令用于使终端设备执行本申请第一方面和第二方面提供的方法。
本申请第十五方面提供一种计算机可读介质，所述计算机可读介质包括计算机执行指令，所述计算机执行指令用于使接入网设备执行本申请第三方面和第四方面提供的方法。
本申请第十六方面提供一种计算机可读介质，所述计算机可读介质包括计算机执行指令，所述计算机执行指令用于使核心网设备执行本申请第五方面提供的方法。
本申请第十七方面提供一种芯片上***，所述***可应用于终端设备，所述芯片上***包括：至少一个通信接口，至少一个处理器，至少一个存储器，所述通信接口、存储器和处理器通过总线互联，所述处理器调用所述存储器中存储的指令，以执行本申请第一方面和第二方面提供的方法。
本申请第十八方面提供一种芯片上***，所述***可应用于接入网设备，所述芯片上***包括：至少一个通信接口，至少一个处理器，至少一个存储器，所述通信接口、存储器和处理器通过总线互联，所述处理器调用所述存储器中存储的指令，以执行本申请第三方面和第四方面提供的方法。
本申请第十九方面提供一种芯片上***，所述***可应用于核心网设备，所述芯片上***包括：至少一个通信接口，至少一个处理器，至少一个存储器，所述通信接口、存储器和处理器通过总线互联，所述处理器调用所述存储器中存储的指令，以执行本申请第五方面提供的方法。
本申请第二十方面提供一种程序产品，所述程序产品包括计算机程序，所述计算机程序存储在可读存储介质中，终端设备的至少一个处理器执行所述计算机程序使得所述终端设备实施本申请第一方面和第二方面提供的方法。
本申请第二十一方面提供一种程序产品，所述程序产品包括计算机程序，所述计算机程序存储在可读存储介质中，接入网设备的至少一个处理器执行所述计算机程序使得所述接入网设备实施本申请第三方面和第四方面提供的方法。
本申请第二十二方面提供一种程序产品，所述程序产品包括计算机程序，所述计算机程序存储在可读存储介质中，核心网设备的至少一个处理器执行所述计算机程序使得所述核心网设备实施本申请第五方面提供的方法。
本申请提供一种数据完整性保护方法和装置，终端设备通过获取会话对应的完整性保护算法和密钥以及会话对应的DRB，使用会话对应的完整性保护算法和密钥对会话对应的DRB的数据进行完整性保护，或者，终端设备获取流对应的完整性保护算法和密钥以及流对应的DRB，使用流对应的完整性保护算法和密钥对流对应的DRB的数据进行完整性保护，一个会话包括多个流，不同会话可以使用不同的完整性保护算法和密钥，不同流也可以使用不同的完整性保护算法和密钥，从而使得完整性保护更加灵活，满足同一用户不同业务的安全需求。
附图说明
图1示出了本申请的一种应用场景的示意性架构图；
图2为本申请实施例一提供的数据完整性保护方法的信令流程图；
图3为5G***的协议层的一种示意图；
图4为本申请实施例二提供的数据完整性保护方法的信令流程图；
图5为在PDCP层进行完整性保护时MAC-I的一种示意图；
图6为本申请实施例三提供的终端设备的结构示意图；
图7为本申请实施例五提供的接入网设备的结构示意图；
图8为本申请实施例七提供的核心网设备的结构示意图；
图9为本申请实施例八提供的终端设备的结构示意图；
图10为本申请实施例九提供的接入网设备的结构示意图；
图11为本申请实施例十提供的核心网设备的结构示意图。
具体实施方式
本申请提供一种数据完整性保护方法，可以应用于多种通信***，该通信***可以为通用移动通信***(Universal Mobile Telecommunications System，UMTS)、码分多址(Code Division Multiple Access，CDMA)***、宽带码分多址(Wideband Code Division Multiple Access，WCDMA)***、无线局域网(Wireless Local Area Network，WLAN)、长期演进(Long Term Evolution，LTE)***或第五代移动通信(5th-Generation，5G)***。
图1示出了本申请的一种应用场景的示意性架构图。如图1所示，5G***可以包括：(无线)接入网((Radio)Access Network，(R)AN)、核心网(Core Network，CN)和终端设备。其中，RAN负责终端设备的接入，RAN的覆盖范围内包括多个终端设备，RAN和CN之间的接口为NG接口，RAN网元之间的接口为Xn接口，RAN网元和终端设备之间的接口为空口。RAN网元可以是UMTS***的基站、CDMA***的基站(Base Transceiver Station，BTS)，也可以是WCDMA***中的基站(NodeB，NB)，还可以是LTE***中的演进型基站(evolved NodeB，eNB)或者中继站，或 者WLAN中的接入点(access point，AP)，也可以是5G***中的基站(如gNB或传输点(Transmission Point，TRP))等，5G***也称为新无线通信***、新接入技术(New Radio)或者下一代移动通信***。在下一代移动通信***中，一种基于流(flow)的业务服务质量(Quality of Service，QoS)架构被提出，flow例如是QoS flow。QoS分为非接入层(Non-access stratum，NAS)层QoS和接入层(access stratum，AS)层QoS，其中NAS层QoS为QoS flow级别，QoS flow是协议数据单元(Protocol Data Unit，PDU)会话(session)中的最小粒度的QoS区分，Qos flow是一组数据包的集合，同一QoS flow包括的数据包会进行相同的处理。
CN网元包括接入和移动性管理功能(Access and Mobility Management Function，AMF)实体和用户面功能(User Plane Function，UPF)实体。AMF实体主要负责移动性管理、接入管理等服务，相当于LTE***中移动管理实体(Mobility Management Entity，MME)除了会话管理功能外的功能。UPF相当于LTE***中的分组数据网络网关(Packet Data Network Gateway，P-GW)，主要负责会话和承载管理、互联网协议(Internet Protocol，IP)地址分配等功能，UPF产生下行的QoS flow，UE产生上行的QoS flow。
可选的，CN网元还可以包括会话管理功能(Session Management Function，SMF)实体、鉴权服务器功能(Authentication Server Function，AUSF)实体/鉴权信任状存储和处理功能(Authentication Credential Repository and Processing Function，ARPF)实体、策略控制功能(Policy Control Function，PCF)实体和认证、授权和计费(Authentication,Authorization and Accounting，AAA)服务器。
SMF实体主要负责建立会话、修改会话或释放会话。PCF实体主要负责为网络提供策略。AAA服务器主要负责用户身份识别(Subscriber Identification Module，SIM)卡的认证、授权SIM卡可以使用哪些服务以及记录SIM卡使用的网络资源。AAA服务器可以由运营商提供，也可以由第三方提供。AUSF是鉴权请求消息的终结点并与ARPF实体交互获得终端设备的长期安全信任状(long-term security credential)。ARPF实体主要负责存储终端设备的长期安全信任状。
当本申请的方法应用在LTE***时，AMF实体和SMF实体可以由MME代替，UPF实体可以由LTE***中的P-GW和服务网关实体(Serving Gateway，S-GW)代替，AUSF实体和ARPF实体由归属网络服务器(Home Subscriber Server，HSS)代替，HSS用于存储签约信息，该签约信息可以是SIM卡的签约信息。其中，MME是信令管理网元，负责NAS信令加密、为终端设备分配临时身份标识、选择SGW和PGW等CN网元、提供漫游、跟踪、安全等功能；SGW是eNB之间切换的移动性锚点，并提供合法监听相关功能；PGW则负责IP地址分配、方案控制和计费规则的执行以及合法监听相关等功能。
本申请中涉及的终端设备可以是无线终端，无线终端可以是指向用户提供语音和/或数据连通性的设备，具有无线连接功能的手持式设备、或连接到无线调制解调器的其它处理设备。无线终端可以经(R)AN与至少一个核心网进行通信。无线终端可以是移动终端，如移动电话(或称为“蜂窝”电话)和带有移动终端的计算机，例如，可以是便携式、袖珍式、手持式、计算机内置的或者车载的移动装置，它们与无线接入 网交换语音和/或数据。无线终端也可以称为用户单元(Subscriber Unit)、用户站(Subscriber Station)，移动站(Mobile Station)、移动台(Mobile Station)、远程站(Remote Station)、接入点(Access Point)、远程终端(Remote Terminal)、接入终端(Access Terminal)、用户终端(User Terminal)、用户设备(User Equipment，UE)、或用户代理(User Agent)，在此不作限定。
基于上述图1所示的通信***，本申请提供的数据完整性保护方法，旨在解决现有技术存在的完整性保护不灵活的问题。
下面以具体地实施例对本申请的技术方案以及本申请的技术方案如何解决上述技术问题进行详细说明。下面这几个具体的实施例可以相互结合，对于相同或相似的概念或过程可能在某些实施例中不再赘述。下面将结合附图，对本申请的实施例进行描述。
图2为本申请实施例一提供的数据完整性保护方法的信令流程图，本实施例的方法主要可以包括以下步骤：
步骤S101、终端设备向接入网设备发送第一消息。
第一消息用于请求建立会话，该会话也称为PDU会话。第一消息中可以携带NAS消息，NAS消息携带会话建立请求信息，该会话建立请求信息中包括要建立的会话的标识。该会话建立请求消息中还可以包括协议栈区分(Protocol discriminator)，用于指示第一消息对应的L3协议栈。如果会话建立请求信息通过NAS消息携带，则接入网将NAS消息携带在第三消息中发送给核心网设备。
示例性的，第一消息可以是无线资源控制(Radio Resource Control，RRC)消息、媒体接入控制(Media Access Control，MAC)消息或者物理层消息等。RRC消息例如是RRC连接建立请求、RRC连接重建立请求或RRC连接建立完成等，MAC消息例如是MAC控制元素(Control Element，CE)，物理层消息例如是物理层信令。
步骤S102、接入网设备向核心网设备发送第三消息，第三消息包括第一消息。
第三消息用于请求建立会话，具体的，接入网设备接收到第一消息后，将第一消息中的NAS消息携带在第三消息中发送给核心网设备，第三消息是RAN和CN之间的接口消息。
步骤S103、核心网设备向接入网设备发送第四消息，第四消息中包括会话对应的完整性保护算法和密钥以及会话对应的无线数据承载(Data Resource Bearer，DRB)。
第四消息用于请求接入网设备为建立的会话准备资源，第四消息可以是UE初始上下文建立请求消息，用于为UE建立上下文配置；或者，第四消息是PDU会话资源建立请求消息，用于为会话配置资源。第四消息中携带会话信息和会话对应的完整性保护配置，会话信息包括会话标识和会话对应的DRB。可选的，第四消息中携带NAS消息，会话对应的完整性保护配置携带在NAS消息中，当然，会话对应的完整性保护配置也可以不携带在NAS消息中。
第四消息中还包括包含至少一个协议层的配置参数，用于为会话建立一个或者多个DRB，以承载终端设备发起的业务。图3为5G***的协议层的一种示意图，如图3所示，终端设备和接入网设备的协议层从上到下依次为：业务数据聚合层(Service Data Aggregation Protocol，SDAP)层、PDCP层、无线链路控制(Radio Link Control， RLC)、MAC和物理层(Physical，PHY)。其中，SDAP层时在LTE***上新增的协议层，SDAP层用于处理流(flow)到DRB的映射，本实施例中一个终端设备可能建立多个会话，每个会话包括一个或多个流，每个流可以映射到一个或多个DRB上，流例如是QoS流。
示例性的，该至少一个协议层的配置参数包含各层协议栈的参数、传输模式、逻辑信道配置和调度相关参数等。传输模式可以是RLC透传模式、确认模式或者非确认模式，逻辑信道配置例如是逻辑信道优先级，具体内容可以参照LTE或者5G协议，此处不再赘述。
本实施例中，第四消息中携带的会话对应的完整性保护配置包括会话对应的完整性保护算法和密钥，可选的，第四消息中也可以不携带会话对应的完整性保护算法和密钥，会话对应的完整性保护算法和密钥通过其他消息携带，或者，会话对应的完整性保护算法和密钥预先配置好。第四消息中还可以包括以下信息中的至少一个：完整性保护位置的指示、完整性保护协议层位置指示、完整性保护位置的使能指示和完整性保护对象的指示。同理，完整性保护位置的指示、完整性保护协议层位置指示、完整性保护位置的使能指示和完整性保护对象的指示中的一个或多个也可以预先配置好，而不需要通过第四消息动态指示。
其中，完整性保护位置的指示用于指示进行完整性保护的网元。完整性保护可以位于RAN侧，或者位于CN侧，或者位于RAN以及CN侧等，因此，完整性保护的网元可以是接入网设备、核心网设备，或者，同时在接入网设备和核心网设备进行完整性保护。当完整性保护位置位于RAN侧时，完整性保护功能由RAN侧的协议栈执行，对应终端设备侧则在接入层执行。当完整性保护位置位于CN侧时，完整性保护功能需要在CN侧的协议栈执行，对应终端设备侧则在非接入层执行。当完整性保护位置位于RAN侧和CN侧时，完整性保护功能需要在RAN侧以及CN侧执行，则用户的控制面或者数据面的完整性保护需要执行两次。
完整性保护协议层位置指示用于指示进行完整性保护的协议层，完整性保护的协议层可以是SDAP层、PDCP层或RRC层。
完整性保护位置的使能指示用于指示是否开启完整性保护的功能。完整性保护位置的使能指示与完整性保护位置的指示关联，例如若完整性保护位置的指示所指示的完整性保护位置在RAN侧，则该完整性保护位置的使能指示用于指示RAN侧功能的开或者关，若完整性保护位置的指示所指示的完整性保护位置在RAN以及CN侧，则该完整性保护位置的使能指示用于指示RAN侧以及CN侧分别的开或者关。
完整性保护对象的指示用于指示完整性保护的对象为用户面(User plane，UP)数据，或者，用户面数据和控制面(Control Plane，CP)信令。
不同会话可以使用相同或者不同的完整性保护算法和密钥，完整性保护算法和密钥与完整性保护位置对应，例如，核心网设备只指示了一种完整性保护位置(RAN侧或CN侧)，则只在该完整性保护位置配置对应的完整性保护算法和密钥，如果核心网设备指示了两种完整性保护位置(RAN侧和CN侧)，则需要在两种完整性保护位置分别配置完整性保护算法和密钥，两种完整性保护位置对应的保护算法和密钥可以相同，也可以不同。
一种方式中，不同会话所使用的密钥可以通过一个根密钥(root key)计算得到，不同会话得到的密钥可以不同，也可以相同，该根密钥可以是接入网设备在SMC过程中获得的根密钥。
另一种方式中，不同会话所使用的密钥可以通过不同的根秘钥计算得到，例如，在第四消息中指示会话使用的根密钥，或者传递相关的参数，使得接入网设备根据根密钥计算得到会话使用的密钥。
本实施例中，会话对应的完整性保护配置可以放在第四消息中的PDU会话信息列表(PDU Session Resource Setup List)中，用于指示该会话对应的完整性保护配置，也可以单独放在第四消息中，并添加完整性保护配置对应的会话标识，接入网设备通过第四消息获知该会话对应的完整性保护配置，进而获知该会话对应的DRB的完整性保护配置。表一为第四消息的一种结构示意图，表二为PDU会话信息列表的一种示意图，表三为PDU会话建立请求传送(PDU Session Setup Request Transfer)的一种示意图。表一所示第四消息例如为第三代合作伙伴(3 rd Generation Partnership Project，3GPP)下一代(Next Generation，NG)RAN NG应用协议(NG Application Protocol，NGAP)，协议版本号为0.1.0，9.2.1.1章节PDU会话资源建立请求消息。表二所述PDU会话信息列表例如为3GPP NG RAN NGAP，协议版本号为0.1.0，9.3.1.5章节PDU会话资源建立列表消息。
表一
Figure PCTCN2018099916-appb-000001
表二
Figure PCTCN2018099916-appb-000002
Figure PCTCN2018099916-appb-000003
表三
Figure PCTCN2018099916-appb-000004
Figure PCTCN2018099916-appb-000005
表二和表三分别示出了会话对应的完整性保护配置在第四消息中的两种可能的位置。表二中会话对应的完整性保护配置携带在PDU会话资源建立列表，PDU会话资源建立列表中包含一个或者多个会话资源建立的信息元素(information element，IE)，其中每个信息元素至少保护以下一种信息：会话标识和单个网络切片选择辅助信息，网络切片选择辅助信息用于指示会话对应的网络切片标识。表三中会话对应的完整性保护配置携带在PDU会话建立请求传送中，PDU会话建立请求传送包含至少以下一种信息：一个或者多个会话对应的最大聚合比特速率、传输层信息、会话类型、QoS 流资源信息列表等，QoS流资源信息列表包含一个或者多个流对应的标识，QoS流级别的QoS参数等。
步骤S104、接入网设备向终端设备发送第二消息，第二消息包括会话的标识，会话对应的完整性保护算法和密钥，以及会话对应的DRB的标识。
接入网设备接收到第四消息后，保存第四消息中携带的会话对应的完整性保护算法和密钥等完整性保护配置。并根据第四消息中携带的至少一个协议层的配置参数为终端设备建立DRB，以承载终端设备发起的业务。然后，生成第二消息，并向终端设备发送第二消息，第二消息可以是NAS消息、RRC消息、MAC层消息或者物理层消息。当第二消息为RRC消息时，如果RRC消息中不包括NAS消息，则会话的标识、会话对应的完整性保护算法和密钥、以及会话对应的DRB的标识全部携带在RRC消息中，如果RRC消息中包括NAS消息，则上述参数中全部或部分携带在RRC消息中包括的NAS消息中。
本实施例中，第二消息中包括会话对应的完整性保护算法和密钥，可选的，第二消息中也可以不携带会话对应的完整性保护算法和密钥，会话对应的完整性保护算法和密钥通过其他消息携带，或者，会话对应的完整性保护算法和密钥预先配置好。在其他实施例中，第二消息中包括以下信息中的至少一个：完整性保护算法和密钥、完整性保护位置的指示、完整性保护协议层位置指示、完整性保护位置的使能指示和完整性保护对象的指示。同理，完整性保护位置的指示、完整性保护协议层位置指示、完整性保护位置的使能指示和完整性保护对象的指示中的一个或多个也可以预先配置好，而不需要通过第二消息动态指示。
第二消息和第四消息中携带的完整性保护配置可以相同，也可以不同。例如，第四消息中指示了会话使用的根密钥，则接入网设备接收到第四消息后，根据指示的根密钥计算得到会话使用的密钥，然后将会话使用的密钥携带在第二消息中。
可选的，会话对应的完整性保护配置可以携带在第二消息的SDAP层的配置参数中，即将完整性保护配置作为SDAP层的配置参数，也可以携带在PDCP层的配置参数中，即将完整性保护配置作为PDCP层的配置参数。其中，第二消息中包括至少一个协议层的配置参数，那么SDAP层的配置参数和PDCP层的配置参数可以都携带在第二消息中，也可以其中一个配置参数携带在第二消息中，另一个配置参数携带在不同于第二消息的其他消息中。下述为完整性保护配置在第二消息中的几种可能的位置，以第二消息为RRC连接重配置消息(RRC Connection Reconfiguration message)为例，该RRC连接重配置消息为例如为下述的3GPP演进的全球陆地无线接入网络(Evolved Universal Terrestrial Radio Access,E-UTRA)RRC协议，协议版本号为13.0.0，6.2.2章节RRC连接重配置消息：
Figure PCTCN2018099916-appb-000006
Figure PCTCN2018099916-appb-000007
上述例子中会话对应的完整性保护配置的可能位置1为SDAP层的配置参数中，会话对应的完整性保护配置的可能位置2为PDCP层的配置参数。
可选的，接入网设备在步骤S104之后，向核心网设备发送第五消息，第五消息用于反馈核心网设备发送的第四消息的处理结果，若接入网设备未能成功对终端设备的上下文进行配置，则第五消息用于反馈配置失败，并包含失败原因指示，即cause值。第五消息还用于携带接入网设备为一个或者多个会话分配的空口资源，例如包括接入网设备建立的会话信息列表，不能建立的QoS流列表等。
步骤S105、终端设备保存第二消息中的内容。
终端设备通过保存第二消息中携带的会话对应的完整性保护配置，后续根据保存的会话对应的完整性保护配置，对会话对应的DRB的数据进行完整性保护，会话对应的DRB可能为一个或多个，如果会话对应的DRB为多个，则会话对应的多个DRB使用的完整性保护配置相同。
具体的，终端设备使用会话对应的完整性保护算法和密钥对会话对应的DRB的数据进行完整性保护。DRB的数据为：DRB的SDAP层的数据包或者PDCP层的数据包，即终端设备可以在SDAP层和PDCP层对DRB的数据进行完整性保护。SDAP层的数据包包括PDU和服务数据单元(service Data Unit，SDU)服务数据单元，PDCP层的数据包也包括PDU和SDU。
以终端设备为发送端、DRB的数据为PDCP层数据包为例，终端设备使用完整性保护算法，以密钥、COUNT值、无线承载标识、DIRECTION、PDCP层数据包本身以及PDCP层数据包的长度等中的至少一个参数作为输入参数，计算一个32bit的MAC-I，放入PDCP PDU的MAC-I域。接收端(接入网设备或核心网设备)在收到该PDCP层数据包后，以同样的方法计算该PDCP层数据所期望的验证码XMAC-I，并通过比较XMAC-I和MAC-I进行完整性校验。如果MAC-I与XMAC-I相等，则接收端确定完整性校验成功，否则确定完整性校验失败。当然，终端设备也可能作为接收端。
本实施例中，终端设备通过第二消息从接入网设备获取了会话对应的完整性算法和密钥，需要说明的是，终端设备还可以通过其他方式获取会话对应的完整性算法和密钥，例如，会话对应的完整性算法和密钥被预先配置在终端设备上，第二消息中只 需要携带会话标识，终端设备根据会话标识查找到会话对应的完整性算法和密钥。同理，对于会话的其他完整性保护配置，例如完整性保护位置的指示、完整性保护协议层位置指示、完整性保护位置的使能指示和完整性保护对象的指示中的一个或多个也可以通过第二消息动态指示，或者，预先配置的方式通知给终端设备。
本实施例中，终端设备获取会话对应的完整性保护算法和密钥以及会话对应的DRB，使用会话对应的完整性保护算法和密钥对DRB的数据进行完整性保护，使得不同会话可以使用不同的完整性保护算法和密钥，从而使得完整性保护更加灵活，满足同一用户不同业务的安全需求。
图4为本申请实施例二提供的数据完整性保护方法的信令流程图，不同于实施例一，本实施例中完整性保护的粒度是流级别的，如图4所示，本实施例的方法主要包括以下步骤：
步骤S201、终端设备向接入网设备发送第一消息。
步骤S202、接入网设备向核心网设备发送第三消息，第三消息包括第一消息。
步骤S201和步骤S202的具体实现方式参照上述实施例一的相关描述。
步骤S203、核心网设备向接入网设备发送第四消息，第四消息包括流对应的完整性保护算法和密钥以及流对应的DRB。
与实施例一不同的是，本实施例中，第四消息包括流对应的完整性保护算法和密钥以及流对应的DRB，其中，流与第一消息请求建立的会话对应，一个会话包括多条流，每条流可以映射到多个DRB，本实施例中，会话包括的多个流可以使用相同或者不同的完整性保护算法和密钥。
可选的，第四消息中也可以不携带流对应的完整性保护算法和密钥，流对应的完整性保护算法和密钥通过其他消息携带，或者，流对应的完整性保护算法和密钥预先配置好。可选的，第四消息中还可以包括以下信息中的至少一个：完整性保护位置的指示、完整性保护协议层位置指示、完整性保护位置的使能指示和完整性保护对象的指示。同理，完整性保护位置的指示、完整性保护协议层位置指示、完整性保护位置的使能指示和完整性保护对象的指示中的一个或多个也可以预先配置好，而不需要通过第四消息动态指示。
本实施例中，流的完整性保护配置可以放在第四消息中的QoS流资源信息列表中，用于指示该流对应的完整性保护配置，也可以单独放在第四消息中，并添加完整性保护配置对应的流标识，例如，放在PDU会话资源信息列表中，接入网设备通过第四消息获知该流的完整性保护配置。第四消息的结构参照上述表一所示，PDU会话信息列表参照上述表二，表四为QoS流资源信息列表的一种示意图。
表四
Figure PCTCN2018099916-appb-000008
Figure PCTCN2018099916-appb-000009
表四所示例子中，流对应的的完整性保护配置携带在QoS流资源信息列表中，QoS流资源信息列表中还包含一个或者多个流对应的标识，QoS流级别的QoS参数等。
步骤S204、接入网设备向终端设备发送第二消息，第二消息包括会话的标识，流的标识，流对应的完整性保护算法和密钥，以及流对应的DRB的标识。
接入网设备接收到第四消息后，保存第四消息中携带的会话的标识，流的标识，流对应的完整性保护算法和密钥，以及流对应的DRB的标识。并根据第四消息中携带的至少一个协议层的配置参数为终端设备建立DRB，以承载终端设备发起的业务，并确定各流对应的DRB。然后，生成第二消息，并向终端设备发送第二消息，第二消息可以是NAS消息、RRC消息、MAC层消息或者物理层消息。当第二消息为RRC消息时，如果RRC消息中不包括NAS消息，则会话的标识、流的标识、流对应的完整性保护算法和密钥、以及流对应的DRB的标识全部携带在RRC消息中，如果RRC消息中包括NAS消息，则上述参数中全部或部分携带在RRC消息中包括的NAS消息中。
本实施例中，第二消息中包括流对应的完整性保护算法和密钥，可选的，第二消息中也可以不携带流对应的完整性保护算法和密钥，流对应的完整性保护算法和密钥通过其他消息携带，或者，流对应的完整性保护算法和密钥预先配置好。在其他实施例中，第二消息中包括以下信息中的至少一个：完整性保护算法和密钥、完整性保护位置的指示、完整性保护协议层位置指示、完整性保护位置的使能指示和完整性保护对象的指示。同理，完整性保护位置的指示、完整性保护协议层位置指示、完整性保护位置的使能指示和完整性保护对象的指示中的一个或多个也可以预先配置好，而不需要通过第二消息动态指示。
第二消息和第四消息中携带的流对应的完整性保护配置可以相同，也可以不同。例如，第四消息中指示了流使用的根密钥，则接入网设备接收到第四消息后，根据指示的根密钥计算得到流使用的密钥，然后将流使用的密钥携带在第二消息中。
可选的，流对应的完整性保护配置可以携带在第二消息的SDAP层的配置参数中，即将流对应的完整性保护配置作为SDAP层的配置参数，也可以携带在PDCP层的配置参数中，即将流对应的完整性保护配置作为PDCP层的配置参数。其中，第二消息中包括至少一个协议层的配置参数，那么SDAP层的配置参数和PDCP层的配置参数可以都携带在第二消息中，也可以其中一个配置参数携带在第二消息中，另一个配置参数携带在不同于第二消息的其他消息中。
可选的，接入网设备在步骤S204之后，向核心网设备发送第五消息，第五消息用于反馈核心网设备发送的第四消息的处理结果，若接入网设备未能成功对终端设备的上下文进行配置，则第五消息用于反馈配置失败，并包含失败原因指示，即cause值。第五消息还用于携带接入网设备为一个或者多个会话分配的空口资源，例如包括接入网设备建立的会话信息列表，不能建立的QoS流列表等。
步骤S205、终端设备保存第二消息中的内容。
终端设备通过保存第二消息中携带的流对应的完整性保护配置，后续根据保存的流对应的完整性保护配置，对流对应的DRB的数据进行完整性保护，流对应的DRB可能为一个或多个，不同流对应的完整性保护算法和密钥可能不同。
具体的，终端设备使用流对应的完整性保护算法和密钥对流对应的DRB的数据进 行完整性保护。DRB的数据为：DRB的SDAP层的数据包或者PDCP层的数据包，即终端设备可以在SDAP层和PDCP层对DRB的数据进行完整性保护。SDAP层的数据包包括PDU和SDU，PDCP层的数据包也包括PDU和SDU。
若在PDCP层进行完整性保护，由于PDCP层无法区分流，只有SDAP层可以识别会话包括的流，因此需要SDAP层在SDAP层的数据包中标记流的标识，以便于PDCP层根据流的标识识别不同流，进而根据流对应的完整性保护算法和密钥对流对应的数据包进行完整性保护。流的标识可以放在SDAP层的数据包的包头中，也可以放在SDAP层的数据包的具体的数据内容中，此发明不限定具体的格式。
本实施例中，终端设备通过第二消息从接入网设备获取了流对应的完整性算法和密钥，需要说明的是，终端设备还可以通过其他方式获取流对应的完整性算法和密钥，例如，流对应的完整性算法和密钥被预先配置在终端设备上，第二消息中只需要携带会话标识和流标识，终端设备根据会话标识和流标识查找到流对应的完整性算法和密钥。同理，对于流的其他完整性保护配置，例如完整性保护位置的指示、完整性保护协议层位置指示、完整性保护位置的使能指示和完整性保护对象的指示中的一个或多个也可以通过第二消息动态指示，或者，预先配置的方式通知给终端设备。
本实施例中，终端设备获取流对应的完整性保护算法和密钥以及流对应的DRB，使用流对应的完整性保护算法和密钥对流对应的DRB的数据进行完整性保护，使得不同流可以使用不同的完整性保护算法和密钥，从而使得完整性保护更加灵活，满足同一用户不同业务的安全需求。
上述实施例中，发送端进行数据完整性保护可以在序列编号、头压缩、加密等环节的任意一个环节之后，对应接收端一样。且MAC-I的位置和大小也可以灵活设置，图5为在PDCP层进行完整性保护时MAC-I的一种示意图，如图5所示，MAC-I可以携带在消息的最后几个字节。
上述实施例中，接收端进行完整性校验，如果某个消息完整性校验失败，则可以进行以下几种处理中的任何一种：(1)通知RRC，重建RRC连接；(2)丢弃该消息；(3)丢弃该消息，并重建RRC连接；(4)完整性校验失败次数达到预设值时，重建RRC连接。
上述实施例的方法可以应用在双连接(Dual Connection，DC)场景或小区切换场景，在小区切换场景中，如果终端设备从源基站切换到了目标基站，则终端设备需要将会话对应的完整性保护配置或者流对应的完整性保护配置发送给目标基站，以便于目标基站根据会话对应的完整性保护配置或者流对应的完整性保护配置进行完整性保护。在DC场景中，可以只在其中一个站点上进行完整性保护，也可以在两个站点都进行完整性保护，主站点(Master node，MN)需要将会话或者流对应的完整性保护配置发送给辅站点(Secondary node，SN)，以便辅站点可以根据会话对应的完整性保护配置或者流对应的完整性保护配置进行完整性保护。
图6为本申请实施例三提供的终端设备的结构示意图，如图6所示，本实施例提供的终端设备包括：
获取模块11，用于获取会话对应的完整性保护算法和密钥以及所述会话对应的无线数据承载DRB；
完整性保护模块12，用于使用所述完整性保护算法和密钥对所述DRB的数据进行完整性保护。
可选的，所述获取模块11，具体用于：发送第一消息，所述第一消息用于请求建立所述会话；接收第二消息，所述第二消息包括所述会话的标识，所述会话对应的完整性保护算法和密钥，以及所述会话对应的DRB的标识。
可选的，所述第二消息包括SDAP层的配置，所述SDAP层的配置包括所述会话的标识，所述会话对应的完整性保护算法和密钥，以及所述会话对应的DRB的标识；或者，所述第二消息包括PDCP层的配置，所述PDCP层的配置包括所述会话的标识，所述会话对应的完整性保护算法和密钥，以及所述会话对应的DRB的标识。
可选的，所述获取模块11还用于：获取以下信息中的至少一个：
完整性保护位置的指示、完整性保护协议层位置指示、完整性保护位置的使能指示和完整性保护对象的指示；
其中，
所述完整性保护位置的指示用于指示进行完整性保护的网元；
所述完整性保护协议层位置指示用于指示进行完整性保护的协议层；
所述完整性保护位置的使能指示用于指示是否开启完整性保护的功能；
所述完整性保护对象的指示用于指示完整性保护的对象为用户面数据，或者，用户面数据和控制面信令。
可选的，所述DRB的数据为：所述DRB的SDAP层的数据包；或者所述DRB的PDCP层的数据包。当所述DRB的数据为所述DRB的SDAP层的数据包时，终端设备还包括：标记模块，用于在所述DRB的SDAP层的数据包中标记所述流的标识。
本实施例提供的终端设备，可用于执行实施例一中终端设备执行的步骤，具体实现方式和技术效果类似，这里不再赘述。
本申请实施例四提供一种终端设备，该终端设备的结构参照图6所示。本实施例中，获取模块11，用于获取流对应的完整性保护算法和密钥、以及所述流对应的无线数据承载DRB；完整性保护模块12，用于使用所述完整性保护算法和密钥对所述DRB的数据进行完整性保护。
可选的，所述获取模块11，具体用于：发送第一消息，所述第一消息用于请求建立会话，所述会话与所述流对应；接收第二消息，所述第二消息包括：所述会话的标识，所述流的标识，所述流对应的DRB的标识，以及所述流对应的完整性保护算法和密钥。
可选的，所述第二消息包括SDAP层的配置，所述SDAP层的配置包括所述会话的标识，所述流的标识，所述流对应的DRB的标识，以及所述流对应的完整性保护算法和密钥；或者，所述第二消息包括PDCP层的配置，所述PDCP层的配置包括所述会话的标识，所述流的标识，所述流对应的DRB的标识，以及所述流对应的完整性保护算法和密钥。
可选的，所述获取模块11还用于：获取以下信息中的至少一个：
完整性保护位置的指示、完整性保护协议层位置指示、完整性保护位置的使能指示和完整性保护对象的指示；
其中，
所述完整性保护位置的指示用于指示进行完整性保护的网元；
所述完整性保护协议层位置指示用于指示进行完整性保护的协议层；
所述完整性保护位置的使能指示用于指示是否开启完整性保护的功能；
所述完整性保护对象的指示用于指示完整性保护的对象为用户面数据，或者，用户面数据和控制面信令。
可选的，所述DRB的数据为：所述DRB的SDAP层的数据包；或者所述DRB的PDCP层的数据包。当所述DRB的数据为所述DRB的SDAP层的数据包时，终端设备还包括：标记模块，用于在所述DRB的SDAP层的数据包中标记所述流的标识。
本实施例提供的终端设备，可用于执行实施例二中终端设备执行的步骤，具体实现方式和技术效果类似，这里不再赘述。
图7为本申请实施例五提供的接入网设备的结构示意图，如图7所示，本实施例提供的接入网设备包括：
接收模块21，用于接收终端设备发送的第一消息，所述第一消息用于请求建立会话；
发送模块22，用于向核心网设备发送第三消息，所述第三消息包括所述第一消息；
所述接收模块21，还用于接收所述核心网设备发送的第四消息，所述第四消息中包括所述会话对应的完整性保护算法和密钥以及所述会话对应的无线数据承载DRB；
存储模块23，用于保存所述会话对应的完整性保护算法和密钥以及所述会话对应的DRB；
所述发送模块23，还用于向所述终端设备发送第二消息，所述第二消息包括所述会话的标识，所述会话对应的完整性保护算法和密钥，以及所述会话对应的DRB的标识。
可选的，所述第二消息包括SDAP层的配置，所述SDAP层的配置包括所述会话的标识，所述会话对应的完整性保护算法和密钥，以及所述会话对应的DRB的标识；或者，所述第二消息包括PDCP层的配置，所述PDCP层的配置包括所述会话的标识，所述会话对应的完整性保护算法和密钥，以及所述会话对应的DRB的标识。
可选的，所述第三消息或所述第二消息中还包括以下信息中的至少一个：
完整性保护位置的指示、完整性保护协议层位置指示、完整性保护位置的使能指示、和完整性保护对象的指示；
其中，
所述完整性保护位置的指示用于指示进行完整性保护的网元；
所述完整性保护协议层位置指示用于指示进行完整性保护的协议层；
所述完整性保护位置的使能指示用于指示是否开启完整性保护的功能；
所述完整性保护对象的指示用于指示完整性保护的对象为用户面数据，或者，用户面数据和控制面信令。
可选的，所述接入网设备还包括：完整性保护模块24，用于使用所述完整性保护算法和密钥对所述DRB的数据进行完整性保护。
可选的，所述DRB的数据为：所述DRB的SDAP层的数据包；或者所述DRB 的PDCP层的数据包。
当所述DRB的数据为所述DRB的SDAP层的数据包时，所述接入网设备还包括：标记模块，用于在所述DRB的SDAP层的数据包中标记所述流的标识。
本申请实施例六提供一种接入网设备，该接入网设备的结构参照图7所示。本实施例中：
接收模块21，用于接收终端设备发送的第一消息，所述第一消息用于请求建立会话；
发送模块22，用于向核心网设备发送所述第三消息，所述第三消息包括所述第一消息；
所述接收模块21，还用于接收所述核心网设备发送的第四消息，所述第四消息中包括流对应的完整性保护算法和密钥以及所述流对应的无线数据承载DRB，所述会话与所述流对应；
存储模块23，用于保存所述流对应的完整性保护算法和密钥以及所述流对应的DRB；
所述发送模块22，还用于向所述终端设备发送第二消息，所述第二消息包括：所述会话的标识，所述流的标识，所述流对应的DRB的标识，以及所述流对应的完整性保护算法和密钥。
可选的，所述第二消息包括SDAP层的配置，所述SDAP层的配置包括所述会话的标识，所述流的标识，所述流对应的DRB的标识，以及所述流对应的完整性保护算法和密钥；或者，所述第二消息包括PDCP层的配置，所述PDCP层的配置包括所述会话的标识，所述流的标识，所述流对应的DRB的标识，以及所述流对应的完整性保护算法和密钥。
可选的，所述第三消息或所述第二消息中还包括以下信息中的至少一个：
完整性保护位置的指示、完整性保护协议层位置指示、完整性保护位置的使能指示、和完整性保护对象的指示；
其中，
所述完整性保护位置的指示用于指示进行完整性保护的网元；
所述完整性保护协议层位置指示用于指示进行完整性保护的协议层；
所述完整性保护位置的使能指示用于指示是否开启完整性保护的功能；
所述完整性保护对象的指示用于指示完整性保护的对象为用户面数据，或者，用户面数据和控制面信令。
可选的，完整性保护模块24，用于使用所述完整性保护算法和密钥对所述DRB的数据进行完整性保护。
可选的，所述DRB的数据为：所述DRB的SDAP层的数据包；或者所述DRB的PDCP层的数据包。
当所述DRB的数据为所述DRB的SDAP层的数据包时，所述接入网设备还包括：标记模块，用于在所述DRB的SDAP层的数据包中标记所述流的标识。
图8为本申请实施例七提供的核心网设备的结构示意图，如图8所示，本实施例提供的核心网设备包括：
接收模块31，用于接收接入网设备发送的第三消息，所述第三消息包括第一消息，所述第一消息用于请求建立会话；
发送模块32，用于向所述接入网设备发送第四消息，所述第三消息中包括所述会话对应的完整性保护算法和密钥以及所述会话对应的无线数据承载DRB，或者包括流对应的完整性保护算法和密钥以及所述流对应的DRB，所述会话与所述流对应。
可选的，所述第四消息还包括以下信息中的至少一个：
完整性保护位置的指示、完整性保护协议层位置指示、完整性保护位置的使能指示、和完整性保护对象的指示；
其中，
所述完整性保护位置的指示用于指示进行完整性保护的网元；
所述完整性保护协议层位置指示用于指示进行完整性保护的协议层；
所述完整性保护位置的使能指示用于指示是否开启完整性保护的功能；
所述完整性保护对象的指示用于指示完整性保护的对象为用户面数据，或者，用户面数据和控制面信令。
可选的，所述核心网设备还包括：完整性保护模块33，用于使用所述完整性保护算法和密钥对所述DRB的数据进行完整性保护。
可选的，所述DRB的数据为：所述DRB的SDAP层的数据包；或者所述DRB的PDCP层的数据包。
当所述DRB的数据为所述DRB的SDAP层的数据包时，所述核心网设备还包括：标记模块，用于在所述DRB的SDAP层的数据包中标记所述流的标识。
需要说明的是，上述装置实施例中，接收模块和发送模块可以通过一个收发器实现，或者，接收模块由独立的接收器实现，发送模块由独立的接收器实现。上述实施例中的获取模块、完整性保护模块和标记模块可以由具有数据处理功能的处理器实现。
图9为本申请实施例八提供的终端设备的结构示意图，如图9所示，本实施例的终端设备400包括：处理器41、存储器42、接收器43和发送器44，所述存储器42、接收器43和发送器44通过总线与所述处理器41连接并通信，所述存储器42用于存储计算机执行指令，所述处理器41用于执行所述计算机执行指令，以使所述终端设备400执行上述实施例一和实施例二提供的方法中终端设备执行的步骤。具体实现方式和技术效果类似，这里不再赘述。
图10为本申请实施例九提供的接入网设备的结构示意图，如图10所示，本实施例的接入网设备500包括：处理器51、存储器52、接收器53和发送器54，所述存储器52、接收器53和发送器54通过总线与所述处理器51连接并通信，所述存储器52用于存储计算机执行指令，所述处理器51用于执行所述计算机执行指令，以使所述接入网设备500执行上述实施例一和实施例二提供的方法中接入网设备执行的步骤。具体实现方式和技术效果类似，这里不再赘述。
图11为本申请实施例十提供的核心网设备的结构示意图，如图11所示，本实施例的核心网设备600包括：处理器61、存储器62、接收器63和发送器64，所述存储器62、接收器63和发送器64通过总线与所述处理器61连接并通信，所述存储器62用于存储计算机执行指令，所述处理器61用于执行所述计算机执行指令，以使所述核 心网设备600执行上述实施例一和实施例二提供的方法中核心网设备执行的步骤。具体实现方式和技术效果类似，这里不再赘述。
本申请实施例十提供一种计算机可读介质，所述计算机可读介质包括计算机执行指令，所述计算机执行指令用于使终端设备执行本申请实施例一和实施例二中终端设备执行的方法步骤。
本申请实施例十一提供一种计算机可读介质，所述计算机可读介质包括计算机执行指令，所述计算机执行指令用于使接入网设备执行本申请实施例一和实施例二中接入网设备执行的方法步骤。
本申请实施例十二提供一种计算机可读介质，所述计算机可读介质包括计算机执行指令，所述计算机执行指令用于使核心网设备执行本申请实施例一和实施例二中核心网设备执行的方法步骤。
本申请实施例十三提供一种芯片上***，所述***可应用于终端设备，所述芯片上***包括：至少一个通信接口，至少一个处理器，至少一个存储器，所述通信接口、存储器和处理器通过总线互联，所述处理器调用所述存储器中存储的指令，以执行本申请实施例一和实施例二中终端设备执行的方法步骤。
本申请实施例十四提供一种芯片上***，所述***可应用于接入网设备，所述芯片上***包括：至少一个通信接口，至少一个处理器，至少一个存储器，所述通信接口、存储器和处理器通过总线互联，所述处理器调用所述存储器中存储的指令，以执行本申请实施例一和实施例二中接入网设备执行的方法步骤。
本申请实施例十五提供一种芯片上***，所述***可应用于核心网设备，所述芯片上***包括：至少一个通信接口，至少一个处理器，至少一个存储器，所述通信接口、存储器和处理器通过总线互联，所述处理器调用所述存储器中存储的指令，以进行本申请实施例一和实施例二中核心网设备提供的方法。
本申请实施例十六提供一种程序产品，所述程序产品包括计算机程序，所述计算机程序存储在可读存储介质中，终端设备的至少一个处理器执行所述计算机程序使得所述终端设备实施本申请实施例一和实施例二中终端设备执行的方法步骤。
本申请实施例十七提供一种程序产品，所述程序产品包括计算机程序，所述计算机程序存储在可读存储介质中，接入网设备的至少一个处理器执行所述计算机程序使得所述接入网设备实施本申请实施例一和实施例二中接入网设备执行的方法步骤。
本申请实施例十八提供一种程序产品，所述程序产品包括计算机程序，所述计算机程序存储在可读存储介质中，核心网设备的至少一个处理器执行所述计算机程序使得所述核心网设备实施本申请实施例一和实施例二中核心网设备执行的方法步骤。
可以理解，本申请所述的处理器可以是中央处理器(CPU)，通用处理器、数字信号处理器(DSP)、专用集成电路(ASIC)，现场可编程门阵列(FPGA)或者其他可编程逻辑器件、晶体管逻辑器件，硬件部件或者其任意组合。其可以实现或执行结合本申请所描述的各种示例性的逻辑方框，模块和电路。所述处理器也可以是实现计算功能的组合，例如包含一个或多个微处理器组合，DSP和微处理器的组合等等。
本申请所述的总线可以是工业标准体系结构(Industry Standard Architecture，ISA)总线、外部设备互连(Peripheral Component，PCI)总线或扩展工业标准体系结构 (Extended Industry Standard Architecture，EISA)总线等。总线可以分为地址总线、数据总线、控制总线等。为便于表示，本申请附图中的总线并不限定仅有一根总线或一种类型的总线。
在本申请所提供的几个实施例中，所描述的装置实施例仅仅是示意性的，例如，所述模块的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个模块或组件可以结合或者可以集成到另一个***，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或模块的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。

Claims (55)

  1. 一种数据完整性保护方法，其特征在于，包括：
    终端设备获取会话对应的完整性保护算法和密钥以及所述会话对应的无线数据承载DRB；
    所述终端设备使用所述完整性保护算法和密钥对所述DRB的数据进行完整性保护。
  2. 一种数据完整性保护方法，其特征在于，包括：
    终端设备获取流对应的完整性保护算法和密钥、以及所述流对应的无线数据承载DRB；
    所述终端设备使用所述完整性保护算法和密钥对所述DRB的数据进行完整性保护。
  3. 根据权利要求1或2所述的方法，其特征在于，还包括：
    所述终端设备获取以下信息中的至少一个：
    完整性保护位置的指示、完整性保护协议层位置指示、完整性保护位置的使能指示和完整性保护对象的指示；
    其中，
    所述完整性保护位置的指示用于指示进行完整性保护的网元；
    所述完整性保护协议层位置指示用于指示进行完整性保护的协议层；
    所述完整性保护位置的使能指示用于指示是否开启完整性保护的功能；
    所述完整性保护对象的指示用于指示完整性保护的对象为用户面数据，或者，用户面数据和控制面信令。
  4. 根据权利要求1所述的方法，其特征在于，所述终端设备获取会话对应的完整性保护算法和密钥，以及所述会话对应的DRB，包括：
    所述终端设备发送第一消息，所述第一消息用于请求建立所述会话；
    所述终端设备接收第二消息，所述第二消息包括所述会话的标识，所述会话对应的完整性保护算法和密钥，以及所述会话对应的DRB的标识。
  5. 根据权利要求2所述的方法，其特征在于，所述终端设备获取流对应的完整性保护算法和密钥、以及所述流对应的DRB，包括：
    所述终端设备发送第一消息，所述第一消息用于请求建立会话，所述会话与所述流对应；
    所述终端设备接收第二消息，所述第二消息包括：所述会话的标识，所述流的标识，所述流对应的DRB的标识，以及所述流对应的完整性保护算法和密钥。
  6. 根据权利要求4所述的方法，其特征在于，
    所述第二消息包括业务数据聚合SDAP层的配置，所述SDAP层的配置包括所述会话的标识，所述会话对应的完整性保护算法和密钥，以及所述会话对应的DRB的标识；或者，
    所述第二消息包括分组数据汇聚协议PDCP层的配置，所述PDCP层的配置包括所述会话的标识，所述会话对应的完整性保护算法和密钥，以及所述会话对应的DRB的标识。
  7. 根据权利要求5所述的方法，其特征在于，
    所述第二消息包括业务数据聚合SDAP层的配置，所述SDAP层的配置包括所述会话的标识，所述流的标识，所述流对应的DRB的标识，以及所述流对应的完整性保护算法和密钥；或者，
    所述第二消息包括分组数据汇聚协议PDCP层的配置，所述PDCP层的配置包括所述会话的标识，所述流的标识，所述流对应的DRB的标识，以及所述流对应的完整性保护算法和密钥。
  8. 一种通信装置，其特征在于，包括：
    获取模块，用于获取会话对应的完整性保护算法和密钥以及所述会话对应的无线数据承载DRB；
    完整性保护模块，用于使用所述完整性保护算法和密钥对所述DRB的数据进行完整性保护。
  9. 一种通信装置，其特征在于，包括：
    获取模块，用于获取流对应的完整性保护算法和密钥、以及所述流对应的无线数据承载DRB；
    完整性保护模块，用于使用所述完整性保护算法和密钥对所述DRB的数据进行完整性保护。
  10. 根据权利要求8或9所述的装置，其特征在于，所述获取模块还用于：
    获取以下信息中的至少一个：
    完整性保护位置的指示、完整性保护协议层位置指示、完整性保护位置的使能指示和完整性保护对象的指示；
    其中，
    所述完整性保护位置的指示用于指示进行完整性保护的网元；
    所述完整性保护协议层位置指示用于指示进行完整性保护的协议层；
    所述完整性保护位置的使能指示用于指示是否开启完整性保护的功能；
    所述完整性保护对象的指示用于指示完整性保护的对象为用户面数据，或者，用户面数据和控制面信令。
  11. 根据权利要求8所述的装置，其特征在于，所述获取模块，具体用于：
    发送第一消息，所述第一消息用于请求建立所述会话；
    接收第二消息，所述第二消息包括所述会话的标识，所述会话对应的完整性保护算法和密钥，以及所述会话对应的DRB的标识。
  12. 根据权利要求9所述的装置，其特征在于，所述获取模块，具体用于：
    发送第一消息，所述第一消息用于请求建立会话，所述会话与所述流对应；
    接收第二消息，所述第二消息包括：所述会话的标识，所述流的标识，所述流对应的DRB的标识，以及所述流对应的完整性保护算法和密钥。
  13. 根据权利要求11所述的装置，其特征在于，
    所述第二消息包括业务数据聚合SDAP层的配置，所述SDAP层的配置包括所述会话的标识，所述会话对应的完整性保护算法和密钥，以及所述会话对应的DRB的标识；或者，
    所述第二消息包括分组数据汇聚协议PDCP层的配置，所述PDCP层的配置包括所述会话的标识，所述会话对应的完整性保护算法和密钥，以及所述会话对应的DRB的标识。
  14. 根据权利要求12所述的装置，其特征在于，
    所述第二消息包括业务数据聚合SDAP层的配置，所述SDAP层的配置包括所述会话的标识，所述流的标识，所述流对应的DRB的标识，以及所述流对应的完整性保护算法和密钥；或者，
    所述第二消息包括分组数据汇聚协议PDCP层的配置，所述PDCP层的配置包括所述会话的标识，所述流的标识，所述流对应的DRB的标识，以及所述流对应的完整性保护算法和密钥。
  15. 一种通信装置，其特征在于，包括处理器，与存储器相连，用于读取并执行所述存储器中存储的程序，以实现如权利要求1-8任一项所述的方法。
  16. 一种终端设备，其特征在于，包括如权利要求9-15任一项所述的装置。
  17. 一种算机可读存储介质，其特征在于，包括程序，所述程序被处理器调用时用于执行如权利要求1-8任一项所述的方法。
  18. 一种数据完整性保护方法，其特征在于，包括：
    终端设备向接入网设备发送第一消息，所述第一消息用于请求建立会话；
    所述终端设备从所述接入网设备接收第二消息，所述第二消息包括所述会话的标识，所述会话对应的无线数据承载DRB的标识，完整性保护算法和密钥；
    所述终端设备使用所述完整性保护算法和所述密钥对所述DRB的数据进行完整性保护。
  19. 根据权利要求18所述的方法，其特征在于，所述第二消息还包括：
    第一指示，所述第一指示用于指示是否开启完整性保护的功能。
  20. 根据权利要求19所述的方法，其特征在于，所述第二消息包括分组数据汇聚层协议PDCP层的配置，所述PDCP层的配置包括所述第一指示。
  21. 根据权利要求18-20任一项所述的方法，其特征在于，所述第二消息还包括：
    第二指示，所述第二指示用于指示进行完整性保护的协议层。
  22. 根据权利要求18-21任一项所述的方法，其特征在于，所述完整性保护的对象为用户面数据。
  23. 根据权利要求18-22任一项所述的方法，其特征在于，所述第二消息包括SDAP层的配置，所述SDAP层的配置包括所述会话的标识，所述SDAP层用于处理流到DRB的映射。
  24. 根据权利要求18-23任一所述的方法，其特征在于，所述DRB的数据为PDCP层的数据包。
  25. 一种通信装置，其特征在于，包括：
    用于向接入网设备发送第一消息的单元或手段，所述第一消息用于请求建立会话；
    用于从所述接入网设备接收第二消息的单元或手段，所述第二消息包括所述会话的标识，所述会话对应的无线数据承载DRB的标识，完整性保护算法和密钥；
    用于使用所述完整性保护算法和所述密钥对所述DRB的数据进行完整性保护的 单元或手段。
  26. 根据权利要求25所述的装置，其特征在于，所述第二消息还包括：
    第一指示，所述第一指示用于指示是否开启完整性保护的功能。
  27. 根据权利要求26所述的装置，其特征在于，所述第二消息包括分组数据汇聚层协议PDCP层的配置，所述PDCP层的配置包括所述第一指示。
  28. 根据权利要求25-27任一项所述的装置，其特征在于，所述第二消息还包括：
    第二指示，所述第二指示用于指示进行完整性保护的协议层。
  29. 根据权利要求25-28任一项所述的装置，其特征在于，所述完整性保护的对象为用户面数据。
  30. 根据权利要求25-29任一项所述的装置，其特征在于，所述第二消息包括SDAP层的配置，所述SDAP层的配置包括所述会话的标识，所述SDAP层用于处理流到DRB的映射。
  31. 根据权利要求25-30任一所述的装置，其特征在于，所述DRB的数据为PDCP层的数据包。
  32. 一种通信装置，其特征在于，包括处理器，与存储器相连，用于读取并执行所述存储器中存储的程序，以实现如权利要求18-24任一项所述的方法。
  33. 一种终端设备，其特征在于，包括如权利要求25-32任一项所述的装置。
  34. 一种算机可读存储介质，其特征在于，包括程序，所述程序被处理器调用时用于执行如权利要求18-24任一项所述的方法。
  35. 一种数据完整性保护方法，其特征在于，包括：
    接入网设备从终端设备接收第一消息，所述第一消息用于请求建立会话；
    所述接入网设备向所述终端设备发送第二消息，所述第二消息包括所述会话的标识，所述会话对应的无线数据承载DRB的标识，完整性保护算法和密钥，其中，所述完整性保护算法和所述密钥用于对所述DRB的数据进行完整性保护。
  36. 根据权利要求35所述的方法，其特征在于，所述第二消息还包括：
    第一指示，所述第一指示用于指示是否开启完整性保护的功能。
  37. 根据权利要求36所述的方法，其特征在于，还包括：
    从核心网设备接收所述第一指示。
  38. 根据权利要求36或37所述的方法，其特征在于，所述第二消息包括分组数据汇聚层协议PDCP层的配置，所述PDCP层的配置包括所述第一指示。
  39. 根据权利要求35-38任一项所述的方法，其特征在于，所述第二消息还包括：
    第二指示，所述第二指示用于指示进行完整性保护的协议层。
  40. 根据权利要求35-39任一项所述的方法，其特征在于，所述完整性保护的对象为用户面数据。
  41. 根据权利要求35-40任一项所述的方法，其特征在于，所述第二消息包括SDAP层的配置，所述SDAP层的配置包括所述会话的标识，所述SDAP层用于处理流到DRB的映射。
  42. 一种通信装置，其特征在于，包括：
    用于从终端设备接收第一消息的单元，所述第一消息用于请求建立会话；
    用于向所述终端设备发送第二消息的单元，所述第二消息包括所述会话的标识，所述会话对应的无线数据承载DRB的标识，完整性保护算法和密钥，其中，所述完整性保护算法和所述密钥用于对所述DRB的数据进行完整性保护。
  43. 根据权利要求42所述的装置，其特征在于，所述第二消息还包括：
    第一指示，所述第一指示用于指示是否开启完整性保护的功能。
  44. 根据权利要求43所述的装置，其特征在于，还包括：
    用于从所述核心网设备接收所述第一指示的单元。
  45. 根据权利要求43或44所述的装置，其特征在于，所述第二消息包括分组数据汇聚层协议PDCP层的配置，所述PDCP层的配置包括所述第一指示。
  46. 根据权利要求42-45任一项所述的装置，其特征在于，所述第二消息还包括：
    第二指示，所述第二指示用于指示进行完整性保护的协议层。
  47. 根据权利要求42-46任一项所述的装置，其特征在于，所述完整性保护的对象为用户面数据。
  48. 根据权利要求42-47任一项所述的装置，其特征在于，所述第二消息包括SDAP层的配置，所述SDAP层的配置包括所述会话的标识，所述SDAP层用于处理流到DRB的映射。
  49. 一种通信装置，其特征在于，包括处理器，与存储器相连，用于读取并执行所述存储器中存储的程序，以实现如权利要求35-41任一项所述的方法。
  50. 一种接入网设备，其特征在于，包括如权利要求42至49任一项所述的装置。
  51. 一种算机可读存储介质，其特征在于，包括程序，所述程序被处理器调用时用于执行如权利要求35-41任一项所述的方法。
  52. 一种数据完整性保护方法，其特征在于，包括：
    核心网设备从接入网设备接收用于请求建立会话的信息；
    所述核心网设备向所述接入网设备发送用于请求接入网设备为所述会话准备资源的消息，其中该消息包括所述会话的标识和第一指示，所述第一指示用于指示是否开启完整性保护的功能。
  53. 一种核心网设备，其特征在于，包括：
    从接入网设备接收用于请求建立会话的信息的单元；
    用于向所述接入网设备发送用于请求接入网设备为所述会话准备资源的消息的单元，其中该消息包括所述会话的标识和第一指示，所述第一指示用于指示是否开启完整性保护的功能。
  54. 一种核心网设备，其特征在于，包括处理器，与存储器相连，用于读取并执行所述存储器中存储的程序，以实现如权利要求52所述的方法。
  55. 一种算机可读存储介质，其特征在于，包括程序，所述程序被处理器调用时用于执行如权利要求52所述的方法。
PCT/CN2018/099916 2017-08-11 2018-08-10 数据完整性保护方法和装置 WO2019029691A1 (zh)

Priority Applications (10)

Application Number Priority Date Filing Date Title
EP21175743.0A EP3934300A1 (en) 2017-08-11 2018-08-10 Data integrity protection method and apparatus
RU2020110041A RU2767778C2 (ru) 2017-08-11 2018-08-10 Способ и устройство защиты целостности данных
CN201880051984.2A CN110999347A (zh) 2017-08-11 2018-08-10 数据完整性保护方法和装置
AU2018315349A AU2018315349B2 (en) 2017-08-11 2018-08-10 Data integrity protection method, communication apparatus, terminal device, access network device, core network device, computer readable medium, and communication system
KR1020207007086A KR102282122B1 (ko) 2017-08-11 2018-08-10 데이터 무결성 보호 방법 및 장치
JP2020508031A JP6978586B2 (ja) 2017-08-11 2018-08-10 データ完全性保護方法および装置
EP18844845.0A EP3585082B1 (en) 2017-08-11 2018-08-10 Data integrity protection method and apparatus
BR112020002766-9A BR112020002766A2 (pt) 2017-08-11 2018-08-10 método de proteção de integridade de dados, aparelho de comunicação, dispositivo terminal, dispositivo de rede de acesso, dispositivo de rede principal, mídia legível por computador, e sistema de comunicação
US16/540,695 US11025645B2 (en) 2017-08-11 2019-08-14 Data integrity protection method and apparatus
US17/330,915 US11818139B2 (en) 2017-08-11 2021-05-26 Data integrity protection method and apparatus

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201710686855.8 2017-08-11
CN201710686855.8A CN109391603B (zh) 2017-08-11 2017-08-11 数据完整性保护方法和装置

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US16/540,695 Continuation US11025645B2 (en) 2017-08-11 2019-08-14 Data integrity protection method and apparatus

Publications (1)

Publication Number Publication Date
WO2019029691A1 true WO2019029691A1 (zh) 2019-02-14

Family

ID=64983156

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/099916 WO2019029691A1 (zh) 2017-08-11 2018-08-10 数据完整性保护方法和装置

Country Status (9)

Country Link
US (2) US11025645B2 (zh)
EP (2) EP3934300A1 (zh)
JP (1) JP6978586B2 (zh)
KR (1) KR102282122B1 (zh)
CN (3) CN109218325B (zh)
AU (1) AU2018315349B2 (zh)
BR (1) BR112020002766A2 (zh)
RU (1) RU2767778C2 (zh)
WO (1) WO2019029691A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111163471A (zh) * 2019-12-26 2020-05-15 北京微智信业科技有限公司 业务数据完整性保护方法、装置、设备及存储介质

Families Citing this family (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
BR112020008401A2 (pt) * 2017-11-08 2020-11-03 Guangdong Oppo Mobile Telecommunications Corp., Ltd. método para controlar uma proteção de integridade, dispositivo de rede e meio de armazenamento para computador
WO2020173859A1 (en) 2019-02-28 2020-09-03 Telefonaktiebolaget Lm Ericsson (Publ) Methods providing management of emergency sessions and related devices and nodes
CN111669750B (zh) * 2019-03-07 2021-08-03 华为技术有限公司 一种pdu会话二次验证的方法及装置
GB2582827A (en) * 2019-04-05 2020-10-07 Nec Corp Communication system
CN111988782B (zh) * 2019-05-23 2022-04-12 华为技术有限公司 安全会话方法和装置
CN110366049B (zh) * 2019-08-05 2021-03-23 杭州当虹科技股份有限公司 一种流式视频完整性保护方法
CN113038604B (zh) * 2019-12-24 2023-03-21 中国电信股份有限公司 无线资源配置方法、装置和***、基站
CN114930890A (zh) * 2020-03-30 2022-08-19 Oppo广东移动通信有限公司 完整性保护方法和通信设备
CN115004634B (zh) * 2020-04-03 2023-12-19 Oppo广东移动通信有限公司 信息处理方法、装置、设备及存储介质
CN116158111B (zh) * 2020-08-10 2024-07-19 华为技术有限公司 一种通信的方法及装置

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102487507A (zh) * 2010-12-01 2012-06-06 中兴通讯股份有限公司 一种实现完整性保护的方法及***
WO2016076628A2 (ko) * 2014-11-11 2016-05-19 삼성전자 주식회사 이동통신 네트워크를 통한 데이터 서비스 제공 방법 및 장치
CN105704753A (zh) * 2014-11-26 2016-06-22 电信科学技术研究院 一种进行数据传输的方法、***和设备

Family Cites Families (31)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20050086477A1 (en) * 2003-10-16 2005-04-21 Taiwan Semiconductor Manufacturing Co. Integrate PGP and Lotus Notes to encrypt / decrypt email
US7477749B2 (en) * 2004-05-12 2009-01-13 Nokia Corporation Integrity protection of streamed content
CN101001252A (zh) * 2006-06-25 2007-07-18 华为技术有限公司 一种注册方法和一种用户面安全算法的协商方法及装置
CN101222322B (zh) 2008-01-24 2010-06-16 中兴通讯股份有限公司 一种超级移动宽带***中安全能力协商的方法
KR101674947B1 (ko) * 2009-04-21 2016-11-10 엘지전자 주식회사 효율적인 보안 관련 처리
CN103188681B (zh) * 2009-09-28 2016-08-10 华为技术有限公司 数据传输方法、装置及***
CN102098676B (zh) * 2010-01-04 2015-08-12 电信科学技术研究院 一种实现完整性保护的方法、装置和***
KR101831448B1 (ko) * 2010-02-02 2018-02-26 엘지전자 주식회사 이동 통신 시스템에서 ｐｄｃｐ 기능을 선택적으로 적용하는 방법
CN101860863A (zh) * 2010-05-21 2010-10-13 中国科学院软件研究所 一种增强的加密及完整性保护方法
JP2012044325A (ja) * 2010-08-16 2012-03-01 Ntt Docomo Inc 移動通信方法及び無線基地局
WO2012055114A1 (en) * 2010-10-29 2012-05-03 Nokia Siemens Networks Oy Security of user plane traffic between relay node and radio access network
ES2530961T3 (es) * 2010-12-10 2015-03-09 Ericsson Telefon Ab L M Habilitación e inhabilitación de la protección de la integridad para portadores de radio de datos
CN102448058B (zh) * 2011-01-10 2014-04-30 华为技术有限公司 一种Un接口上的数据保护方法与装置
CN102595390B (zh) * 2011-01-18 2019-04-05 中兴通讯股份有限公司 一种安全模式的配置方法和终端
CN108566685B (zh) * 2012-06-08 2021-11-30 华为技术有限公司 基站、用户设备及通信方法
CN104919834B (zh) * 2013-01-11 2018-10-19 Lg 电子株式会社 用于在无线通信***中应用安全信息的方法和设备
WO2014201160A1 (en) * 2013-06-11 2014-12-18 Huawei Technologies Co., Ltd. System and method for coordinated remote control of network radio nodes and core network elements
EP2965554B1 (en) * 2013-09-11 2019-07-24 Samsung Electronics Co., Ltd. Method and system to enable secure communication for inter-enb transmission
WO2016159841A1 (en) * 2015-03-31 2016-10-06 Telefonaktiebolaget Lm Ericsson (Publ) Service continuity
US10454686B2 (en) * 2015-04-08 2019-10-22 Telefonaktiebolaget Lm Ericsson (Publ) Method, apparatus, and system for providing encryption or integrity protection in a wireless network
CA2995514C (en) 2015-08-13 2020-04-28 Huawei Technologies Co., Ltd. Message protection method, and related device, and system
WO2017039042A1 (ko) * 2015-09-04 2017-03-09 엘지전자(주) 무선 통신 시스템에서 단말의 데이터 송수신 방법 및 장치
CN107027117A (zh) * 2016-02-02 2017-08-08 普天信息技术有限公司 一种动态生成根密钥的方法
US20190075482A1 (en) * 2016-11-04 2019-03-07 Telefonaktiebolaget Lm Ericsson (Publ) Reflective mapping of flows to radio bearers
JP2020503781A (ja) * 2016-12-29 2020-01-30 エルジー エレクトロニクス インコーポレイティド Ｄｒｂを確立する方法及び装置
CN115278659A (zh) * 2017-01-30 2022-11-01 瑞典爱立信有限公司 针对用户平面数据的完整性保护的方法
US10123210B2 (en) * 2017-03-17 2018-11-06 Nokia Of America Corporation System and method for dynamic activation and deactivation of user plane integrity in wireless networks
KR102359746B1 (ko) * 2017-06-05 2022-02-10 삼성전자 주식회사 차세대 이동통신 시스템에서 인액티브 모드 단말이 데이터를 전송하는 방법 및 장치
KR102394123B1 (ko) * 2017-06-16 2022-05-04 삼성전자 주식회사 차세대 이동 통신 시스템에서 복수 개의 스케쥴링 요청을 전송하는 방법 및 장치
EP3435700B1 (en) * 2017-07-24 2020-09-16 ASUSTek Computer Inc. Method and apparatus for serving quality of service (qos) flow in a wireless communication system
MX2019000419A (es) * 2017-08-10 2019-06-20 Lg Electronics Inc Metodo para realizar un restablecimiento de una entidad pdcp asociada con la entidad um de rlc en un sistema de comunicacion inalambrica y un dispositivo para lo mismo.

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102487507A (zh) * 2010-12-01 2012-06-06 中兴通讯股份有限公司 一种实现完整性保护的方法及***
WO2016076628A2 (ko) * 2014-11-11 2016-05-19 삼성전자 주식회사 이동통신 네트워크를 통한 데이터 서비스 제공 방법 및 장치
CN105704753A (zh) * 2014-11-26 2016-06-22 电信科学技术研究院 一种进行数据传输的方法、***和设备

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
"Consideration on UP integrity configuration", R2-1710314, 3GPP TSG RAN WG2 MEETING #99BIS, 13 October 2017 (2017-10-13), XP051342362 *

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111163471A (zh) * 2019-12-26 2020-05-15 北京微智信业科技有限公司 业务数据完整性保护方法、装置、设备及存储介质
CN111163471B (zh) * 2019-12-26 2021-02-19 北京微智信业科技有限公司 业务数据完整性保护方法、装置、设备及存储介质

Also Published As

Publication number Publication date
CN109391603A (zh) 2019-02-26
CN110999347A (zh) 2020-04-10
US20210352082A1 (en) 2021-11-11
EP3585082B1 (en) 2021-05-26
KR20200036018A (ko) 2020-04-06
RU2020110041A (ru) 2021-09-13
CN109391603B (zh) 2021-07-09
JP6978586B2 (ja) 2021-12-08
CN109218325A (zh) 2019-01-15
BR112020002766A2 (pt) 2020-07-28
EP3585082A1 (en) 2019-12-25
KR102282122B1 (ko) 2021-07-26
EP3934300A1 (en) 2022-01-05
US20190372995A1 (en) 2019-12-05
JP2020530721A (ja) 2020-10-22
US11818139B2 (en) 2023-11-14
AU2018315349A1 (en) 2020-03-19
AU2018315349B2 (en) 2021-03-25
CN109218325B (zh) 2020-03-10
US11025645B2 (en) 2021-06-01
RU2767778C2 (ru) 2022-03-21
RU2020110041A3 (zh) 2021-10-15
EP3585082A4 (en) 2020-01-22

Similar Documents

Publication Publication Date Title
US11818139B2 (en) Data integrity protection method and apparatus
US20230016378A1 (en) Pdu session management
CN108347410B (zh) 安全实现方法、设备以及***
CN108366369B (zh) 一种数据安全传输的方法及接入网、终端、核心网设备
WO2015165051A1 (zh) 数据传输方法及设备
US20200344245A1 (en) Message sending method and apparatus
EP3806529A1 (en) Data transmission method and apparatus
WO2017133021A1 (zh) 一种安全处理方法及相关设备
WO2021254172A1 (zh) 一种通信方法以及相关装置
KR102104844B1 (ko) 데이터 전송 방법， 제1 장치 및 제2 장치
JP2024026229A (ja) Ｓｌユニキャストにおけるセキュリティの改善
WO2020252790A1 (zh) 一种信息传输方法及装置、网络设备、用户设备
US10455472B2 (en) Device and method of handling data transmissions in a wireless communication system
WO2021073382A1 (zh) 注册方法及装置
WO2023011263A1 (zh) 消息传输方法及通信装置
WO2022160275A1 (zh) 无线通信方法、设备及存储介质
WO2021233358A1 (zh) 通信方法及装置
EP4376461A1 (en) Method and device for operating terminal in wireless communication system

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18844845

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2018844845

Country of ref document: EP

Effective date: 20190916

ENP Entry into the national phase

Ref document number: 2020508031

Country of ref document: JP

Kind code of ref document: A

NENP Non-entry into the national phase

Ref country code: DE

REG Reference to national code

Ref country code: BR

Ref legal event code: B01A

Ref document number: 112020002766

Country of ref document: BR

ENP Entry into the national phase

Ref document number: 20207007086

Country of ref document: KR

Kind code of ref document: A

ENP Entry into the national phase

Ref document number: 2018315349

Country of ref document: AU

Date of ref document: 20180810

Kind code of ref document: A

ENP Entry into the national phase

Ref document number: 112020002766

Country of ref document: BR

Kind code of ref document: A2

Effective date: 20200210