WO2020155157A1 - 切换过程中安全信息的处理方法及装置、网络设备、终端 - Google Patents

切换过程中安全信息的处理方法及装置、网络设备、终端 Download PDF

Info

Publication number
WO2020155157A1
WO2020155157A1 PCT/CN2019/074628 CN2019074628W WO2020155157A1 WO 2020155157 A1 WO2020155157 A1 WO 2020155157A1 CN 2019074628 W CN2019074628 W CN 2019074628W WO 2020155157 A1 WO2020155157 A1 WO 2020155157A1
Authority
WO
WIPO (PCT)
Prior art keywords
base station
target base
terminal
key
handover
Prior art date
Application number
PCT/CN2019/074628
Other languages
English (en)
French (fr)
Inventor
尤心
卢前溪
Original Assignee
Oppo广东移动通信有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Oppo广东移动通信有限公司 filed Critical Oppo广东移动通信有限公司
Priority to PCT/CN2019/074628 priority Critical patent/WO2020155157A1/zh
Priority to CN201980073085.7A priority patent/CN112956236B/zh
Publication of WO2020155157A1 publication Critical patent/WO2020155157A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W36/00—Hand-off or reselection arrangements

Definitions

  • the embodiments of the present application relate to the field of mobile communication technology, and in particular to a method and device, network equipment, and terminal for processing security information in a handover process.
  • the handover process includes a handover preparation process, a handover execution process, and a handover completion process.
  • the handover preparation process includes cell measurement by the terminal, measurement report by the terminal, and handover command issued by the network.
  • the terminal When the terminal is successfully handed over to a target base station, it will be considered that the handover is complete. For the next handover, a handover preparation process is still required.
  • the redundant handover preparation process will bring additional signaling overhead. How to support continuous handover of the terminal, especially continuous handover
  • the update of the security key in China is a problem to be solved.
  • the embodiments of the present application provide a method and device, network equipment, and terminal for processing security information in the handover process.
  • the source base station generates multiple corresponding first keys for multiple target base stations
  • the source base station sends the multiple first keys to the multiple target base stations respectively, and the first keys are used for communication between the target base station and the terminal.
  • the terminal receives a handover command sent by a source base station, where the handover command includes first configuration information and handover conditions of multiple target base stations;
  • the terminal determines that the first target base station among the multiple target base stations meets the handover condition, generating a first key corresponding to the first target base station, and accessing the first target base station, The first key corresponding to the first target base station is used for the terminal to communicate with the first target base station;
  • the terminal After the terminal successfully accesses the first target base station, it retains all or part of the information carried in the handover command.
  • the device for processing security information in the handover process provided by the embodiment of the present application is applied to a source base station, and the device includes:
  • a generating unit configured to generate multiple corresponding first keys for multiple target base stations
  • the sending unit is configured to send the multiple first keys to the multiple target base stations respectively, and the first keys are used for the target base station to communicate with the terminal.
  • the device for processing security information in the handover process provided by the embodiment of the present application is applied to a terminal, and the device includes:
  • a receiving unit configured to receive a handover command sent by a source base station, where the handover command includes first configuration information and handover conditions of multiple target base stations;
  • a generating unit configured to generate a first key corresponding to the first target base station and access to the first target base station when it is determined that the first target base station of the multiple target base stations meets the handover condition
  • a target base station where a first key corresponding to the first target base station is used for the terminal to communicate with the first target base station
  • the saving unit is configured to retain all or part of the information carried in the handover command after successfully accessing the first target base station.
  • the network device provided by the embodiment of the present application includes a processor and a memory.
  • the memory is used to store a computer program
  • the processor is used to call and run the computer program stored in the memory to execute the method for processing security information in the switching process described above.
  • the terminal provided in the embodiment of the present application includes a processor and a memory.
  • the memory is used to store a computer program
  • the processor is used to call and run the computer program stored in the memory to execute the method for processing security information in the switching process described above.
  • the chip provided in the embodiment of the present application is used to implement the above-mentioned method for processing security information in the handover process.
  • the chip includes a processor, which is used to call and run a computer program from the memory, so that the device installed with the chip executes the method for processing security information in the switching process described above.
  • the computer-readable storage medium provided by the embodiment of the present application is used to store a computer program, and the computer program enables the computer to execute the above-mentioned method for processing security information in the switching process.
  • the computer program product provided by the embodiment of the present application includes computer program instructions that cause the computer to execute the above-mentioned method for processing security information in the switching process.
  • the computer program provided in the embodiment of the present application when it runs on a computer, causes the computer to execute the above-mentioned method for processing security information in the switching process.
  • multiple target base stations are configured in the handover command.
  • the terminal successfully accesses a target base station all or part of the information carried in the handover command is retained, so as to perform continuous handover of the next target base station to avoid A redundant handover preparation process; on the other hand, it realizes the update of the security key during continuous handover, ensuring the security of communication.
  • FIG. 1 is a schematic diagram of a communication system architecture provided by an embodiment of this application.
  • FIG. 2 is a handover flowchart provided by an embodiment of the application
  • FIG. 3 is a flowchart of Conditional Handover provided by an embodiment of the application.
  • Figure 4 is a schematic diagram of key derivation provided by an embodiment of the application.
  • FIG. 5 is a schematic diagram of key update during the handover process provided by an embodiment of the application.
  • FIG. 6 is a first schematic flowchart of a method for processing security information in a handover process provided by an embodiment of this application;
  • Figure 7(a) is a schematic diagram 1 of an application scenario provided by an embodiment of this application.
  • Figure 7(b) is a second schematic diagram of an application scenario provided by an embodiment of this application.
  • FIG. 8 is a second schematic flowchart of a method for processing security information in a handover process provided by an embodiment of the application.
  • FIG. 9 is a third schematic flowchart of a method for processing security information in a handover process provided by an embodiment of the application.
  • FIG. 10 is a fourth schematic flowchart of a method for processing security information in a handover process provided by an embodiment of this application.
  • FIG. 11 is a schematic diagram 1 of the structural composition of the device for processing security information in the handover process provided by an embodiment of the application;
  • FIG. 12 is a schematic diagram 2 of the structural composition of the device for processing security information in the handover process provided by an embodiment of the application;
  • FIG. 13 is a schematic structural diagram of a communication device provided by an embodiment of this application.
  • FIG. 14 is a schematic structural diagram of a chip according to an embodiment of the application.
  • FIG. 15 is a schematic block diagram of a communication system provided by an embodiment of this application.
  • GSM Global System of Mobile Communication
  • CDMA Code Division Multiple Access
  • WCDMA Wideband Code Division Multiple Access
  • GPRS General Packet Radio Service
  • LTE Long Term Evolution
  • FDD Frequency Division Duplex
  • TDD Time Division Duplex
  • UMTS Universal Mobile Telecommunication System
  • WiMAX Worldwide Interoperability for Microwave Access
  • the communication system 100 applied in the embodiment of the present application is shown in FIG. 1.
  • the communication system 100 may include a network device 110, and the network device 110 may be a device that communicates with a terminal 120 (or called a communication terminal or a terminal).
  • the network device 110 may provide communication coverage for a specific geographic area, and may communicate with terminals located in the coverage area.
  • the network device 110 may be a base station (Base Transceiver Station, BTS) in a GSM system or a CDMA system, a base station (NodeB, NB) in a WCDMA system, or an evolved base station in an LTE system (Evolutional Node B, eNB or eNodeB), or the wireless controller in the Cloud Radio Access Network (CRAN), or the network equipment can be a mobile switching center, a relay station, an access point, a vehicle-mounted device, Wearable devices, hubs, switches, bridges, routers, network side devices in 5G networks, or network devices in the future evolution of public land mobile networks (Public Land Mobile Network, PLMN), etc.
  • BTS Base Transceiver Station
  • NodeB, NB base station
  • LTE Long Term Evolutional Node B
  • eNB evolved base station
  • CRAN Cloud Radio Access Network
  • the network equipment can be a mobile switching center, a relay station, an access point, a vehicle-mounted device, Wearable devices, hub
  • the communication system 100 also includes at least one terminal 120 located within the coverage area of the network device 110.
  • the "terminal” used here includes, but is not limited to, connection via a wired line, such as via a public switched telephone network (PSTN), digital subscriber line (Digital Subscriber Line, DSL), digital cable, and direct cable connection; And/or another data connection/network; and/or via a wireless interface, such as for cellular networks, wireless local area networks (WLAN), digital TV networks such as DVB-H networks, satellite networks, AM-FM Broadcast transmitter; and/or another terminal's device configured to receive/send communication signals; and/or Internet of Things (IoT) equipment.
  • PSTN public switched telephone network
  • DSL Digital Subscriber Line
  • DSL Digital Subscriber Line
  • DSL Digital Subscriber Line
  • DSL Digital Subscriber Line
  • DSL Digital Subscriber Line
  • DSL Digital Subscriber Line
  • DSL Digital Subscriber Line
  • DSL Digital Subscriber Line
  • DSL Digital Subscriber Line
  • DSL Digital Subscriber Line
  • a terminal set to communicate through a wireless interface may be referred to as a "wireless communication terminal", a “wireless terminal” or a “mobile terminal”.
  • mobile terminals include, but are not limited to, satellites or cellular phones; Personal Communications System (PCS) terminals that can combine cellular radio phones with data processing, fax, and data communication capabilities; can include radio phones, pagers, Internet/intranet PDA with internet access, web browser, memo pad, calendar, and/or Global Positioning System (GPS) receiver; and conventional laptop and/or palmtop receivers or others including radio phone transceivers Electronic device.
  • PCS Personal Communications System
  • GPS Global Positioning System
  • Terminal can refer to access terminal, user equipment (UE), user unit, user station, mobile station, mobile station, remote station, remote terminal, mobile device, user terminal, terminal, wireless communication device, user agent or user Device.
  • the access terminal can be a cellular phone, a cordless phone, a Session Initiation Protocol (SIP) phone, a wireless local loop (Wireless Local Loop, WLL) station, a personal digital processing (Personal Digital Assistant, PDA), with wireless communication Functional handheld devices, computing devices or other processing devices connected to wireless modems, in-vehicle devices, wearable devices, terminals in 5G networks, or terminals in the future evolution of PLMN, etc.
  • SIP Session Initiation Protocol
  • WLL Wireless Local Loop
  • PDA Personal Digital Assistant
  • direct terminal connection (Device to Device, D2D) communication may be performed between the terminals 120.
  • the 5G system or 5G network may also be referred to as a New Radio (NR) system or NR network.
  • NR New Radio
  • FIG. 1 exemplarily shows one network device and two terminals.
  • the communication system 100 may include multiple network devices and the coverage of each network device may include other numbers of terminals. This embodiment of the present application There is no restriction on this.
  • the communication system 100 may also include other network entities such as a network controller and a mobility management entity, which are not limited in the embodiment of the present application.
  • network entities such as a network controller and a mobility management entity, which are not limited in the embodiment of the present application.
  • the devices with communication functions in the network/system in the embodiments of the present application may be referred to as communication devices.
  • the communication device may include a network device 110 and a terminal 120 with communication functions.
  • the network device 110 and the terminal 120 may be the specific devices described above, which will not be repeated here;
  • the device may also include other devices in the communication system 100, such as other network entities such as a network controller and a mobility management entity, which are not limited in the embodiment of the present application.
  • Fig. 2 is a handover flow chart provided by an embodiment of this application. The process mainly includes the following steps:
  • the source base station delivers the measurement configuration to the terminal.
  • the terminal performs related measurements based on the measurement configuration, and reports the measurement results to the source base station.
  • the source base station makes a handover decision based on the measurement result (Handove Decision).
  • the source base station initiates a handover request (Handover Request) to the target base station.
  • the target base station performs admission control (Admission Control).
  • the target base station sends a handover request-acknowledgement feedback message (Handover Request Ack) to the source base station.
  • Handover Request Ack a handover request-acknowledgement feedback message
  • the source base station sends an RRC connection reconfiguration message to the terminal, where the RRC connection reconfiguration message carries mobility control information (mobilityControlInformation) of the target base station.
  • mobilityControlInformation mobility control information
  • the RRC connection reconfiguration message is carried in the handover command.
  • the source base station forwards the SN status (SN Status Transfer) to the target base station.
  • the terminal synchronizes to the target base station.
  • the target base station performs periodic uplink allocation (Periodic UL allocation) to the terminal.
  • the target base station configures an uplink allocation and tracking area (Tracking Area, TA) for the terminal.
  • Tracking Area Tracking Area
  • the terminal sends an RRC connection reconfiguration complete message to the target base station.
  • the target base station initiates a path switching request to the MME.
  • the MME initiates a bearer modification request to the Serving Gateway.
  • the serving gateway switches the downlink path.
  • the serving gateway sends a modify bearer response message to the MME.
  • the MME sends a path switching request-confirmation feedback message to the target base station.
  • the target base station notifies the source base station to release the terminal context.
  • the source base station releases resources.
  • the handover process in Figure 2 above mainly includes the following processes:
  • the source base station configures the terminal to perform measurement report, and sends a handover request to the target base station based on the report result of the terminal.
  • the target base station agrees to the switch request, it will configure the RRC message for the terminal.
  • the RRC message carries mobility control information (mobility Control Information), including random access channel (Random Access Channel, RACH) resources, cell radio network temporary identification (Cell- Radio Network Temporary Identifier (C-RNTI), target base station security algorithm, and target base station system information, etc.
  • mobility Control Information including random access channel (Random Access Channel, RACH) resources, cell radio network temporary identification (Cell- Radio Network Temporary Identifier (C-RNTI), target base station security algorithm, and target base station system information, etc.
  • the source base station forwards the mobilityControlInformation to the terminal through a handover command. After receiving the handover command, the terminal initiates a random access procedure to the target base station. At the same time, the source base station will forward the serial number status (Serial Number STATUS TRANSFER, SN STATUS TRANSFER) to the target base station to inform the target base station of the uplink packet data convergence protocol (Packet Data Convergence Protocol, PDCP) SN reception status and downlink PDCP SN transmission status.
  • serial Number STATUS TRANSFER Serial Number STATUS TRANSFER
  • SN STATUS TRANSFER Packet Data Convergence Protocol
  • Steps 12-18 in Figure 2 When the terminal successfully accesses the target base station (that is, the random access is successful), the target base station will initiate a path switch request (PATH SWITCH REQUEST) to request the mobility management entity (Mobility Management Entity (MME) switches the downlink path. After the path switching is completed, the target base station will instruct the source base station to release the terminal context, and the switching is complete.
  • PATH SWITCH REQUEST path switch request
  • MME Mobility Management Entity
  • Conditional handover avoids the problem that the handover preparation time is too long, causing the terminal to switch too late, and the handover command is configured for the terminal in advance.
  • the terminal's operating trajectory is specific, so the base station can allocate the target base station to the terminal in advance, and the handover command includes the condition for triggering the terminal to switch (hereinafter referred to as the handover condition).
  • the handover condition is met, the terminal initiates an access request to the target base station.
  • multiple target base stations that is, multiple target cells
  • handover conditions can be configured in the handover command in the Conditional Handover scenario.
  • the terminal judges which target cell to access based on the configured handover condition.
  • Conditional Handover mainly includes the following processes:
  • the source base station delivers the measurement configuration to the terminal, and the terminal performs related measurements based on the measurement configuration and reports the measurement result to the source base station.
  • the source base station issues a handover command to the terminal, and the handover command carries configuration information and handover conditions of multiple target base stations.
  • the terminal synchronizes to the target base station (that is, the terminal accesses the target base station).
  • key derivation includes the following two types:
  • K NG-RAN* is generated based on the K gNB and the physical cell identity (PCI) of the target cell (the cell of the target base station) and the downlink frequency (DL frequency).
  • PCI physical cell identity
  • K NG-RAN* is generated based on the PCI of the next hop (Next Hop, NH) and the target cell (cell of the target base station) and the downlink frequency (DL frequency). Further, NH can be generated based on the Next hop Chaining Counter (NCC).
  • NCC Next hop Chaining Counter
  • the base station is a gNB as an example, the original key is denoted as K gNB , and the new derived key is denoted as K NG-RAN* or K gNB* . If the base station is an eNB, the original key is recorded as K eNB , and the new derived key is recorded as K eNB* .
  • the data communicated between the base station and the terminal is encrypted and transmitted with a key and some other parameters and then an encryption algorithm.
  • the key used by the base station and the key used by the terminal must be consistent.
  • the terminal accesses the target In the case of a base station the terminal and the target base station need to determine the key used by themselves through the horizontal derivation of the key or the vertical derivation of the key.
  • the source base station sends a handover request message to the target base station.
  • the handover request message carries the security capability of the terminal, the security algorithm used by the source base station, K NG-RAN* , and NCC.
  • K NG-RAN* is generated by the source base station according to the PCI and downlink frequency of the target base station.
  • the target base station takes K NG-RAN* as K gNB and saves it after being associated with the NCC.
  • the target base station sends the NCC and the security algorithm selected by the target base station to the source base station, and the source base station sends a handover command to the terminal.
  • the handover command carries the NCC, the security algorithm selected by the target base station.
  • the terminal synchronizes NH according to the received NCC, calculates K gNB , and saves it after being associated with the NCC.
  • the terminal sends a handover complete message to the target base station.
  • the target base station sends a path switching request message to the target access and mobility management entity (T-AMF, Target-Access and Mobility Management Function).
  • T-AMF Target-Access and Mobility Management Function
  • the T-AMF sends a path switch request-confirmation feedback message to the target base station, and the path switch request-confirmation feedback message carries ⁇ NH,NCC ⁇ .
  • the target base station saves ⁇ NH,NCC ⁇ , and it will be switched over next time.
  • the terminal initiates an intra cell handover process to the target base station.
  • the target base station will receive K NG-RAN* as K gNB to communicate with the terminal; associate the NCC received from the source base station with the K gNB ; include the NCC in the handover command and send it to the terminal through the source base station ; After the switching is completed, the target base station sends a path switching request to the T-AMF.
  • the K NG-RAN* is generated based on the K gNB and the PCI of the target base station and the downlink frequency; if the terminal receives the handover command The received NCC is different from the NCC associated with the K gNB on the current terminal side.
  • NH is generated based on the saved NCC, and K NG-RAN* is generated based on the generated NH and the PCI and downlink frequency of the target base station; the terminal will use the generated K NG -RAN* communicates with the target base station as K gN B.
  • the base station is a gNB as an example, the original key is denoted as K gNB , and the new derived key is denoted as K NG-RAN* or K gNB* . If the base station is an eNB, the original key is recorded as K eNB , and the new derived key is recorded as K eNB* .
  • an embodiment of the present application proposes a method for supporting continuous handover of a terminal, which realizes the update of the security key in the continuous handover.
  • FIG. 6 is a schematic flow chart 1 of a method for processing security information during a handover provided by an embodiment of the application. As shown in FIG. 6, the method for processing security information during a handover includes the following steps:
  • Step 601 The source base station generates multiple corresponding first keys for multiple target base stations.
  • the source base station and the target base station can be, but are not limited to, gNB, eNB, NG-gNB, and so on. Further, the types of the source base station and the target base station may be the same or different.
  • the embodiments of the present application may be applied to a Conditional Handover scenario, in which a source base station sends a handover command to a terminal, and the handover command includes the first configuration information and handover conditions of the multiple target base stations.
  • the first configuration information is, for example, an RRC connection reconfiguration message.
  • the switching condition is, for example, a reference signal receiving power (Reference Signal Receiving Power, RSRP) threshold.
  • RSRP Reference Signal Receiving Power
  • the terminal determines that the first target base station among the multiple target base stations meets the handover condition (for example, the RSRP measurement value of the first target base station is greater than or equal to the RSRP threshold), it accesses the first target base station. After the terminal successfully accesses the first target base station, all or part of the information carried in the handover command is retained.
  • the terminal's operating trajectory is specific, starting from the source base station, and sequentially connecting to the target base station 1, target base station 2, ..., target base station 6.
  • This kind of scene terminal does not go back.
  • the terminal After the terminal successfully accesses the target base station 1, the first configuration information except for the target base station 1 is reserved for use in the next continuous handover.
  • the terminal detects that the target base station 2 satisfies the handover conditions during the movement of the terminal, and after successfully accessing the target base station 2, the first configuration information other than the target base station 2 is retained for use in the next continuous handover.
  • continuous switching is realized and redundant switching preparation procedures are avoided.
  • the running track of the terminal is unpredictable, starting from the source base station, and randomly accessing to any one of the target base station 1 to the target base station 6.
  • the terminal successfully accesses the target base station 1 it continues to retain the first configuration information of the 6 target base stations for use in the next continuous handover.
  • the terminal detects that the target base station 6 meets the handover conditions during the movement of the terminal after successfully accessing the target base station 6, the first configuration information of the six target base stations will continue to be retained for use in the next continuous handover.
  • continuous switching is realized and redundant switching preparation procedures are avoided.
  • the source base station generates multiple corresponding first keys for multiple target base stations, and sends the multiple first keys to the multiple target base stations respectively, and the first keys are used for
  • the target base station communicates with the terminal. It should be noted that the data communicated between the base station and the terminal is encrypted and transmitted with a key and some other parameters and then an encryption algorithm. The key used by the base station and the key used by the terminal need to be consistent.
  • Step 602 The source base station sends the multiple first keys to the multiple target base stations respectively, and the first keys are used for communication between the target base station and the terminal.
  • the source base station generates multiple corresponding first keys for multiple target base stations, which can be implemented in the following manner:
  • Manner 1 The source base station generates multiple first keys corresponding to multiple target base stations based on the second key of the source base station, and the second key is used for communication between the source base station and the terminal.
  • the source base station sends the multiple first keys to the multiple target base stations respectively.
  • the source base station After the source base station generates multiple first keys corresponding to the multiple target base stations based on the second key of the source base station, the respective first keys of the multiple target base stations are no longer updated.
  • the source base station For each target base station of the multiple target base stations, the source base station generates a second key corresponding to the target base station based on the second key of the source base station and the PCI and/or downlink frequency information of the target base station. A key, and send the first key to the target base station.
  • the second key of the source base station is K gNB , assuming that the handover command configures 3 target base stations, namely target base station 1, target base station 2, and target base station 3.
  • the source base station For the target base station 1, the source base station generates K1 NG-RAN* based on K gNB , the PCI of the target base station 1, and the downlink frequency.
  • the target base station 2 For the target base station 2, the source base station generates K2 NG-RAN* based on K gNB , the PCI of the target base station 2 and the downlink frequency.
  • the source base station generates K3 NG-RAN* based on K gNB , the PCI of the target base station 3 and the downlink frequency.
  • the source base station receives first indication information sent by a terminal or a first target base station among multiple target base stations, where the first indication information is used to indicate that the terminal successfully accesses the first target base station, so
  • the first indication information carries the first key corresponding to the first target base station;
  • the source base station generates the first key corresponding to the first target base station based on the first key corresponding to the first target base station.
  • the first key corresponding to the target base station other than the target base station.
  • the source base station sends the first keys corresponding to the other target base stations to the other target base stations respectively.
  • the target base station accessed will change.
  • the first key received by the source base station of the target base station currently accessed by the terminal will be continuously updated, and the source base station will renew based on the updated first key.
  • the first keys of other target base stations are generated, and it can be seen that the first keys of other target base stations will be updated.
  • the source base station For each target base station among the other target base stations, the source base station generates the corresponding target base station based on the first key corresponding to the first target base station and the PCI and/or downlink frequency information of the target base station. And send the first key to the target base station.
  • the handover command configures 3 target base stations, namely target base station 1, target base station 2, and target base station 3.
  • the terminal or the target base station 1 sends the first key of the target base station 1 to the source base station.
  • the source base station generates the first key of target base station 2 based on the first key of target base station 1, the PCI of target base station 2 and the downlink frequency; the source base station generates the first key of target base station 2 based on the first key of target base station 1, the PCI of target base station 3 and the downlink frequency
  • the first key of the target base station 3 is generated.
  • the source base station issues the first key of the target base station 2 and the first key of the target base station 3 to the target base station 2 and the target base station 3 respectively. After that, the terminal continues to move and continuously monitors the channel quality of other configured target base stations. When the target base station 2 meets the handover condition, the terminal accesses the target base station 2, and uses the first key of the target base station 2 to perform the communication with the target base station 2. Communication.
  • the other target base stations may update the feedback configuration information.
  • the terminal can actively report operating scenarios (such as high-speed movement or movement under high-frequency conditions) to facilitate the base station to configure Conditional Handover.
  • operating scenarios such as high-speed movement or movement under high-frequency conditions
  • the source base station will regenerate the first secret keys of other target base stations based on the first secret key of the target base station newly accessed by the terminal.
  • FIG. 8 is a schematic diagram of the second flow of a method for processing security information during a handover provided by an embodiment of the application. As shown in FIG. 8, the method for processing security information during a handover includes the following steps:
  • Step 801 A terminal receives a handover command sent by a source base station, where the handover command includes first configuration information and handover conditions of multiple target base stations.
  • the terminal may be any device capable of communicating with the network, such as a mobile phone, a tablet computer, a notebook, a vehicle-mounted terminal, and a wearable device.
  • the embodiments of the present application may be applied to a conditional handover scenario, in which a terminal receives a handover command sent by a source base station, and the handover command includes first configuration information and handover conditions of multiple target base stations.
  • the first configuration information is, for example, an RRC connection reconfiguration message.
  • the switching condition is, for example, an RSRP threshold.
  • Step 802 When the terminal determines that the first target base station among the multiple target base stations meets the handover condition, it generates a first key corresponding to the first target base station, and accesses the first target base station.
  • the terminal when the terminal determines that the first target base station of the multiple target base stations meets the handover condition (for example, the RSRP measurement value of the first target base station is greater than or equal to the RSRP threshold), it generates the first target base station corresponding to the first target base station. And access to the first target base station, and the first key corresponding to the first target base station is used for the terminal to communicate with the first target base station.
  • the handover condition for example, the RSRP measurement value of the first target base station is greater than or equal to the RSRP threshold
  • the terminal generating the first key corresponding to the first target base station can be implemented in the following manner:
  • Manner 1 The terminal generates a first key corresponding to the first target base station based on the second key of the source base station, and the second key is used for communication between the source base station and the terminal.
  • the terminal generates a first key corresponding to the first target base station based on the second key of the source base station and the PCI and/or downlink frequency information of the first target base station.
  • the second key of the source base station is K gNB , assuming that the handover command configures 3 target base stations, namely target base station 1, target base station 2, and target base station 3.
  • the terminal accesses the target base station 1, based on the K gNB , the PCI and the downlink frequency of the target base station 1 generate K1 NG-RAN* , and use the K1 NG-RAN* as the K gNB to communicate with the target base station 1.
  • a K2 NG-RAN* is generated based on the K gNB , the PCI of the target base station 2 and the downlink frequency, and the K2 NG-RAN* is used as the K gNB to communicate with the target base station 2.
  • a K3 NG-RAN* is generated based on the K gNB , the PCI of the target base station 3 and the downlink frequency, and the K3 NG-RAN* is used as the K gNB to communicate with the target base station 3.
  • other cell identification information can be added during key derivation based on the second key, and this identification information will be carried in the handover command.
  • Manner 2 The terminal generates the first key corresponding to the first target base station based on the latest key of the terminal.
  • the terminal generates the first key corresponding to the first target base station based on the latest key of the terminal and the PCI and/or downlink frequency information of the first target base station.
  • the latest key of the terminal is the second key of the source base station; or, the latest key of the terminal is the first key corresponding to the second target base station among the multiple target base stations, so
  • the second target base station is a target base station accessed by the terminal before accessing the first target base station.
  • the handover command configures 3 target base stations, namely target base station 1, target base station 2, and target base station 3.
  • the terminal uses the first key of the target base station 1 to communicate with the target base station 1.
  • the terminal uses the first key of the target base station 1, the PCI of the target base station 2 and the downlink frequency to generate the first key of the target base station 2, using the first key of the target base station 2 and the target base station 2 to communicate.
  • the terminal After the terminal successfully accesses the target base station 3, the terminal uses the first key of the target base station 2, the PCI of the target base station 3 and the downlink frequency to generate the first key of the target base station 3, using the first key of the target base station 3 and the target base station 3 to communicate.
  • Step 803 After the terminal successfully accesses the first target base station, it retains all or part of the information carried in the handover command.
  • the terminal's operating trajectory is specific, starting from the source base station, and sequentially connecting to the target base station 1, target base station 2, ..., target base station 6.
  • This kind of scene terminal does not go back.
  • the terminal After the terminal successfully accesses the target base station 1, the first configuration information except for the target base station 1 is reserved for use in the next continuous handover.
  • the terminal detects that the target base station 2 satisfies the handover conditions during the movement of the terminal, and after successfully accessing the target base station 2, the first configuration information other than the target base station 2 is retained for use in the next continuous handover.
  • continuous switching is realized and redundant switching preparation procedures are avoided.
  • the running track of the terminal is unpredictable, starting from the source base station, and randomly accessing to any one of the target base station 1 to the target base station 6.
  • the terminal successfully accesses the target base station 1 it continues to retain the first configuration information of the 6 target base stations for use in the next continuous handover.
  • the terminal detects that the target base station 6 meets the handover conditions during the movement of the terminal after successfully accessing the target base station 6, the first configuration information of the six target base stations will continue to be retained for use in the next continuous handover.
  • continuous switching is realized and redundant switching preparation procedures are avoided.
  • FIG. 9 is the third schematic flowchart of the method for processing security information in the handover process provided by an embodiment of the application. As shown in FIG. 9, the process includes the following steps:
  • the source base station generates K eNB* based on K eNB .
  • the key of the source base station is K eNB
  • the K eNB is used for communication between the target base station 1 and the terminal.
  • the source base station sends a handover command to the terminal.
  • the handover command carries RRC reconfiguration messages and handover conditions of multiple target base stations.
  • two target base stations are taken as examples, namely target base station 1 and target base station 2.
  • the target base station 1 sends a path switching request message to the MME.
  • the MME sends a path switching response message to the target base station 1.
  • the K eNB is used for communication between the target base station 2 and the terminal.
  • FIG. 10 is a schematic flowchart 4 of a method for processing security information in a handover process provided by an embodiment of the application. As shown in FIG. 10, the process includes the following steps:
  • the source base station generates K eNB* based on K eNB .
  • the key of the source base station is K eNB
  • the K eNB is used for communication between the target base station 1 and the terminal.
  • the source base station sends a handover command to the terminal.
  • the handover command carries RRC reconfiguration messages and handover conditions of multiple target base stations.
  • three target base stations are taken as examples, which are target base station 1, target base station 2, and target base station 3.
  • a random access procedure is performed between the terminal and the target base station 1.
  • the K eNB is used for communication between the target base station 2 and the terminal.
  • a random access procedure is performed between the terminal and the target base station 2.
  • the K eNB is used for communication between the target base station 3 and the terminal.
  • a random access procedure is performed between the terminal and the target base station 3.
  • inter-NB inter-NodeB
  • intra-NB intra-NodeB
  • switch cell handover for inter-NB refers to handover between two cells belonging to different target base stations.
  • cell handover for intra-NB refers to handover between two cells belonging to the same target base station.
  • FIG. 11 is a schematic diagram 1 of the structural composition of a device for processing security information during a handover provided by an embodiment of the application.
  • the device is applied to a source base station. As shown in FIG. 11, the device includes:
  • the generating unit 1101 is configured to generate multiple corresponding first keys for multiple target base stations
  • the sending unit 1102 is configured to send the multiple first keys to the multiple target base stations respectively, and the first keys are used for the target base station to communicate with the terminal.
  • the generating unit 1101 is configured to generate multiple first keys corresponding to multiple target base stations based on the second key of the source base station, and the second key is used for the source base station.
  • the base station communicates with the terminal.
  • the generating unit 1101 for each of the multiple target base stations, the generating unit 1101 generates the target base station based on the second key of the source base station and the PCI and/or downlink frequency information of the target base station. The first key corresponding to the target base station.
  • the device further includes:
  • the receiving unit 1103 is configured to receive first indication information sent by a terminal or a first target base station among multiple target base stations, where the first indication information is used to indicate that the terminal successfully accesses the first target base station, and The first indication information carries the first key corresponding to the first target base station;
  • the generating unit 1101 is configured to generate, based on the first key corresponding to the first target base station, a first key corresponding to other target base stations among the multiple target base stations except the first target base station;
  • the sending unit 1102 is configured to send the first keys corresponding to the other target base stations to the other target base stations respectively.
  • the generating unit 1101 is based on the first key corresponding to the first target base station and the PCI and/or downlink frequency information of the target base station Generate the first key corresponding to the target base station.
  • the sending unit 1102 is further configured to send a handover command to the terminal, where the handover command includes first configuration information and handover conditions of the multiple target base stations.
  • FIG. 12 is a second structural diagram of the device for processing security information in the handover process provided by an embodiment of this application.
  • the device is applied to a terminal. As shown in FIG. 12, the device includes:
  • the receiving unit 1201 is configured to receive a handover command sent by a source base station, where the handover command includes first configuration information and handover conditions of multiple target base stations;
  • the generating unit 1202 is configured to generate a first key corresponding to the first target base station, and access to the first target base station when it is determined that the first target base station of the multiple target base stations meets the handover condition.
  • the saving unit 1203 is configured to retain all or part of the information carried in the handover command after successfully accessing the first target base station.
  • the generating unit 1202 is configured to generate a first key corresponding to the first target base station based on a second key of the source base station, and the second key is used for the source base station.
  • the base station communicates with the terminal.
  • the generating unit 1202 is configured to generate the first target base station corresponding to the first target base station based on the second key of the source base station and the PCI and/or downlink frequency information of the first target base station. Key.
  • the generating unit 1202 is configured to generate a first key corresponding to the first target base station based on the latest key of the terminal.
  • the generating unit 1202 is configured to generate a first key corresponding to the first target base station based on the latest key of the terminal and the PCI and/or downlink frequency information of the first target base station .
  • the latest key of the terminal is the second key of the source base station; or,
  • the latest key of the terminal is the first key corresponding to the second target base station among the multiple target base stations, and the second target base station is the terminal accessed before the first target base station is accessed.
  • the target base station is the latest key corresponding to the second target base station among the multiple target base stations.
  • FIG. 13 is a schematic structural diagram of a communication device 600 according to an embodiment of the present application.
  • the communication device can be a network device, such as a base station, or a terminal.
  • the communication device 600 shown in FIG. 13 includes a processor 610.
  • the processor 610 can call and run a computer program from a memory to implement the method.
  • the communication device 600 may further include a memory 620.
  • the processor 610 can call and run a computer program from the memory 620 to implement the method in the embodiment of the present application.
  • the memory 620 may be a separate device independent of the processor 610, or may be integrated in the processor 610.
  • the communication device 600 may further include a transceiver 630, and the processor 610 may control the transceiver 630 to communicate with other devices. Specifically, it may send information or data to other devices, or receive other devices. Information or data sent by the device.
  • the transceiver 630 may include a transmitter and a receiver.
  • the transceiver 630 may further include an antenna, and the number of antennas may be one or more.
  • the communication device 600 may specifically be a network device in an embodiment of the present application, and the communication device 600 may implement the corresponding process implemented by the network device in each method of the embodiment of the present application. For the sake of brevity, it will not be repeated here. .
  • the communication device 600 may specifically be a mobile terminal/terminal according to an embodiment of the application, and the communication device 600 may implement the corresponding processes implemented by the mobile terminal/terminal in each method of the embodiments of the application. For the sake of brevity, This will not be repeated here.
  • FIG. 14 is a schematic structural diagram of a chip of an embodiment of the present application.
  • the chip 700 shown in FIG. 14 includes a processor 710, and the processor 710 can call and run a computer program from the memory to implement the method in the embodiment of the present application.
  • the chip 700 may further include a memory 720.
  • the processor 710 may call and run a computer program from the memory 720 to implement the method in the embodiment of the present application.
  • the memory 720 may be a separate device independent of the processor 710, or may be integrated in the processor 710.
  • the chip 700 may further include an input interface 730.
  • the processor 710 can control the input interface 730 to communicate with other devices or chips, and specifically, can obtain information or data sent by other devices or chips.
  • the chip 700 may further include an output interface 740.
  • the processor 710 can control the output interface 740 to communicate with other devices or chips, and specifically, can output information or data to other devices or chips.
  • the chip can be applied to the network device in the embodiment of the present application, and the chip can implement the corresponding process implemented by the network device in each method of the embodiment of the present application.
  • the chip can implement the corresponding process implemented by the network device in each method of the embodiment of the present application.
  • the chip can be applied to the mobile terminal/terminal in the embodiment of the present application, and the chip can implement the corresponding process implemented by the mobile terminal/terminal in each method of the embodiment of the present application.
  • the chip can implement the corresponding process implemented by the mobile terminal/terminal in each method of the embodiment of the present application.
  • it will not be omitted here. Repeat.
  • chips mentioned in the embodiments of the present application may also be referred to as system-level chips, system-on-chips, system-on-chips, or system-on-chips.
  • FIG. 15 is a schematic block diagram of a communication system 900 according to an embodiment of the present application. As shown in FIG. 15, the communication system 900 includes a terminal 910 and a network device 920.
  • the terminal 910 may be used to implement the corresponding functions implemented by the terminal in the foregoing method
  • the network device 920 may be used to implement the corresponding functions implemented by the network device in the foregoing method.
  • details are not described herein again.
  • the processor of the embodiment of the present application may be an integrated circuit chip with signal processing capability.
  • the steps of the foregoing method embodiments can be completed by hardware integrated logic circuits in the processor or instructions in the form of software.
  • the above-mentioned processor may be a general-purpose processor, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a ready-made programmable gate array (Field Programmable Gate Array, FPGA) or other Programming logic devices, discrete gates or transistor logic devices, discrete hardware components.
  • DSP digital signal processor
  • ASIC application specific integrated circuit
  • FPGA ready-made programmable gate array
  • the methods, steps, and logical block diagrams disclosed in the embodiments of the present application can be implemented or executed.
  • the general-purpose processor may be a microprocessor or the processor may also be any conventional processor or the like.
  • the steps of the method disclosed in combination with the embodiments of the present application may be directly embodied as being executed and completed by a hardware decoding processor, or executed by a combination of hardware and software modules in the decoding processor.
  • the software module can be located in a mature storage medium in the field such as random access memory, flash memory, read-only memory, programmable read-only memory, or electrically erasable programmable memory, registers.
  • the storage medium is located in the memory, and the processor reads the information in the memory and completes the steps of the above method in combination with its hardware.
  • the memory in the embodiments of the present application may be volatile memory or non-volatile memory, or may include both volatile and non-volatile memory.
  • the non-volatile memory can be Read-Only Memory (ROM), Programmable Read-Only Memory (Programmable ROM, PROM), Erasable Programmable Read-Only Memory (Erasable PROM, EPROM), and Erase programmable read-only memory (Electrically EPROM, EEPROM) or flash memory.
  • the volatile memory may be a random access memory (Random Access Memory, RAM), which is used as an external cache.
  • RAM random access memory
  • SRAM static random access memory
  • DRAM dynamic random access memory
  • DRAM synchronous dynamic random access memory
  • DDR SDRAM Double Data Rate Synchronous Dynamic Random Access Memory
  • Enhanced SDRAM, ESDRAM Enhanced Synchronous Dynamic Random Access Memory
  • Synchronous Link Dynamic Random Access Memory Synchronous Link Dynamic Random Access Memory
  • DR RAM Direct Rambus RAM
  • the memory in the embodiment of the present application may also be static random access memory (static RAM, SRAM), dynamic random access memory (dynamic RAM, DRAM), Synchronous dynamic random access memory (synchronous DRAM, SDRAM), double data rate synchronous dynamic random access memory (double data rate SDRAM, DDR SDRAM), enhanced synchronous dynamic random access memory (enhanced SDRAM, ESDRAM), synchronous connection Dynamic random access memory (synch link DRAM, SLDRAM) and direct memory bus random access memory (Direct Rambus RAM, DR RAM) and so on. That is to say, the memory in the embodiments of the present application is intended to include but not limited to these and any other suitable types of memory.
  • the embodiments of the present application also provide a computer-readable storage medium for storing computer programs.
  • the computer-readable storage medium may be applied to the network device in the embodiment of the present application, and the computer program causes the computer to execute the corresponding process implemented by the network device in each method of the embodiment of the present application.
  • the computer program causes the computer to execute the corresponding process implemented by the network device in each method of the embodiment of the present application.
  • the computer-readable storage medium can be applied to the mobile terminal/terminal in the embodiment of the present application, and the computer program causes the computer to execute the corresponding process implemented by the mobile terminal/terminal in each method of the embodiment of the present application, in order to It's concise, so I won't repeat it here.
  • the embodiments of the present application also provide a computer program product, including computer program instructions.
  • the computer program product can be applied to the network device in the embodiment of the present application, and the computer program instructions cause the computer to execute the corresponding process implemented by the network device in each method of the embodiment of the present application.
  • the computer program instructions cause the computer to execute the corresponding process implemented by the network device in each method of the embodiment of the present application.
  • the computer program instructions cause the computer to execute the corresponding process implemented by the network device in each method of the embodiment of the present application.
  • it is not here. Repeat it again.
  • the computer program product can be applied to the mobile terminal/terminal in the embodiments of the present application, and the computer program instructions cause the computer to execute the corresponding procedures implemented by the mobile terminal/terminal in the various methods of the embodiments of the present application, for the sake of brevity , I won’t repeat it here.
  • the embodiment of the application also provides a computer program.
  • the computer program can be applied to the network device in the embodiment of the present application.
  • the computer program is run on the computer, the computer is caused to execute the corresponding process implemented by the network device in each method of the embodiment of the present application.
  • I won’t repeat it here.
  • the computer program can be applied to the mobile terminal/terminal in the embodiments of the present application.
  • the computer program runs on the computer, the computer can execute the corresponding methods implemented by the mobile terminal/terminal in the various methods of the embodiments of the present application. For the sake of brevity, the process will not be repeated here.
  • the disclosed system, device, and method may be implemented in other ways.
  • the device embodiments described above are merely illustrative.
  • the division of the units is only a logical function division, and there may be other divisions in actual implementation, for example, multiple units or components may be combined or It can be integrated into another system, or some features can be ignored or not implemented.
  • the displayed or discussed mutual coupling or direct coupling or communication connection may be indirect coupling or communication connection through some interfaces, devices or units, and may be in electrical, mechanical or other forms.
  • the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the objectives of the solutions of the embodiments.
  • the functional units in the various embodiments of the present application may be integrated into one processing unit, or each unit may exist alone physically, or two or more units may be integrated into one unit.
  • the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer readable storage medium.
  • the technical solution of this application essentially or the part that contributes to the existing technology or the part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including Several instructions are used to make a computer device (which may be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the method described in each embodiment of the present application.
  • the aforementioned storage media include: U disk, mobile hard disk, read-only memory (Read-Only Memory,) ROM, random access memory (Random Access Memory, RAM), magnetic disk or optical disk and other media that can store program code .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本申请实施例提供一种切换过程中安全信息的处理方法及装置、网络设备、终端，该方法包括：源基站为多个目标基站生成对应的多个第一密钥；所述源基站将所述多个第一密钥分别发送给所述多个目标基站，所述第一密钥用于所述目标基站与终端进行通信。

Description

切换过程中安全信息的处理方法及装置、网络设备、终端 技术领域
本申请实施例涉及移动通信技术领域，具体涉及一种切换过程中安全信息的处理方法及装置、网络设备、终端。
背景技术
切换过程包括切换准备流程、切换执行流程和切换完成流程。其中，切换准备流程包括终端进行小区测量、终端进行测量上报、网络下发切换命令等。当终端成功切换至一个目标基站时会认为切换完成，对于下一次切换，仍然需要切换准备流程，冗余的切换准备流程会带来额外的信令开销，如何支持终端的连续切换特别是连续切换中安全密钥的更新是有待解决的问题。
发明内容
本申请实施例提供一种切换过程中安全信息的处理方法及装置、网络设备、终端。
本申请实施例提供的切换过程中安全信息的处理方法，包括：
源基站为多个目标基站生成对应的多个第一密钥；
所述源基站将所述多个第一密钥分别发送给所述多个目标基站，所述第一密钥用于所述目标基站与终端进行通信。
本申请实施例提供的切换过程中安全信息的处理方法，包括：
终端接收源基站发送的切换命令，所述切换命令包括多个目标基站的第一配置信息和切换条件；
所述终端确定所述多个目标基站中的第一目标基站满足所述切换条件的情况下，生成所述第一目标基站对应的第一密钥，并接入到所述第一目标基站，所述第一目标基站对应的第一密钥用于所述终端与所述第一目标基站进行通信；
所述终端成功接入所述第一目标基站后，保留所述切换命令中携带的全部信息或部分信息。
本申请实施例提供的切换过程中安全信息的处理装置，应用于源基站，所述装置包括：
生成单元，用于为多个目标基站生成对应的多个第一密钥；
发送单元，用于将所述多个第一密钥分别发送给所述多个目标基站，所述第一密钥用于所述目标基站与终端进行通信。
本申请实施例提供的切换过程中安全信息的处理装置，应用于终端，所述装置包括：
接收单元，用于接收源基站发送的切换命令，所述切换命令包括多个目标基站的第一配置信息和切换条件；
生成单元，用于在确定所述多个目标基站中的第一目标基站满足所述切换条件的情况下，生成所述第一目标基站对应的第一密钥，并接入到所述第一目标基站，所述第一目标基站对应的第一密钥用于所述终端与所述第一目标基站进行通信；
保存单元，用于在成功接入所述第一目标基站后，保留所述切换命令中携带的全部信息或部分信息。
本申请实施例提供的网络设备，包括处理器和存储器。该存储器用于存储计算机程序，该处理器用于调用并运行该存储器中存储的计算机程序，执行上述的切换过程中安全信息的处理方法。
本申请实施例提供的终端，包括处理器和存储器。该存储器用于存储计算机程序，该处理器用于调用并运行该存储器中存储的计算机程序，执行上述的切换过程中安全信息的处理方法。
本申请实施例提供的芯片，用于实现上述的切换过程中安全信息的处理方法。
具体地，该芯片包括：处理器，用于从存储器中调用并运行计算机程序，使得安装有该芯片 的设备执行上述的切换过程中安全信息的处理方法。
本申请实施例提供的计算机可读存储介质，用于存储计算机程序，该计算机程序使得计算机执行上述的切换过程中安全信息的处理方法。
本申请实施例提供的计算机程序产品，包括计算机程序指令，该计算机程序指令使得计算机执行上述的切换过程中安全信息的处理方法。
本申请实施例提供的计算机程序，当其在计算机上运行时，使得计算机执行上述的切换过程中安全信息的处理方法。
通过上述技术方案，切换命令中配置了多个目标基站，当终端成功接入到一个目标基站后，保留该切换命令中携带的全部信息或部分信息，以便进行下一个目标基站的连续切换，避免了冗余的切换准备流程；另一方面，实现了连续切换中安全密钥的更新，保障了通信的安全性。
附图说明
此处所说明的附图用来提供对本申请的进一步理解，构成本申请的一部分，本申请的示意性实施例及其说明用于解释本申请，并不构成对本申请的不当限定。在附图中：
图1为本申请实施例提供的一种通信***架构的示意性图；
图2为本申请实施例提供的切换流程图；
图3为本申请实施例提供的Conditional handover的流程图；
图4为本申请实施例提供的密钥衍生的示意图；
图5为本申请实施例提供的切换过程中密钥更新的示意图；
图6为本申请实施例提供的切换过程中安全信息的处理方法的流程示意图一；
图7(a)为本申请实施例提供的应用场景示意图一；
图7(b)为本申请实施例提供的应用场景示意图二；
图8为本申请实施例提供的切换过程中安全信息的处理方法的流程示意图二；
图9为本申请实施例提供的切换过程中安全信息的处理方法的流程示意图三；
图10为本申请实施例提供的切换过程中安全信息的处理方法的流程示意图四；
图11为本申请实施例提供的切换过程中安全信息的处理装置的结构组成示意图一；
图12为本申请实施例提供的切换过程中安全信息的处理装置的结构组成示意图二；
图13为本申请实施例提供的一种通信设备示意性结构图；
图14为本申请实施例的芯片的示意性结构图；
图15为本申请实施例提供的一种通信***的示意性框图。
具体实施方式
下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行描述，显然，所描述的实施例是本申请一部分实施例，而不是全部的实施例。基于本申请中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本申请保护的范围。
本申请实施例的技术方案可以应用于各种通信***，例如：全球移动通讯(Global System of Mobile communication，GSM)***、码分多址(Code Division Multiple Access，CDMA)***、宽带码分多址(Wideband Code Division Multiple Access，WCDMA)***、通用分组无线业务(General Packet Radio Service，GPRS)、长期演进(Long Term Evolution，LTE)***、LTE频分双工(Frequency Division Duplex，FDD)***、LTE时分双工(Time Division Duplex，TDD)、通用移动通信***(Universal Mobile Telecommunication System，UMTS)、全球互联微波接入(Worldwide Interoperability for Microwave Access，WiMAX)通信***或5G***等。
示例性的，本申请实施例应用的通信***100如图1所示。该通信***100可以包括网络设备110，网络设备110可以是与终端120(或称为通信终端、终端)通信的设备。网络设备110可以为特定的地理区域提供通信覆盖，并且可以与位于该覆盖区域内的终端进行通信。可选地，该网络设备110可以是GSM***或CDMA***中的基站(Base Transceiver Station，BTS)，也可以是WCDMA***中的基站(NodeB，NB)，还可以是LTE***中的演进型基站(Evolutional Node B，eNB或eNodeB)，或者是云无线接入网络(Cloud Radio Access Network，CRAN)中的无线控制器，或者该网络设备可以为移动交换中心、中继站、接入点、车载设备、可穿戴设备、集线器、交换机、网桥、 路由器、5G网络中的网络侧设备或者未来演进的公共陆地移动网络(Public Land Mobile Network，PLMN)中的网络设备等。
该通信***100还包括位于网络设备110覆盖范围内的至少一个终端120。作为在此使用的“终端”包括但不限于经由有线线路连接，如经由公共交换电话网络(Public Switched Telephone Networks，PSTN)、数字用户线路(Digital Subscriber Line，DSL)、数字电缆、直接电缆连接；和/或另一数据连接/网络；和/或经由无线接口，如，针对蜂窝网络、无线局域网(Wireless Local Area Network，WLAN)、诸如DVB-H网络的数字电视网络、卫星网络、AM-FM广播发送器；和/或另一终端的被设置成接收/发送通信信号的装置；和/或物联网(Internet of Things，IoT)设备。被设置成通过无线接口通信的终端可以被称为“无线通信终端”、“无线终端”或“移动终端”。移动终端的示例包括但不限于卫星或蜂窝电话；可以组合蜂窝无线电电话与数据处理、传真以及数据通信能力的个人通信***(Personal Communications System，PCS)终端；可以包括无线电电话、寻呼机、因特网/内联网接入、Web浏览器、记事簿、日历以及/或全球定位***(Global Positioning System，GPS)接收器的PDA；以及常规膝上型和/或掌上型接收器或包括无线电电话收发器的其它电子装置。终端可以指接入终端、用户设备(User Equipment，UE)、用户单元、用户站、移动站、移动台、远方站、远程终端、移动设备、用户终端、终端、无线通信设备、用户代理或用户装置。接入终端可以是蜂窝电话、无绳电话、会话启动协议(Session Initiation Protocol，SIP)电话、无线本地环路(Wireless Local Loop，WLL)站、个人数字处理(Personal Digital Assistant，PDA)、具有无线通信功能的手持设备、计算设备或连接到无线调制解调器的其它处理设备、车载设备、可穿戴设备、5G网络中的终端或者未来演进的PLMN中的终端等。
可选地，终端120之间可以进行终端直连(Device to Device，D2D)通信。
可选地，5G***或5G网络还可以称为新无线(New Radio，NR)***或NR网络。
图1示例性地示出了一个网络设备和两个终端，可选地，该通信***100可以包括多个网络设备并且每个网络设备的覆盖范围内可以包括其它数量的终端，本申请实施例对此不做限定。
可选地，该通信***100还可以包括网络控制器、移动管理实体等其他网络实体，本申请实施例对此不作限定。
应理解，本申请实施例中网络/***中具有通信功能的设备可称为通信设备。以图1示出的通信***100为例，通信设备可包括具有通信功能的网络设备110和终端120，网络设备110和终端120可以为上文所述的具体设备，此处不再赘述；通信设备还可包括通信***100中的其他设备，例如网络控制器、移动管理实体等其他网络实体，本申请实施例中对此不做限定。
应理解，本文中术语“***”和“网络”在本文中常被可互换使用。本文中术语“和/或”，仅仅是一种描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。另外，本文中字符“/”，一般表示前后关联对象是一种“或”的关系。
为便于理解本申请实施例的技术方案，以下对本申请实施例的相关技术进行说明，以下相关技术与本申请实施例的技术方案的任意结合均属于本申请实施例的保护范围。
1)切换(Handover，HO)
参照图2，图2为本申请实施例提供的切换流程图，该流程主要包括如下步骤：
1、源基站给终端下发测量配置。
2、终端基于测量配置进行相关测量，向源基站上报测量结果。
3、源基站基于测量结果做切换决定(Handove decision)。
4、源基站向目标基站发起切换请求(Handover Request)。
5、目标基站做准入控制(Admission Control)。
6、目标基站向源基站发送切换请求-确认反馈消息(Handover Request Ack)。
7、源基站向终端发送RRC连接重配置消息，该RRC连接重配置消息携带目标基站的移动性控制信息(mobilityControlInformation)。
这里，RRC连接重配置消息携带在切换命令中。
8、源基站向目标基站进行SN状态转发(SN Status Transfer)。
9、终端同步至目标基站。
10a、目标基站给终端进行周期的上行分配(Periodic UL allocation)。
10b、目标基站给终端配置上行分配和跟踪区(Tracking Area，TA)。
11、终端向目标基站发送RRC连接重配置完成消息。
12、目标基站向MME发起路径切换请求。
13、MME向服务网关(Serving Gateway)发起修改承载请求。
14、服务网关切换下行路径。
15、服务网关向MME发送修改承载响应消息。
16、MME向目标基站发送路径切换请求-确认反馈消息。
17、目标基站通知源基站释放终端上下文。
18、源基站释放资源。
上述图2中的切换过程主要包括如下流程：
- 切换准备(图2中的步骤1-6)：源基站配置终端进行测量上报，并基于终端的上报结果向目标基站发送切换请求。当目标基站同意换请求后，会为终端配置RRC消息，该RRC消息携带移动性控制信息(mobilityControlInformation)，其中包括随机接入信道(Random Access Channel，RACH)资源、小区无线网络临时标识(Cell-Radio Network Temporary Identifier，C-RNTI)、目标基站安全算法以及目标基站的***消息等。
- 切换执行(图2中的步骤7-11)：源基站通过切换命令转发mobilityControlInformation给终端，终端收到切换命令后，向目标基站发起随机接入流程。同时源基站会向目标基站进行序列号状态转发(Serial Number STATUS TRANSFER，SN STATUS TRANSFER)，告诉目标基站上行分组数据汇聚协议(Packet Data Convergence Protocol，PDCP)SN接收状态以及下行PDCP SN发送状态。
- 切换完成(图2中的步骤12-18)：当终端成功接入目标基站后(即随机接入成功)，目标基站会发起路径切换请求(PATH SWITCH REQUEST)，请求移动性管理实体(Mobility Management Entity，MME)切换下行路径，路径切换完成后目标基站会指示源基站释放终端上下文，切换完成。
2)条件切换(Conditional handover)
对于某些特殊场景，比如终端高速移动或者高频条件下，需要频繁的进行切换。Conditional handover避免了切换准备时间过长，导致终端要切换的时候已经过晚的问题，为终端提前配置了切换命令。另一方面，对于高铁场景，终端的运行轨迹是特定的，所以基站可以提前把目标基站配给终端，并且在切换命令中包含用于触发终端进行切换的条件(以下简称切换条件)，当目标基站满足切换条件时，终端向该目标基站发起接入请求。
进一步，Conditional handover场景下的切换命令中可以配置多个目标基站(即多个目标小区)以及切换条件。终端基于所配置的切换条件判断接入哪个目标小区。
如图3所示，Conditional handover主要包括如下流程：
1、终端与源基站之间进行测量配置/上报测量结果。
这里，源基站向终端下发测量配置，终端基于测量配置进行相关测量并向源基站上报测量结果。
2、源基站与目标基站之间进行切换准备流程。
3、源基站向终端下发切换命令，该切换命令携带多个目标基站的配置信息和切换条件。
4、目标基站满足切换条件时，终端同步至目标基站(即终端接入到目标基站)。
3)切换过程中的密钥更新
如图4所示，密钥衍生(即密钥更新)包括以下两种：
密钥的水平衍生：基于K gNB以及目标小区(目标基站的小区)的物理小区标识(Physical Cell Identity，PCI)以及下行频率(DL frequency)生成K NG-RAN*。
密钥的垂直衍生：基于下一跳(Next Hop，NH)与目标小区(目标基站的小区)的PCI以及下行频率(DL frequency)生成K NG-RAN*。进一步，可以基于下一跳链计数(Next hop Chaining Counter，NCC)生成NH。
需要说明的是，图4中是以基站为gNB为例，原密钥记作K gNB，衍生的新密钥记作K NG-RAN*，或者记作K gNB*。如果基站为eNB，原密钥记作K eNB，衍生的新密钥记作K eNB*。
需要说明的是，基站和终端之间通信的数据是用密钥以及其他一些参数然后使用加密算法来加密传输的，基站使用的密钥和终端使用的密钥需要保持一致，当终端接入目标基站时，终端和该目标基站需要通过密钥的水平衍生或者密钥的垂直衍生来确定自己所使用的密钥。
切换过程中密钥更新如图5所示，包括如下流程：
1、源基站向目标基站发送切换请求消息，该切换请求消息携带终端的安全能力，源基站使用的安全算法，K NG-RAN*，NCC。
这里，K NG-RAN*是源基站根据目标基站的PCI以及下行频率生成。
2、目标基站将K NG-RAN*作为K gNB，并与NCC关联后保存。
3、目标基站向源基站发送NCC和目标基站选择的安全算法，源基站向终端发送切换命令，该切换命令携带NCC，目标基站选择的安全算法。
4、终端根据收到的NCC同步NH，并计算K gNB，与NCC关联后保存。
5、终端向目标基站发送切换完成消息。
6、目标基站向目标接入和移动性管理实体(T-AMF，Target-Access and Mobility Management Function)发送路径切换请求消息。
7、T-AMF通过NCC＝NCC+1更新NCC。
这里，通过NCC＝NCC+1更新NCC是指将NCC的值加1。
8、T-AMF向目标基站发送路径切换请求-确认反馈消息，该路径切换请求-确认反馈消息携带{NH,NCC}。
9、目标基站保存{NH,NCC}，下次切换备用。
10、终端向目标基站发起小区内(Intra cell)切换流程。
上述图5中的密钥更新对于源基站、目标基站以及终端的处理如下：
对于源基站：1)首先基于目标基站的PCI以及下行频率生成K NG-RAN*；进一步，如果有未使用的{NH,NCC}，则基于NH和目标基站的PCI以及下行频率生成K NG-RAN*，如果没有未使用的{NH,NCC}，则用现有的K gNB和目标基站的PCI以及下行频率生成K NG-RAN*；把生成的K NG-RAN*转发给目标基站；切换完成后使用K NG-RAN*作为K gNB；在切换命令中携带用于生成K NG-RAN*的NCC。
对于目标基站：目标基站会把收到K NG-RAN*作为K gNB与终端进行通信；把从源基站收到的NCC与K gNB关联起来；把NCC包含在切换命令中通过源基站发送给终端；切换完成后，目标基站发送路径切换请求给T-AMF。
对于终端：如果终端在切换命令中收到的NCC与当前终端侧K gNB所关联的NCC相等，基于K gNB以及目标基站的PCI以及下行频率生成K NG-RAN*；如果终端在切换命令中收到的NCC与当前终端侧的K gNB所关联的NCC不同，基于已保存的NCC生成NH，基于生成的NH与目标基站的PCI以及下行频率生成K NG-RAN*；终端会使用生成的K NG-RAN*作为K gNB与目标基站进行通信。
需要说明的是，图5中是以基站为gNB为例，原密钥记作K gNB，衍生的新密钥记作K NG-RAN*，或者记作K gNB*。如果基站为eNB，原密钥记作K eNB，衍生的新密钥记作K eNB*。
基于上述切换流程，即便切换命令中配置了多个目标基站，当终端成功切换至其中一个目标基站时就会认为切换完成，对于下一次切换，仍然需要切换准备等流程。为了避免冗余的切换准备流程，本申请实施例提出了一种支持终端连续切换的方法，实现了连续切换中安全密钥的更新。
图6为本申请实施例提供的切换过程中安全信息的处理方法的流程示意图一，如图6所示，所述切换过程中安全信息的处理方法包括以下步骤：
步骤601：源基站为多个目标基站生成对应的多个第一密钥。
本申请实施例中，源基站和目标基站可以但不局限于是gNB，eNB，NG-gNB等等。进一步，源基站和目标基站的类型可以一样，也可以不一样。
本申请实施例可应用于Conditional handover场景，该场景下，源基站向终端发送切换命令，所述切换命令包括所述多个目标基站的第一配置信息和切换条件。这里，所述第一配置信息例如是RRC连接重配置消息。所述切换条件例如是参考信号接收功率(Reference Signal Receiving Power，RSRP)门限值。终端确定多个目标基站中的第一目标基站满足切换条件时(如第一目标基站的RSRP测量值大于等于RSRP门限值)，接入到所述第一目标基站。在终端成功接入所述第一目标基站后，保留所述切换命令中携带的全部信息或部分信息。
在一个场景中，如图7(a)所示，终端的运行轨迹是特定的，从源基站开始接入，并依次接入到目标基站1，目标基站2，……，目标基站6，这种场景终端不走回头路。此时，终端成功接入目标基站1后，保留除目标基站1以外的第一配置信息，以便下次连续切换时使用。而后，终端移动过程中检测到目标基站2满足切换条件，成功接入目标基站2后，保留除目标基站2以外的第一配置信息，以便下次连续切换时使用。以此类推，实现了连续切换，避免了冗余的切换准备流程。
在另一个场景中，如图7(b)所示，终端的运行轨迹是无法预知的，从源基站开始接入，随机接入到目标基站1至目标基站6中的任意一个目标基站。此时，终端成功接入目标基站1后，继续保留6个目标基站的第一配置信息，以便下次连续切换时使用。而后，如果终端移动过程中检测到目标基站6满足切换条件，成功接入目标基站6后，继续保留6个目标基站的第一配置信 息，以便下次连续切换时使用。以此类推，实现了连续切换，避免了冗余的切换准备流程。
在连续切换过程中，源基站为多个目标基站生成对应的多个第一密钥，将所述多个第一密钥分别发送给所述多个目标基站，所述第一密钥用于所述目标基站与终端进行通信。需要说明的是，基站和终端之间通信的数据是用密钥以及其他一些参数然后使用加密算法来加密传输的，基站使用的密钥和终端使用的密钥需要保持一致。
步骤602：所述源基站将所述多个第一密钥分别发送给所述多个目标基站，所述第一密钥用于所述目标基站与终端进行通信。
本申请实施例中，所述源基站为多个目标基站生成对应的多个第一密钥，可以通过以下方式实现：
方式一：所述源基站基于所述源基站的第二密钥，生成多个目标基站对应的多个第一密钥，所述第二密钥用于所述源基站与终端进行通信。
进一步，所述源基站将所述多个第一密钥分别发送给所述多个目标基站。
这里，所述源基站基于所述源基站的第二密钥，生成所述多个目标基站对应的多个第一密钥后，所述多个目标基站各自的第一密钥不再更新。
进一步，对于所述多个目标基站中的每个目标基站，所述源基站基于所述源基站的第二密钥和所述目标基站的PCI和/或下行频率信息生成该目标基站对应的第一密钥，并将所述第一密钥发送给该目标基站。
举个例子：源基站的第二密钥为K gNB，假设切换命令配置了3个目标基站，分别为目标基站1、目标基站2、目标基站3。对于目标基站1，源基站基于K gNB，目标基站1的PCI以及下行频率生成K1 NG-RAN*。对于目标基站2，源基站基于K gNB，目标基站2的PCI以及下行频率生成K2 NG-RAN*。对于目标基站3，源基站基于K gNB，目标基站3的PCI以及下行频率生成K3 NG-RAN*。
方式二：所述源基站接收终端或多个目标基站中的第一目标基站发送的第一指示信息，所述第一指示信息用于指示所述终端成功接入所述第一目标基站，所述第一指示信息携带所述第一目标基站对应的第一密钥；所述源基站基于所述第一目标基站对应的第一密钥，生成所述多个目标基站中除所述第一目标基站以外的其他目标基站对应的第一密钥。
进一步，所述源基站将所述其他目标基站对应的第一密钥分别发送给所述其他目标基站。
这里，随着终端的移动，接入的目标基站会发生变化，源基站接收到的终端当前接入到的目标基站的第一密钥会不断更新，源基站基于该更新的第一密钥重新生成其他目标基站的第一密钥，可见，其他目标基站的第一密钥会发生更新。
进一步，对于所述其他目标基站中的每个目标基站，所述源基站基于所述第一目标基站对应的第一密钥和所述目标基站的PCI和/或下行频率信息生成该目标基站对应的第一密钥，并将所述第一密钥发送给该目标基站。
举个例子：假设切换命令配置了3个目标基站，分别为目标基站1、目标基站2、目标基站3。终端成功接入目标基站1后，终端或目标基站1向源基站发送目标基站1的第一密钥。源基站基于目标基站1的第一密钥，目标基站2的PCI以及下行频率生成目标基站2的第一密钥；源基站基于目标基站1的第一密钥，目标基站3的PCI以及下行频率生成目标基站3的第一密钥。源基站将目标基站2的第一密钥和目标基站3的第一密钥分别下发给目标基站2和目标基站3。之后，终端继续移动并且持续对所配置的其他目标基站进行信道质量监测，当目标基站2满足切换条件时，终端接入目标基站2，并使用目标基站2的第一密钥与目标基站2进行通信。
可选地，源基站发送更新的密钥给其他目标基站的时候，其他目标基站可以进行反馈配置信息的更新等。
可选地，终端可以主动上报运行场景(如高速移动或者高频条件下移动)，方便基站配置Conditional handover。
对于上述方式二而言，如果终端接入的目标基站发生了变化，源基站会基于终端新接入的目标基站的第一秘钥重新生成其他目标基站的第一秘钥。
图8为本申请实施例提供的切换过程中安全信息的处理方法的流程示意图二，如图8所示，所述切换过程中安全信息的处理方法包括以下步骤：
步骤801：终端接收源基站发送的切换命令，所述切换命令包括多个目标基站的第一配置信息和切换条件。
本申请实施例中，所述终端可以是手机、平板电脑、笔记本、车载终端、穿戴式设备等任意能够与网络进行通信的设备。
本申请实施例可应用于Conditional handover场景，该场景下，终端接收源基站发送的切换命令，所述切换命令包括多个目标基站的第一配置信息和切换条件。这里，所述第一配置信息例如是RRC连接重配置消息。所述切换条件例如是RSRP门限值。
步骤802：所述终端确定所述多个目标基站中的第一目标基站满足所述切换条件的情况下，生成所述第一目标基站对应的第一密钥，并接入到所述第一目标基站，所述第一目标基站对应的第一密钥用于所述终端与所述第一目标基站进行通信。
本申请实施例中，终端确定多个目标基站中的第一目标基站满足切换条件时(如第一目标基站的RSRP测量值大于等于RSRP门限值)，生成所述第一目标基站对应的第一密钥，并接入到所述第一目标基站，所述第一目标基站对应的第一密钥用于所述终端与所述第一目标基站进行通信。
这里，所述终端生成所述第一目标基站对应的第一密钥，可以通过以下方式实现：
方式一：所述终端基于所述源基站的第二密钥，生成所述第一目标基站对应的第一密钥，所述第二密钥用于所述源基站与终端进行通信。
进一步，所述终端基于所述源基站的第二密钥和所述第一目标基站的PCI和/或下行频率信息生成所述第一目标基站对应的第一密钥。
举个例子：源基站的第二密钥为K gNB，假设切换命令配置了3个目标基站，分别为目标基站1、目标基站2、目标基站3。终端接入到目标基站1时，基于K gNB，目标基站1的PCI以及下行频率生成K1 NG-RAN*，将该K1 NG-RAN*作为K gNB与目标基站1进行通信。终端接入到目标基站2时，基于K gNB，目标基站2的PCI以及下行频率生成K2 NG-RAN*，将该K2 NG-RAN*作为K gNB与目标基站2进行通信。终端接入到目标基站3时，基于K gNB，目标基站3的PCI以及下行频率生成K3 NG-RAN*，将该K3 NG-RAN*作为K gNB与目标基站3进行通信。
对于上述方式一而言，切换命令中配置的所有目标基站与终端之间的密钥都是基于该目标基站的PCI和下行频率以及源基站的第二密钥生成，此时终端成功切换至任意一个目标基站时，需保存源基站的第二密钥用于后续密钥的衍生。
可选的，基于第二密钥进行密钥衍生时可以增加其他的小区识别信息，且该识别信息会在切换命令里携带。
方式二：所述终端基于所述终端的最新密钥，生成所述第一目标基站对应的第一密钥。
进一步，所述终端基于所述终端的最新密钥和所述第一目标基站的PCI和/或下行频率信息生成所述第一目标基站对应的第一密钥。
这里，所述终端的最新密钥为所述源基站的第二密钥；或者，所述终端的最新密钥为所述多个目标基站中的第二目标基站对应的第一密钥，所述第二目标基站为所述终端在接入所述第一目标基站之前所接入的目标基站。
举个例子：假设切换命令配置了3个目标基站，分别为目标基站1、目标基站2、目标基站3。终端成功接入目标基站1后，使用目标基站1的第一密钥与目标基站1进行通信。终端成功接入目标基站2后，终端使用目标基站1的第一密钥，目标基站2的PCI以及下行频率生成目标基站2的第一密钥，使用目标基站2的第一密钥与目标基站2进行通信。终端成功接入目标基站3后，终端使用目标基站2的第一密钥，目标基站3的PCI以及下行频率生成目标基站3的第一密钥，使用目标基站3的第一密钥与目标基站3进行通信。
步骤803：所述终端成功接入所述第一目标基站后，保留所述切换命令中携带的全部信息或部分信息。
本申请实施例中，在终端成功接入所述第一目标基站后，保留所述切换命令中携带的全部信息或部分信息。
在一个场景中，如图7(a)所示，终端的运行轨迹是特定的，从源基站开始接入，并依次接入到目标基站1，目标基站2，……，目标基站6，这种场景终端不走回头路。此时，终端成功接入目标基站1后，保留除目标基站1以外的第一配置信息，以便下次连续切换时使用。而后，终端移动过程中检测到目标基站2满足切换条件，成功接入目标基站2后，保留除目标基站2以外的第一配置信息，以便下次连续切换时使用。以此类推，实现了连续切换，避免了冗余的切换准备流程。
在另一个场景中，如图7(b)所示，终端的运行轨迹是无法预知的，从源基站开始接入，随机接入到目标基站1至目标基站6中的任意一个目标基站。此时，终端成功接入目标基站1后，继续保留6个目标基站的第一配置信息，以便下次连续切换时使用。而后，如果终端移动过程中检测到目标基站6满足切换条件，成功接入目标基站6后，继续保留6个目标基站的第一配置信 息，以便下次连续切换时使用。以此类推，实现了连续切换，避免了冗余的切换准备流程。
以下结合具体流程对本申请实施例的技术方案进行举例说明，需要说明的是，本申请实施例的技术方案不局限于以下流程。
图9为本申请实施例提供的切换过程中安全信息的处理方法的流程示意图三，如图9所示，该流程包括以下步骤：
1、源基站基于K eNB生成K eNB*。
这里，源基站的密钥为K eNB，与其关联的NCC的取值为0，即NCC＝0。将源基站侧的安全信息记作K eNB，NCC＝0。
同样，由于终端当前接入的是源基站，因此，终端侧的安全信息也为K eNB，NCC＝0。
源基站基于自身的K eNB，目标基站1的PCI和下行频率生成目标基站1的K eNB*，并将K eNB*与NCC＝0关联起来。
2、源基站将K eNB*，NCC＝0转发给目标基站1。
3、目标基站1将K eNB*设为K eNB，NCC＝0。
这里，目标基站1将K eNB*设为K eNB后，该K eNB用于目标基站1与终端之间的通信。
4、源基站向终端发切换命令。
这里，切换命令携带多个目标基站的RRC重配置消息以及切换条件。这里以两个目标基站为例，分别为目标基站1和目标基站2。
5、终端基于K eNB生成K eNB*，将K eNB*设为K eNB，NCC＝0。
这里，终端基于K eNB，目标基站1的PCI和下行频率生成目标基站1的K eNB*，并将K eNB*与NCC＝0关联起来。终端将K eNB*设为K eNB后，该K eNB用于终端与目标基站1之间的通信。
6、目标基站1向MME发送路径切换请求消息。
7、MME更新NCC，当前安全信息为K eNB，NCC＝1。
8、MME向目标基站1发送路径切换响应消息。
9、目标基站1向源基站发送第一指示信息，该第一指示信息携带NCC＝1。
10、源基站基于NCC＝1更新NH，基于NH生成K eNB*。
这里，源基站基于NH，目标基站2的PCI和下行频率生成目标基站2的K eNB*，并将K eNB*与NCC＝1关联起来。
11、源基站向目标基站2转发安全信息K eNB*，NCC＝1。
12、源基站向终端发送NCC＝1。
这里，也可以由目标基站1向终端发送NCC＝1。
13、终端基于K eNB生成K eNB*，将K eNB*设为K eNB，NCC＝1。
这里，终端基于K eNB，目标基站2的PCI和下行频率生成目标基站2的K eNB*，并将K eNB*与NCC＝1关联起来。终端将K eNB*设为K eNB后，该K eNB用于终端与目标基站2之间的通信。
14、目标基站2将K eNB*设为K eNB，NCC＝1。
这里，目标基站2将K eNB*设为K eNB后，该K eNB用于目标基站2与终端之间的通信。
需要说明的是，上述方案是以LTE***为例，5G***与上述流程类似，不再赘述。
图10为本申请实施例提供的切换过程中安全信息的处理方法的流程示意图四，如图10所示，该流程包括以下步骤：
1、源基站基于K eNB生成K eNB*。
这里，源基站的密钥为K eNB，与其关联的NCC的取值为0，即NCC＝0。将源基站侧的安全信息记作K eNB，NCC＝0。
同样，由于终端当前接入的是源基站，因此，终端侧的安全信息也为K eNB，NCC＝0。
源基站基于自身的K eNB，目标基站1的PCI和下行频率生成目标基站1的K eNB*，并将K eNB*与NCC＝0关联起来。
源基站基于自身的K eNB，目标基站2的PCI和下行频率生成目标基站2的K eNB*，并将K eNB*与NCC＝0关联起来。
源基站基于自身的K eNB，目标基站3的PCI和下行频率生成目标基站3的K eNB*，并将K eNB*与NCC＝0关联起来。
2、源基站将K eNB*，NCC＝0分别转发给目标基站1，目标基站2，目标基站3。
3、目标基站1将K eNB*设为K eNB，NCC＝0。
这里，目标基站1将K eNB*设为K eNB后，该K eNB用于目标基站1与终端之间的通信。
4、源基站向终端发切换命令。
这里，切换命令携带多个目标基站的RRC重配置消息以及切换条件。这里以三个目标基站为例，分别为目标基站1、目标基站2和目标基站3。
5、终端基于K eNB生成K eNB*，将K eNB*设为K eNB，NCC＝0。
这里，终端基于K eNB，目标基站1的PCI和下行频率生成目标基站1的K eNB*，并将K eNB*与NCC＝0关联起来。终端将K eNB*设为K eNB后，该K eNB用于终端与目标基站1之间的通信。
6、终端与目标基站1之间执行随机接入流程。
7、目标基站2将K eNB*设为K eNB，NCC＝0。
这里，目标基站2将K eNB*设为K eNB后，该K eNB用于目标基站2与终端之间的通信。
8、终端基于K eNB生成K eNB*，将K eNB*设为K eNB，NCC＝0。
这里，终端基于K eNB，目标基站2的PCI和下行频率生成目标基站2的K eNB*，并将K eNB*与NCC＝0关联起来。终端将K eNB*设为K eNB后，该K eNB用于终端与目标基站2之间的通信。
9、终端与目标基站2之间执行随机接入流程。
10、目标基站3将K eNB*设为K eNB，NCC＝0。
这里，目标基站3将K eNB*设为K eNB后，该K eNB用于目标基站3与终端之间的通信。
11、终端基于K eNB生成K eNB*，将K eNB*设为K eNB，NCC＝0。
这里，终端基于K eNB，目标基站3的PCI和下行频率生成目标基站3的K eNB*，并将K eNB*与NCC＝0关联起来。终端将K eNB*设为K eNB后，该K eNB用于终端与目标基站3之间的通信。
12、终端与目标基站3之间执行随机接入流程。
需要说明的是，上述方案是以LTE***为例，5G***与上述流程类似，不再赘述。
需要说明的是，本申请实施例的上述技术方案不局限于应用于基站间(inter-NodeB，inter-NB)的小区切换，还可以应用于基站内(intra-NB，intra-NB)的小区切换。其中，对于inter-NB的小区切换是指：属于不同目标基站的两个小区之间的切换。对于intra-NB的小区切换是指：属于相同目标基站的两个小区之间的切换。
图11为本申请实施例提供的切换过程中安全信息的处理装置的结构组成示意图一，该装置应用于源基站，如图11所示，所述装置包括：
生成单元1101，用于为多个目标基站生成对应的多个第一密钥；
发送单元1102，用于将所述多个第一密钥分别发送给所述多个目标基站，所述第一密钥用于所述目标基站与终端进行通信。
在一实施方式中，所述生成单元1101，用于基于所述源基站的第二密钥，生成多个目标基站对应的多个第一密钥，所述第二密钥用于所述源基站与终端进行通信。
在一实施方式中，对于所述多个目标基站中的每个目标基站，所述生成单元1101基于所述源基站的第二密钥和所述目标基站的PCI和/或下行频率信息生成该目标基站对应的第一密钥。
在一实施方式中，所述装置还包括：
接收单元1103，用于接收终端或多个目标基站中的第一目标基站发送的第一指示信息，所述第一指示信息用于指示所述终端成功接入所述第一目标基站，所述第一指示信息携带所述第一目标基站对应的第一密钥；
所述生成单元1101，用于基于所述第一目标基站对应的第一密钥，生成所述多个目标基站中除所述第一目标基站以外的其他目标基站对应的第一密钥；
所述发送单元1102，用于将所述其他目标基站对应的第一密钥分别发送给所述其他目标基站。
在一实施方式中，对于所述其他目标基站中的每个目标基站，所述生成单元1101基于所述第一目标基站对应的第一密钥和所述目标基站的PCI和/或下行频率信息生成该目标基站对应的第一密钥。
在一实施方式中，所述发送单元1102，还用于向终端发送切换命令，所述切换命令包括所述多个目标基站的第一配置信息和切换条件。
本领域技术人员应当理解，本申请实施例的上述切换过程中安全信息的处理装置的相关描述可以参照本申请实施例的切换过程中安全信息的处理方法的相关描述进行理解。
图12为本申请实施例提供的切换过程中安全信息的处理装置的结构组成示意图二，该装置应用于终端，如图12所示，所述装置包括：
接收单元1201，用于接收源基站发送的切换命令，所述切换命令包括多个目标基站的第一配 置信息和切换条件；
生成单元1202，用于在确定所述多个目标基站中的第一目标基站满足所述切换条件的情况下，生成所述第一目标基站对应的第一密钥，并接入到所述第一目标基站，所述第一目标基站对应的第一密钥用于所述终端与所述第一目标基站进行通信；
保存单元1203，用于在成功接入所述第一目标基站后，保留所述切换命令中携带的全部信息或部分信息。
在一实施方式中，所述生成单元1202，用于基于所述源基站的第二密钥，生成所述第一目标基站对应的第一密钥，所述第二密钥用于所述源基站与终端进行通信。
在一实施方式中，所述生成单元1202，用于基于所述源基站的第二密钥和所述第一目标基站的PCI和/或下行频率信息生成所述第一目标基站对应的第一密钥。
在一实施方式中，所述生成单元1202，用于基于所述终端的最新密钥，生成所述第一目标基站对应的第一密钥。
在一实施方式中，所述生成单元1202，用于基于所述终端的最新密钥和所述第一目标基站的PCI和/或下行频率信息生成所述第一目标基站对应的第一密钥。
在一实施方式中，所述终端的最新密钥为所述源基站的第二密钥；或者，
所述终端的最新密钥为所述多个目标基站中的第二目标基站对应的第一密钥，所述第二目标基站为所述终端在接入所述第一目标基站之前所接入的目标基站。
本领域技术人员应当理解，本申请实施例的上述切换过程中安全信息的处理装置的相关描述可以参照本申请实施例的切换过程中安全信息的处理方法的相关描述进行理解。
图13是本申请实施例提供的一种通信设备600示意性结构图。该通信设备可以是网络设备，如基站，也可以是终端，图13所示的通信设备600包括处理器610，处理器610可以从存储器中调用并运行计算机程序，以实现本申请实施例中的方法。
可选地，如图13所示，通信设备600还可以包括存储器620。其中，处理器610可以从存储器620中调用并运行计算机程序，以实现本申请实施例中的方法。
其中，存储器620可以是独立于处理器610的一个单独的器件，也可以集成在处理器610中。
可选地，如图13所示，通信设备600还可以包括收发器630，处理器610可以控制该收发器630与其他设备进行通信，具体地，可以向其他设备发送信息或数据，或接收其他设备发送的信息或数据。
其中，收发器630可以包括发射机和接收机。收发器630还可以进一步包括天线，天线的数量可以为一个或多个。
可选地，该通信设备600具体可为本申请实施例的网络设备，并且该通信设备600可以实现本申请实施例的各个方法中由网络设备实现的相应流程，为了简洁，在此不再赘述。
可选地，该通信设备600具体可为本申请实施例的移动终端/终端，并且该通信设备600可以实现本申请实施例的各个方法中由移动终端/终端实现的相应流程，为了简洁，在此不再赘述。
图14是本申请实施例的芯片的示意性结构图。图14所示的芯片700包括处理器710，处理器710可以从存储器中调用并运行计算机程序，以实现本申请实施例中的方法。
可选地，如图14所示，芯片700还可以包括存储器720。其中，处理器710可以从存储器720中调用并运行计算机程序，以实现本申请实施例中的方法。
其中，存储器720可以是独立于处理器710的一个单独的器件，也可以集成在处理器710中。
可选地，该芯片700还可以包括输入接口730。其中，处理器710可以控制该输入接口730与其他设备或芯片进行通信，具体地，可以获取其他设备或芯片发送的信息或数据。
可选地，该芯片700还可以包括输出接口740。其中，处理器710可以控制该输出接口740与其他设备或芯片进行通信，具体地，可以向其他设备或芯片输出信息或数据。
可选地，该芯片可应用于本申请实施例中的网络设备，并且该芯片可以实现本申请实施例的各个方法中由网络设备实现的相应流程，为了简洁，在此不再赘述。
可选地，该芯片可应用于本申请实施例中的移动终端/终端，并且该芯片可以实现本申请实施例的各个方法中由移动终端/终端实现的相应流程，为了简洁，在此不再赘述。
应理解，本申请实施例提到的芯片还可以称为***级芯片，***芯片，芯片***或片上***芯片等。
图15是本申请实施例提供的一种通信***900的示意性框图。如图15所示，该通信***900包括终端910和网络设备920。
其中，该终端910可以用于实现上述方法中由终端实现的相应的功能，以及该网络设备920可以用于实现上述方法中由网络设备实现的相应的功能为了简洁，在此不再赘述。
应理解，本申请实施例的处理器可能是一种集成电路芯片，具有信号的处理能力。在实现过程中，上述方法实施例的各步骤可以通过处理器中的硬件的集成逻辑电路或者软件形式的指令完成。上述的处理器可以是通用处理器、数字信号处理器(Digital Signal Processor，DSP)、专用集成电路(Application Specific Integrated Circuit，ASIC)、现成可编程门阵列(Field Programmable Gate Array，FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件。可以实现或者执行本申请实施例中的公开的各方法、步骤及逻辑框图。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。结合本申请实施例所公开的方法的步骤可以直接体现为硬件译码处理器执行完成，或者用译码处理器中的硬件及软件模块组合执行完成。软件模块可以位于随机存储器，闪存、只读存储器，可编程只读存储器或者电可擦写可编程存储器、寄存器等本领域成熟的存储介质中。该存储介质位于存储器，处理器读取存储器中的信息，结合其硬件完成上述方法的步骤。
可以理解，本申请实施例中的存储器可以是易失性存储器或非易失性存储器，或可包括易失性和非易失性存储器两者。其中，非易失性存储器可以是只读存储器(Read-Only Memory，ROM)、可编程只读存储器(Programmable ROM，PROM)、可擦除可编程只读存储器(Erasable PROM，EPROM)、电可擦除可编程只读存储器(Electrically EPROM，EEPROM)或闪存。易失性存储器可以是随机存取存储器(Random Access Memory，RAM)，其用作外部高速缓存。通过示例性但不是限制性说明，许多形式的RAM可用，例如静态随机存取存储器(Static RAM，SRAM)、动态随机存取存储器(Dynamic RAM，DRAM)、同步动态随机存取存储器(Synchronous DRAM，SDRAM)、双倍数据速率同步动态随机存取存储器(Double Data Rate SDRAM，DDR SDRAM)、增强型同步动态随机存取存储器(Enhanced SDRAM，ESDRAM)、同步连接动态随机存取存储器(Synchlink DRAM，SLDRAM)和直接内存总线随机存取存储器(Direct Rambus RAM，DR RAM)。应注意，本文描述的***和方法的存储器旨在包括但不限于这些和任意其它适合类型的存储器。
应理解，上述存储器为示例性但不是限制性说明，例如，本申请实施例中的存储器还可以是静态随机存取存储器(static RAM，SRAM)、动态随机存取存储器(dynamic RAM，DRAM)、同步动态随机存取存储器(synchronous DRAM，SDRAM)、双倍数据速率同步动态随机存取存储器(double data rate SDRAM，DDR SDRAM)、增强型同步动态随机存取存储器(enhanced SDRAM，ESDRAM)、同步连接动态随机存取存储器(synch link DRAM，SLDRAM)以及直接内存总线随机存取存储器(Direct Rambus RAM，DR RAM)等等。也就是说，本申请实施例中的存储器旨在包括但不限于这些和任意其它适合类型的存储器。
本申请实施例还提供了一种计算机可读存储介质，用于存储计算机程序。
可选的，该计算机可读存储介质可应用于本申请实施例中的网络设备，并且该计算机程序使得计算机执行本申请实施例的各个方法中由网络设备实现的相应流程，为了简洁，在此不再赘述。
可选地，该计算机可读存储介质可应用于本申请实施例中的移动终端/终端，并且该计算机程序使得计算机执行本申请实施例的各个方法中由移动终端/终端实现的相应流程，为了简洁，在此不再赘述。
本申请实施例还提供了一种计算机程序产品，包括计算机程序指令。
可选的，该计算机程序产品可应用于本申请实施例中的网络设备，并且该计算机程序指令使得计算机执行本申请实施例的各个方法中由网络设备实现的相应流程，为了简洁，在此不再赘述。
可选地，该计算机程序产品可应用于本申请实施例中的移动终端/终端，并且该计算机程序指令使得计算机执行本申请实施例的各个方法中由移动终端/终端实现的相应流程，为了简洁，在此不再赘述。
本申请实施例还提供了一种计算机程序。
可选的，该计算机程序可应用于本申请实施例中的网络设备，当该计算机程序在计算机上运行时，使得计算机执行本申请实施例的各个方法中由网络设备实现的相应流程，为了简洁，在此不再赘述。
可选地，该计算机程序可应用于本申请实施例中的移动终端/终端，当该计算机程序在计算机上运行时，使得计算机执行本申请实施例的各个方法中由移动终端/终端实现的相应流程，为了简洁，在此不再赘述。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来 执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的***、装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的***、装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个***，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。
所述功能如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(Read-Only Memory，)ROM、随机存取存储器(Random Access Memory，RAM)、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应所述以权利要求的保护范围为准。

Claims (34)

  1. 一种切换过程中安全信息的处理方法，所述方法包括：
    源基站为多个目标基站生成对应的多个第一密钥；
    所述源基站将所述多个第一密钥分别发送给所述多个目标基站，所述第一密钥用于所述目标基站与终端进行通信。
  2. 根据权利要求1所述的方法，其中，所述源基站为多个目标基站生成对应的多个第一密钥，包括：
    所述源基站基于所述源基站的第二密钥，生成多个目标基站对应的多个第一密钥，所述第二密钥用于所述源基站与终端进行通信。
  3. 根据权利要求2所述的方法，其中，对于所述多个目标基站中的每个目标基站，所述源基站基于所述源基站的第二密钥和所述目标基站的PCI和/或下行频率信息生成该目标基站对应的第一密钥，并将所述第一密钥发送给该目标基站。
  4. 根据权利要求1所述的方法，其中，所述源基站为多个目标基站生成对应的多个第一密钥，包括：
    所述源基站接收终端或多个目标基站中的第一目标基站发送的第一指示信息，所述第一指示信息用于指示所述终端成功接入所述第一目标基站，所述第一指示信息携带所述第一目标基站对应的第一密钥；
    所述源基站基于所述第一目标基站对应的第一密钥，生成所述多个目标基站中除所述第一目标基站以外的其他目标基站对应的第一密钥。
  5. 根据权利要求4所述的方法，其中，对于所述其他目标基站中的每个目标基站，所述源基站基于所述第一目标基站对应的第一密钥和所述目标基站的PCI和/或下行频率信息生成该目标基站对应的第一密钥，并将所述第一密钥发送给该目标基站。
  6. 根据权利要求1至5任一项所述的方法，其中，所述方法还包括：
    所述源基站向终端发送切换命令，所述切换命令包括所述多个目标基站的第一配置信息和切换条件。
  7. 一种切换过程中安全信息的处理方法，所述方法包括：
    终端接收源基站发送的切换命令，所述切换命令包括多个目标基站的第一配置信息和切换条件；
    所述终端确定所述多个目标基站中的第一目标基站满足所述切换条件的情况下，生成所述第一目标基站对应的第一密钥，并接入到所述第一目标基站，所述第一目标基站对应的第一密钥用于所述终端与所述第一目标基站进行通信；
    所述终端成功接入所述第一目标基站后，保留所述切换命令中携带的全部信息或部分信息。
  8. 根据权利要求7所述的方法，其中，所述生成所述第一目标基站对应的第一密钥，包括：
    所述终端基于所述源基站的第二密钥，生成所述第一目标基站对应的第一密钥，所述第二密钥用于所述源基站与终端进行通信。
  9. 根据权利要求8所述的方法，其中，所述终端基于所述源基站对应的第二密钥，生成所述第一目标基站对应的第一密钥，包括：
    所述终端基于所述源基站的第二密钥和所述第一目标基站的PCI和/或下行频率信息生成所述第一目标基站对应的第一密钥。
  10. 根据权利要求7所述的方法，其中，所述生成所述第一目标基站对应的第一密钥，包括：
    所述终端基于所述终端的最新密钥，生成所述第一目标基站对应的第一密钥。
  11. 根据权利要求10所述的方法，其中，所述终端基于所述终端的最新密钥，生成所述第一目标基站对应的第一密钥，包括：
    所述终端基于所述终端的最新密钥和所述第一目标基站的PCI和/或下行频率信息生成所述第一目标基站对应的第一密钥。
  12. 根据权利要求10或11所述的方法，其中，
    所述终端的最新密钥为所述源基站的第二密钥；或者，
    所述终端的最新密钥为所述多个目标基站中的第二目标基站对应的第一密钥，所述第二目标 基站为所述终端在接入所述第一目标基站之前所接入的目标基站。
  13. 一种切换过程中安全信息的处理装置，应用于源基站，所述装置包括：
    生成单元，用于为多个目标基站生成对应的多个第一密钥；
    发送单元，用于将所述多个第一密钥分别发送给所述多个目标基站，所述第一密钥用于所述目标基站与终端进行通信。
  14. 根据权利要求13所述的装置，其中，所述生成单元，用于基于所述源基站的第二密钥，生成多个目标基站对应的多个第一密钥，所述第二密钥用于所述源基站与终端进行通信。
  15. 根据权利要求14所述的装置，其中，对于所述多个目标基站中的每个目标基站，所述生成单元基于所述源基站的第二密钥和所述目标基站的PCI和/或下行频率信息生成该目标基站对应的第一密钥。
  16. 根据权利要求13所述的装置，其中，所述装置还包括：
    接收单元，用于接收终端或多个目标基站中的第一目标基站发送的第一指示信息，所述第一指示信息用于指示所述终端成功接入所述第一目标基站，所述第一指示信息携带所述第一目标基站对应的第一密钥；
    所述生成单元，用于基于所述第一目标基站对应的第一密钥，生成所述多个目标基站中除所述第一目标基站以外的其他目标基站对应的第一密钥；
    所述发送单元，用于将所述其他目标基站对应的第一密钥分别发送给所述其他目标基站。
  17. 根据权利要求16所述的装置，其中，对于所述其他目标基站中的每个目标基站，所述生成单元基于所述第一目标基站对应的第一密钥和所述目标基站的PCI和/或下行频率信息生成该目标基站对应的第一密钥。
  18. 根据权利要求13至17任一项所述的装置，其中，所述发送单元，还用于向终端发送切换命令，所述切换命令包括所述多个目标基站的第一配置信息和切换条件。
  19. 一种切换过程中安全信息的处理装置，应用于终端，所述装置包括：
    接收单元，用于接收源基站发送的切换命令，所述切换命令包括多个目标基站的第一配置信息和切换条件；
    生成单元，用于在确定所述多个目标基站中的第一目标基站满足所述切换条件的情况下，生成所述第一目标基站对应的第一密钥，并接入到所述第一目标基站，所述第一目标基站对应的第一密钥用于所述终端与所述第一目标基站进行通信；
    保存单元，用于在成功接入所述第一目标基站后，保留所述切换命令中携带的全部信息或部分信息。
  20. 根据权利要求19所述的装置，其中，所述生成单元，用于基于所述源基站的第二密钥，生成所述第一目标基站对应的第一密钥，所述第二密钥用于所述源基站与终端进行通信。
  21. 根据权利要求20所述的装置，其中，所述生成单元，用于基于所述源基站的第二密钥和所述第一目标基站的PCI和/或下行频率信息生成所述第一目标基站对应的第一密钥。
  22. 根据权利要求19所述的装置，其中，所述生成单元，用于基于所述终端的最新密钥，生成所述第一目标基站对应的第一密钥。
  23. 根据权利要求22所述的装置，其中，所述生成单元，用于基于所述终端的最新密钥和所述第一目标基站的PCI和/或下行频率信息生成所述第一目标基站对应的第一密钥。
  24. 根据权利要求22或23所述的装置，其中，
    所述终端的最新密钥为所述源基站的第二密钥；或者，
    所述终端的最新密钥为所述多个目标基站中的第二目标基站对应的第一密钥，所述第二目标基站为所述终端在接入所述第一目标基站之前所接入的目标基站。
  25. 一种网络设备，包括：处理器和存储器，该存储器用于存储计算机程序，所述处理器用于调用并运行所述存储器中存储的计算机程序，执行如权利要求1至6中任一项所述的方法。
  26. 一种终端，包括：处理器和存储器，该存储器用于存储计算机程序，所述处理器用于调用并运行所述存储器中存储的计算机程序，执行如权利要求7至12中任一项所述的方法。
  27. 一种芯片，包括：处理器，用于从存储器中调用并运行计算机程序，使得安装有所述芯片的设备执行如权利要求1至6中任一项所述的方法。
  28. 一种芯片，包括：处理器，用于从存储器中调用并运行计算机程序，使得安装有所述芯片的设备执行如权利要求7至12中任一项所述的方法。
  29. 一种计算机可读存储介质，用于存储计算机程序，所述计算机程序使得计算机执行如权 利要求1至6中任一项所述的方法。
  30. 一种计算机可读存储介质，用于存储计算机程序，所述计算机程序使得计算机执行如权利要求7至12中任一项所述的方法。
  31. 一种计算机程序产品，包括计算机程序指令，该计算机程序指令使得计算机执行如权利要求1至6中任一项所述的方法。
  32. 一种计算机程序产品，包括计算机程序指令，该计算机程序指令使得计算机执行如权利要求7至12中任一项所述的方法。
  33. 一种计算机程序，所述计算机程序使得计算机执行如权利要求1至6中任一项所述的方法。
  34. 一种计算机程序，所述计算机程序使得计算机执行如权利要求7至12中任一项所述的方法。
PCT/CN2019/074628 2019-02-02 2019-02-02 切换过程中安全信息的处理方法及装置、网络设备、终端 WO2020155157A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
PCT/CN2019/074628 WO2020155157A1 (zh) 2019-02-02 2019-02-02 切换过程中安全信息的处理方法及装置、网络设备、终端
CN201980073085.7A CN112956236B (zh) 2019-02-02 2019-02-02 切换过程中安全信息的处理方法及装置、网络设备、终端

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2019/074628 WO2020155157A1 (zh) 2019-02-02 2019-02-02 切换过程中安全信息的处理方法及装置、网络设备、终端

Publications (1)

Publication Number Publication Date
WO2020155157A1 true WO2020155157A1 (zh) 2020-08-06

Family

ID=71840682

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/074628 WO2020155157A1 (zh) 2019-02-02 2019-02-02 切换过程中安全信息的处理方法及装置、网络设备、终端

Country Status (2)

Country Link
CN (1) CN112956236B (zh)
WO (1) WO2020155157A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2023125342A1 (zh) * 2021-12-27 2023-07-06 华为技术有限公司 通信方法、装置及***

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN118175541A (zh) * 2022-12-08 2024-06-11 华为技术有限公司 通信方法及相关装置

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20090117876A1 (en) * 2007-10-24 2009-05-07 Tetsuo Inoue Communication system, communication method, authentication information managing server, and small base station
CN101946535A (zh) * 2008-02-15 2011-01-12 阿尔卡特朗讯美国公司 在无线通信***中执行切换时执行密钥管理的***和方法
CN101953191A (zh) * 2008-02-20 2011-01-19 阿尔卡特朗讯美国公司 在无线通信***中实施切换或在实施切换同时实施密钥管理的***和方法
CN108934049A (zh) * 2017-05-26 2018-12-04 捷开通讯(深圳)有限公司 通信切换方法及装置

Family Cites Families (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101336554A (zh) * 2006-01-04 2008-12-31 诺基亚公司 安全分配的切换信令
CN101616408B (zh) * 2008-06-23 2012-04-18 华为技术有限公司 密钥衍生方法、设备及***
WO2010105442A1 (zh) * 2009-03-20 2010-09-23 深圳华为通信技术有限公司 密钥推演参数的生成方法、装置和***
CN101931950B (zh) * 2009-06-19 2014-02-05 电信科学技术研究院 切换时的密钥获取方法、***和设备
CN102215485B (zh) * 2010-04-04 2015-07-22 中兴通讯股份有限公司 多载波通信***中保证多载波切换或重建安全性的方法
CN102340774B (zh) * 2010-07-22 2016-05-11 中兴通讯股份有限公司 一种切换的密钥分发方法及***

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20090117876A1 (en) * 2007-10-24 2009-05-07 Tetsuo Inoue Communication system, communication method, authentication information managing server, and small base station
CN101946535A (zh) * 2008-02-15 2011-01-12 阿尔卡特朗讯美国公司 在无线通信***中执行切换时执行密钥管理的***和方法
CN101953191A (zh) * 2008-02-20 2011-01-19 阿尔卡特朗讯美国公司 在无线通信***中实施切换或在实施切换同时实施密钥管理的***和方法
CN108934049A (zh) * 2017-05-26 2018-12-04 捷开通讯(深圳)有限公司 通信切换方法及装置

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2023125342A1 (zh) * 2021-12-27 2023-07-06 华为技术有限公司 通信方法、装置及***

Also Published As

Publication number Publication date
CN112956236B (zh) 2022-10-21
CN112956236A (zh) 2021-06-11

Similar Documents

Publication Publication Date Title
US11184811B2 (en) Method and device for anchor replacement
WO2020164016A1 (zh) 小区切换的方法和设备
WO2020034229A1 (zh) 一种信息传输方法及装置、通信设备
US20220225203A1 (en) Communication Method and Communications Apparatus
WO2020154994A1 (zh) 小区切换方法、终端设备和网络设备
WO2020061931A1 (zh) 一种切换上报的方法、终端设备及网络设备
WO2020155070A1 (zh) 用于切换网络设备的方法和终端设备
WO2020019230A1 (zh) 一种资源配置方法及装置、终端设备、网络设备
US11805563B2 (en) Wireless communication method and base station
US11611925B2 (en) Switching processing method, terminal device and network device
WO2020155157A1 (zh) 切换过程中安全信息的处理方法及装置、网络设备、终端
WO2020024301A1 (zh) 一种保证数传输可靠性的方法及装置、网络设备
WO2020061995A1 (zh) 一种信息传输方法及装置、终端、网络设备
US20220007449A1 (en) Wireless communication method, terminal device and network device
US20210160751A1 (en) Cell handover method, network node and terminal device
EP4007369B1 (en) Information processing method and terminal device
WO2021212258A1 (zh) 一种上报指示信息的方法及装置、终端设备、网络设备
WO2020223972A1 (zh) 一种无线资源控制消息的处理方法、设备及存储介质
WO2020082327A1 (zh) 一种切换过程中的信令交互方法及装置、网络设备
WO2020029275A1 (zh) 一种无线通信方法、终端设备和网络设备
WO2020061943A1 (zh) 一种数据传输方法、终端设备及网络设备
CN111989951B (zh) 一种数据转发方法及装置、网络设备
US20220182895A1 (en) Wireless communication method and apparatus, and network device
CN111869262B (zh) 一种基站切换方法及装置、网络设备
WO2020211066A1 (zh) 用于切换网络设备的方法、终端设备和网络设备

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19913514

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 19913514

Country of ref document: EP

Kind code of ref document: A1